Notification rules

A rule is one statement: when a resource matches these conditions, deliver to these destinations, or suppress it. Rules are ordered, and the first one that matches a resource claims it.

Prerequisites

At least one notification destination. A rule with the Deliver outcome cannot be saved without one.

Where rules live

A policy and its insight share one list. Editing it from the policy wizard and editing it from the insight page change the same rules.

Create a rule

1. Open the Notification rules panel and click Add rule.
2. Give the rule a name. The name appears in the rules list, in the match preview, and in {{ rule.name }} if your message uses it.
3. Add conditions. A rule with no conditions matches every resource — see Defaults.
4. Choose an outcome:
   • Deliver — send a notification to the selected destinations.
   • Suppress — record the match and send nothing.
5. For Deliver, select destinations. Each destination gets its own message content — see Message content.
6. Drag the rule into position. Rules are evaluated top to bottom.
7. Click Save rules.

Conditions

Conditions read attributes of the affected resource. A resource must match every condition on the rule, and within one condition it matches any of the values.

A rule with Environment: prod, staging and Cloud: aws matches an AWS resource in either environment, and nothing on GCP.

App, Environment, and Owner depend on the corresponding platform features being enabled for your organization. Where a field’s values are not scoped to the insight — Environment and Owner draw from the whole tenant — the value picker says so.

A resource can belong to several apps or environments at once, so those conditions match when any value overlaps.

Order and first match

Each resource is claimed by the first rule that matches it, so ordering is the routing logic. Put narrow rules above broad ones.

A rule ordered below an unconditional rule can never run. The rules list marks those rules as unreachable — move them up or give the rule above them conditions.

Defaults

A rule with no conditions matches everything. Each list holds at most one, pinned to the bottom of the list.

• Insight default — click Configure insight default in the pinned slot. Without one, the slot reads Inherited default: unmatched resources continue to the organization’s rules.
• Organization default — set it under Settings > Organization > Insights. Without one, no notification is sent about unmatched resources at all.

A default needs a destination before the list can be saved.

Suppress an exception

Suppress claims a resource and sends nothing, which is how you carve an exception out of a broader rule without editing that rule.

To stop notifying about one app’s resources while every other production finding still pages:

1. Add a rule with App: <YOUR_APP> and the Suppress outcome.
2. Order it above the rule that delivers production findings.

Suppress affects notifications, not the insight. The resources stay visible in Insights and still count as violations. To stop an insight from firing at all, use silencing instead.

Disable a rule

Toggle a rule to Disabled to skip it during evaluation while keeping it in the list. Rules below it then see the resources it would have claimed.

A disabled rule keeps the record of what it already notified about, so re-enabling it does not re-send everything it matched before.

Preview which resources a rule claims

Click See matching resources on a rule to project the list you are editing against the insight’s current resources. The preview accounts for the rules above — the count is what the rule claims after they take theirs.

If a rule is showing 0 matches, it typically means a rule above is claiming matching resources first.

Previews are only available where the list is scoped to an insight. The organization default list has no insight behind it and offers no preview.

Limits

If an insight exceeds the enumeration cap, its counts are a lower bound and the insight is skipped for that cycle rather than notified on a partial list.

Next steps

• Message content — write what each destination receives
• Webhook receivers — the payload schema and signature verification