Create Custom Alert Rules
Last update：2026-08-20 15:59:54
Reading time: About 8 minutes
You can configure custom alert rules based on your business needs. This document walks you through configuring a custom alert rule.
Path: Analysis & Logs > Alert Management > Alert Rules > Add Alert Rule
Configuration Steps
Step 1: Configure Basic Information
- Configure the Rule Name and Rule Description
Step 2: Configure the Alert Rule
-
Configure the Alert Level: Sets the level assigned when the alert is triggered, which determines the alert’s handling priority. Available levels are Emergency, Major, and Warning. We recommend choosing based on business impact: select Emergency when core business is affected and requires immediate action; select Major when the issue needs close attention but the impact is manageable; select Warning when you only need to be aware of the issue and no immediate action is required.
-
Select the Monitoring Object:
- L7 Protection: Monitors hostnames.
- L4 Protection: Monitors resource groups.
Note: For L7 Protection, only hostnames that already have security protection enabled are available for selection.
-
Configure the Statistics Method:
- Separate Statistics: Monitors data for each object separately.
- Aggregated Statistics: Monitors aggregated data across objects. Supports up to 1,000 monitored objects; if the number exceeds 1,000, the system automatically uses only the first 1,000.
-
Configure the Trigger Condition:
An alert trigger condition consists of three parts: Statistical Period + Statistical Metric + Threshold.
Statistical Period
A statistical period consists of: Statistical Granularity + Number of Consecutive Data Points.
- Statistical Granularity: Defines the interval between metric checks.
- Number of Consecutive Data Points: Defines how long the check condition must persist.
For example, if you select a 1-minute granularity with 3 consecutive data points, the system checks the metric once every minute; if all 3 checks reach the configured threshold for the statistical metric, the alert is triggered.
| Configuration Item | Available Options |
|---|---|
| N-Minute Statistical Granularity | 1 minute, 2 minutes, 5 minutes, 10 minutes |
| N Consecutive Data Points | 1, 2, 3, 4, 5 |
The alert resolution condition is also determined by the Statistical Period: if the trigger condition is not met for N consecutive periods, the alert is resolved.
Statistical Metric
A statistical metric defines the monitoring expression to be calculated. A statistical metric consists of a Basic Metric + Filter Condition; together they narrow the metric down to the data that matches the filter condition for statistics.
| Monitoring Object | Configuration Item | Available Options | Metric Calculation Logic Example |
|---|---|---|---|
| L7 Protection | Basic Metric | Requests QPS Back-to-Origin Requests Back-to-Origin QPS |
Basic Metric: Requests Filter Fields: 1. WAF - Rule Type = XSS, SQL; 2. Final Security Action = Deny This calculates: The number of requests where the Final Security Action equals Deny and the triggered WAF Rule Type equals XSS or SQL Note: Select filter fields for security features that are already enabled, to ensure the system can monitor the relevant data and send alerts. |
| Filter Condition | Policy: Policy Type, Final Security Action Request: Path, Request Method, Status Code DDoS Protection: Policy Name WAF: Rule Type |
||
| L4 Protection | Basic Metric | Peak Attack Bandwidth | Basic Metric: Peak DDoS Attack Bandwidth Filter Field: DDoS Attack Type = SYN, ACK This calculates: The sum of the peak attack bandwidth for SYN Flood and ACK Flood |
| Filter Condition | CPS Blackhole (if any CPS IP within the resource group is blackholed, the alert is triggered; when the blackhole is lifted, the alert is resolved) |
Threshold Operators
| Operator Type | Operator | Example |
|---|---|---|
| Numeric Comparison | > , >= | Example: Requests > 100 |
| <，<= | Example: Requests < 100 | |
| =, != | Example: Requests = 100 | |
| Cross-period Fluctuation | Up from yesterday, Down from yesterday | Example: Back-to-Origin Requests increased day-over-day by 30% compared to yesterday Day-over-Day Calculation Rules |
| Ratio Calculation | Proportion ≥, Proportion < | Example: Back-to-Origin 5xx Error Requests as a percentage ≥ 20% Basic Metric: Back-to-Origin Requests as a percentage ≥ 20% Filter Condition: Status Code equals 5xx Note: For percentage calculations, you must add a filter condition, which is used to calculate the percentage of matching requests. |
Step 3: Configure Alert Notifications
- Configure the Alert Frequency:
| Configuration Item | Available Options |
|---|---|
| Alert Every N Minutes | Only alert at first time; every 5, 10, 15, or 30 minutes; or once every 1/2/6/12/24 hours |
| Alert Cleared Notification | Yes / No |
For example, if an alert lasts 12 minutes and you configure it to alert once every 5 minutes with alert cleared notifications enabled, the first notification is sent when the alert triggers, a second is sent 5 minutes later, a third 10 minutes later, and a recovery notification is pushed when the alert resolves at 12 minutes.
- Configure the Notification Period:
Configure the time window during which you receive alert notifications. Outside this window, alerts are still logged in the alert history, but no notifications are sent.
- Set the time range: Start Time and End Time
- Confirm the time zone
- Select the days it applies to: Monday through Sunday
Note: If the start time is later than the end time, the window spans midnight. For example, configuring
23:00-02:00means notifications are sent from 23:00 the same day to 02:00 the next day.
-
Select the Notification Language: Simplified Chinese or English.
-
Configure the Notification Method:
- Email: Add a contact or contact group under Account Management > Contact Management first. For details, see Contact Management.
- Robot: Add one under Message Center > Robot Management. Supports WeCom, DingTalk, Telegram, Feishu, Lark, and Slack.
Alert Configuration Examples
Scenario 1: Detecting an L7 DDoS Attack and Blocking Requests When AI Intelligent Protection Deploys a Rule
Scenario Description
When a new type of L7 DDoS attack occurs, AI Intelligent Protection identifies the threat based on learned attack signatures and deploys an AI protection rule. Alerts let you know promptly when a rule is deployed and what action was taken on requests, so you can assess risks such as false positives.
Configuration Walkthrough
-
On the Alert Management page, click Add Alert Rule to enter the alert rule configuration page.
-
Configure Basic Information: Rule Name and Description (optional).
-
Configuration details:
- Select the Alert Level.
- Select the Monitoring Object: L7 Protection - All Hostnames.
- Select the Statistical Method: Separate
- Configure Statistical Metrics: For example, 1 minute granularity, continuous for 3 statistical points; trigger an alert only when all conditions are met. Configure the basic metric formula such as Requests > 100 and the filters such as Action equals Block, and DDoS Protection – Policy Name = Adaptive Protection.
- Configure the alert frequency: For example, Repeat alert every 5 minutes. Adaptive Protection rules will be deleted automatically 15 minutes after an attack ends. You can also configure the system to resolve the alert when trigger conditions are not met for 5 consecutive statistical period.
-
Configure Alert Notification: Select Yes for Alert Cleared Notification, configure the Notification Period to the default (All-day), Notification Language, and Notification Method.