Watch alerts: email and inbox
Severity levels, what each alert carries, acknowledge/resolve, and why repeats do not re-email you.
Last updated · September 2026
On this page
Every high or critical incident lands in two places: your inbox (Dashboard → Watch alerts) and your email. Both carry the same evidence, host, fingerprint, and AI triage — either one is enough to work the incident.
Severity levels
| Level | Meaning | Notifies |
|---|---|---|
| critical | Likely compromise or imminent outage shape (reserved for escalations). | Email + inbox. |
| high | Auth bursts, new listeners, watched-file changes, full disks. | Email + inbox. |
| info | Gone listeners, load/memory pressure, coverage notes. | Inbox only — no email. |
Repeats update, they do not re-email
Each incident carries a stable fingerprint. Repeat observations inside 24 hours refresh last-seen on the same alert instead of opening a new one, and email fires once, on first sighting (capped at 20 a day per account). A burst that lasts all night is one alert with a fresh timestamp — not fifty emails.
Working an alert
- Open it for evidence, host, signal, and the AI triage with discriminating next checks.
- Acknowledge when owned; resolve when handled. Both are timestamped on the alert.
- Act on the host: bolt watch events for the local trail, bolt watch respond for an authorized playbook.
No email?
- Check spam for the alert@ sender, then Dashboard → Watch alerts — the inbox is the source of truth.
- On the host: bolt login (signed out means local-only), phonehome on in policy, host not disabled.
- Info-level findings never email by design; escalate the signal threshold instead of expecting mail.
Was this page helpful?