Alerts

VeraID’s alerting system delivers real-time notifications when security-relevant events occur across your non-human identity landscape. Alerts are generated by threat detection, policy evaluation, credential lifecycle monitoring, and configurable rules.

Alert Types

VeraID generates six categories of alerts:

Type	Description	Typical Trigger
ANOMALY_DETECTED	Behavioral anomaly identified by ITDR.	Identity activity deviates from baseline patterns.
POLICY_VIOLATION	An access attempt was denied by policy evaluation.	Identity attempted an action blocked by a DENY policy.
CREDENTIAL_EXPIRING	A credential is approaching its expiration date.	API key, token, or certificate expires within the configured threshold.
HIGH_RISK_IDENTITY	An identity’s risk score has exceeded a defined threshold.	Risk score crosses from moderate to high due to posture changes.
UNUSUAL_ACTIVITY	A cluster of low-confidence anomalies aggregated into a significant signal.	Multiple minor deviations that individually would not alert.
RATE_LIMIT_EXCEEDED	An identity has exceeded its rate limit policy.	Request volume exceeds the maxRequests threshold.

Alert Severity

Each alert is assigned a severity level based on the nature and potential impact of the event:

Severity	Description	Expected Response Time
LOW	Informational. No immediate risk.	Review within 1 week.
MEDIUM	Potential risk that warrants investigation.	Review within 24 hours.
HIGH	Significant risk requiring prompt attention.	Investigate within 4 hours.
CRITICAL	Active threat or imminent security impact.	Respond immediately.

Danger

CRITICAL alerts indicate a high probability of active compromise or imminent credential exposure. Configure automated responses for CRITICAL alerts to contain threats before human review. See Alert Rules for automated response configuration.

Alert Status Workflow

Alerts follow a defined lifecycle from detection to resolution:

OPEN → ACKNOWLEDGED → RESOLVED
                    → DISMISSED

Status	Description
OPEN	Newly created alert, awaiting review.
ACKNOWLEDGED	A team member has seen the alert and is investigating.
RESOLVED	The underlying issue has been addressed and remediated.
DISMISSED	The alert was reviewed and determined to be a false positive or acceptable risk.

Note

Dismissed alerts are retained in the audit log for compliance and can be reviewed later. Dismissing an alert does not suppress future alerts of the same type — configure alert rules to adjust thresholds if an alert type generates excessive false positives.

Alerts API

List Alerts

Retrieve alerts filtered by status, severity, and type:

# Get all open high-severity alerts
curl -H "Authorization: Bearer $API_KEY" \
  "https://app.veraid.io/api/v1/alerts?status=OPEN&severity=HIGH"

# Get all alerts for a specific identity
curl -H "Authorization: Bearer $API_KEY" \
  "https://app.veraid.io/api/v1/alerts?identityId=id_svc_deploy_bot"

# Get alerts by type
curl -H "Authorization: Bearer $API_KEY" \
  "https://app.veraid.io/api/v1/alerts?type=ANOMALY_DETECTED&severity=CRITICAL"

Response:

{
  "alerts": [
    {
      "id": "alert_abc123",
      "type": "ANOMALY_DETECTED",
      "severity": "HIGH",
      "status": "OPEN",
      "title": "Unusual frequency detected for svc-payment-processor",
      "description": "4,832 requests in the last hour, baseline is 215 ± 42.",
      "identityId": "id_svc_payment_processor",
      "identityName": "svc-payment-processor",
      "createdAt": "2026-03-19T14:22:00Z",
      "metadata": {
        "anomalyType": "UNUSUAL_FREQUENCY",
        "confidence": 0.96,
        "baselineMean": 215,
        "observedValue": 4832
      }
    }
  ],
  "pagination": {
    "total": 47,
    "page": 1,
    "pageSize": 20,
    "hasMore": true
  }
}

Query Parameters:

Parameter	Type	Description
status	string	Filter by status: OPEN, ACKNOWLEDGED, RESOLVED, DISMISSED.
severity	string	Filter by severity: LOW, MEDIUM, HIGH, CRITICAL.
type	string	Filter by alert type (see Alert Types).
identityId	string	Filter alerts for a specific identity.
from	string	ISO 8601 start date for time range filter.
to	string	ISO 8601 end date for time range filter.
page	integer	Page number for pagination. Default: 1.
pageSize	integer	Results per page. Default: 20, max: 100.

