Features 3 min read

Alert Rules

Get notified when threats matching your criteria appear. Set up keyword and entity-based alerts.

Alert rules let you define conditions that, when matched by a new or updated cluster, trigger a notification. Instead of checking the feed manually, you set your criteria once and ThreatCluster watches for you.

How Alert Rules Work

Every time a new cluster is created or an existing cluster is significantly updated, ThreatCluster evaluates it against all of your active alert rules. If the cluster meets a rule's conditions, you receive a notification through your configured channels.

Creating a Rule

To create an alert rule, go to Settings > Alert Rules and click New Rule. Each rule has the following components:

Rule Name

Give the rule a descriptive name so you can identify it later -- for example, "Critical CVEs" or "Ransomware targeting healthcare."

Conditions

Combine one or more conditions to define what triggers the alert:

  • Keywords -- Match clusters containing specific terms in their title, summary, or article content. Works the same way as tracked keywords.
  • Entity types -- Restrict matching to specific entity categories. For example, trigger only when a cluster involves a ransomware group or a specific CVE.
  • Entity values -- Match a specific entity by name (e.g., "LockBit", "CVE-2024-3400").
Tip: Combining conditions makes rules more precise. A rule with keyword "healthcare" + entity type "Ransomware Group" will fire far less often than one with just the keyword alone.

Notification Channels

When a rule triggers, you can be notified through:

  • In-app notifications -- A badge appears on the bell icon in the top navigation. Click it to see all recent alerts and jump directly to the matching cluster.
  • Email digest -- Receive a periodic email summarizing all alerts that fired since the last digest. Configure digest frequency (immediate, daily, or weekly) in Settings > Notifications.
Note: Email notifications require a verified email address on your account. Check Settings > Account if you are not receiving emails.

Managing Rules

From Settings > Alert Rules, you can manage all of your rules:

  • Enable/Disable -- Toggle a rule on or off without deleting it. Useful for temporarily silencing alerts during noisy periods.
  • Edit -- Update a rule's name, conditions, or notification preferences at any time.
  • Delete -- Permanently remove a rule you no longer need.

Each rule displays a summary of its conditions and a count of how many times it has triggered, so you can gauge whether it's too broad or too narrow.

Best Practices

Keep rules focused. A single broad keyword like "attack" will match nearly every cluster. Pair keywords with entity types or score thresholds to get actionable alerts.

Use entity types for precision. Instead of tracking "LockBit" as a keyword (which could match articles merely mentioning the group in passing), create a rule with entity type "Ransomware Group" and keyword "LockBit" to match clusters where LockBit is a recognized actor.

Review trigger counts. If a rule has fired dozens of times in a week, it may be too broad. If it has never fired, the conditions might be too restrictive or the topic may not be active in current threat reporting.

Use separate rules for separate concerns. Rather than building one complex rule that tries to cover everything, create dedicated rules for each monitoring objective. This makes it easier to tune, disable, or delete individual rules without affecting others.