Detectors and Alerts

The detector stack

Edge runs over twenty detectors on a rolling schedule. Fast detectors run every minute and catch acute incidents: traffic spikes, credential-stuffing signatures, path abuse, origin slowdowns. Hourly detectors catch the slower patterns: gradual escalation, bot-dominated networks, catalogue crawling, reconnaissance scanners, fake Googlebots, repeat offenders. Certificate checks run every six hours, and a continuous heartbeat check pages you if your data feed itself goes silent.

A handful of high-power detectors ship disabled so you can validate their thresholds against your own traffic before turning them on from the Rules page. The full catalogue, with what each one catches and its default state, is in How Detectors Work.

When an alert fires

1. The detector opens an alert with status "open".
2. Notifications go out on your configured channels: email, webhook, Microsoft Teams, or Slack (see Sending Alerts to Teams and Slack).
3. The alert appears on the Alerts page and the Overview active-alerts panel.
4. Each later evaluation updates the alert while the condition persists, and most detectors auto-resolve it when the condition clears.

What an alert gives you

Open any alert and you get, in reading order:

• A one-sentence summary in natural language, plus a short AI-written brief explaining what happened and why it matters.
• A detector-specific playbook: what to check, and a "when to close" criterion.
• Where the alert maps to a "stop this traffic" situation, a drafted eCDN rule you can copy into Business Manager or apply in one click (Applying and Rolling Back Protections).
• If other detectors are firing on the same target, a banner linking the correlated incident so you investigate once (Correlated Incidents).

Alert lifecycle

• Open — the detector is currently tripping
• Acknowledged — an operator has seen it and is investigating
• Resolved — the condition cleared (automatic) or an operator resolved it manually

For the full triage workflow see Investigating an Alert.