Alert rules

An alert rule is the bridge between a monitor target and a channel. Each rule says: when this signal crosses this threshold over this window, fire this severity to this channel.

Anatomy of a rule

  • Operator — one of gt, gte, lt, lte, eq, neq.
  • Threshold — a floating-point number compared against the target's measured value.
  • Window — a duration in seconds. This is the rule's cooldown, not a measurement window: once the rule fires it stays quiet for at least this long before it can fire again. It does not bound how much history the metric looks at — count and rate metrics are computed over whatever the poller fetched this cycle (the block range since the last poll). See Idempotency & storm prevention below.
  • Severity — info, warning, or critical. Used for routing, dashboard sorting, and channel formatting.
  • Channels — one primary channel, plus up to 20 optional additional channels. When the rule fires, IMAA delivers to all of them in parallel — no need to duplicate the rule to reach more than one destination.

Rule types

Most alert rules compare a threshold against a monitor target value. Two additional categories cover bridge and agent monitoring:

  • Standard rules — threshold comparison against a target value. Covers event_frequency, tx_rate, revert_rate, value_transfer, the oracle and anomaly targets, the Solana sol_* targets, and all other numeric targets.
  • Bridge rules — bridge_dvn_change fires when a route's LayerZero V2 DVN configuration changes on-chain (DVN added/removed, threshold decreased, unknown operator). Its severity_threshold config controls the minimum risk level that triggers a fire, and alert_on_unknown_dvn toggles alerting on unrecognised operators. See DVN Detection.
  • Agent rules — agent_response_drift, agent_latency_spike, agent_signature_invalid, agent_endpoint_down, and agent_model_swap_suspected apply to monitored AI agents. See AI Agent Monitoring.

Compound conditions

A rule can combine up to three sub-conditions with AND / OR logic instead of a single threshold. Each sub-condition has its own target type, operator, and threshold, and can be individually negated. This lets you express rules like tx rate > 100 AND revert rate > 0.1 — a spike that is also failing — without firing on either signal alone. Build compound conditions with the condition builder on the alert-rule form; the sub-condition target types are the same numeric targets listed above.

One-click templates

On any contract detail page, click Apply Templates to get a set of monitor targets and alert rules pre-configured for the contract's category. Select a category and a notification channel; IMAA creates the targets and rules in one action.

Available categories:

  • Lending — large value transfer + tx rate spike + anomaly detection.
  • DEX — large value transfer + tx rate spike + anomaly detection.
  • Bridge — large value transfer + tx rate spike + anomaly detection.
  • Oracle — price deviation + staleness + anomaly detection.
  • Governance — tx rate spike + anomaly detection + large value transfer.

Templates are a starting point. Edit or delete any generated rule like you would any other.

Idempotency & storm prevention

Once a rule fires, it is suppressed for window_seconds before it can fire again. This is intentional: a rule with a 60-second window evaluating a signal that stays above threshold should not generate one alert per poll for 30 minutes.

If you want faster repeat alerts when a condition persists, shorten the window. If you want slower repeats, lengthen it. There is no separate cooldown setting — the window is the cooldown.

Worked example

Goal: alert me when a poll picks up more than 5 Transfer events on a particular ERC-20, and don't re-alert for at least a minute.

  1. Add the ERC-20 as a contract. ABI auto-fetches.
  2. Create an event_frequency monitor target and pick Transfer from the event list.
  3. Create an alert rule against that target with operator gt, threshold 5, window 60, severity warning, and your Slack channel.

IMAA polls the contract on your tier's schedule, counts the Transfer logs in that poll's block range, and posts to Slack the first time the count exceeds 5 — then stays quiet for at least 60 seconds (the window) before it can fire again.