Acknowledge an Alert

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "note": "Investigating the frequency spike. May be related to batch processing job."
  }' \
  https://app.veraid.io/api/v1/alerts/alert_abc123/acknowledge

Response:

{
  "id": "alert_abc123",
  "status": "ACKNOWLEDGED",
  "acknowledgedBy": "user_security_analyst",
  "acknowledgedAt": "2026-03-19T14:35:00Z",
  "note": "Investigating the frequency spike. May be related to batch processing job."
}

Resolve an Alert

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "resolution": "Confirmed batch processing job caused the spike. Added rate limit exception for batch window.",
    "actions_taken": [
      "Added TIME_WINDOW condition to rate limit policy for batch hours",
      "Verified no unauthorized access occurred",
      "Updated baseline to account for batch schedule"
    ]
  }' \
  https://app.veraid.io/api/v1/alerts/alert_abc123/resolve

Response:

{
  "id": "alert_abc123",
  "status": "RESOLVED",
  "resolvedBy": "user_security_analyst",
  "resolvedAt": "2026-03-19T15:10:00Z",
  "resolution": "Confirmed batch processing job caused the spike. Added rate limit exception for batch window.",
  "timeToAcknowledge": "13m",
  "timeToResolve": "48m"
}

Alert Rules

Alert rules are configurable triggers that define when alerts are generated. Rules allow you to customize thresholds, target specific identities or groups, and set the severity of resulting alerts.

Rule Types

Rule Type	Description	Configurable Parameters
Credential expiry	Alert when credentials approach expiration.	daysBeforeExpiry: 7, 14, 30, 60, 90.
Risk score threshold	Alert when an identity’s risk score exceeds a limit.	riskThreshold: 0–100.
Failed authentication	Alert after repeated auth failures.	maxFailures: count, windowMinutes: time window.
Policy violation frequency	Alert when an identity accumulates policy violations.	maxViolations: count, windowHours: time window.
AI cost threshold	Alert when AI agent spend exceeds a budget.	maxCostUSD: dollar amount, period: daily, weekly, monthly.
AI quota threshold	Alert when AI agent token usage approaches quota.	quotaPercent: percentage of allocated quota.

Creating Alert Rules

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "credential-expiry-30d",
    "description": "Alert 30 days before credential expiration",
    "type": "CREDENTIAL_EXPIRY",
    "severity": "MEDIUM",
    "config": {
      "daysBeforeExpiry": 30
    },
    "targets": {
      "groups": ["group:production-services"],
      "identityTypes": ["service_account", "api_key"]
    },
    "isActive": true
  }' \
  https://app.veraid.io/api/v1/alerts/rules

More rule examples:

// Risk score alert
{
  "name": "high-risk-identity-alert",
  "type": "RISK_SCORE_THRESHOLD",
  "severity": "HIGH",
  "config": {
    "riskThreshold": 70
  },
  "targets": {
    "groups": ["group:all-identities"]
  },
  "isActive": true
}

// Failed auth alert
{
  "name": "brute-force-detection",
  "type": "FAILED_AUTH",
  "severity": "CRITICAL",
  "config": {
    "maxFailures": 10,
    "windowMinutes": 5
  },
  "targets": {
    "groups": ["group:all-identities"]
  },
  "isActive": true
}

// AI cost alert
{
  "name": "ai-agent-daily-budget",
  "type": "AI_COST_THRESHOLD",
  "severity": "HIGH",
  "config": {
    "maxCostUSD": 500,
    "period": "daily"
  },
  "targets": {
    "identityTypes": ["ai_agent"]
  },
  "isActive": true
}

Tip

Create layered alert rules with increasing severity. For credential expiry, set a MEDIUM alert at 30 days, HIGH at 14 days, and CRITICAL at 7 days. This gives teams adequate time to rotate credentials before they expire.

Real-Time Delivery via SSE

VeraID supports Server-Sent Events (SSE) for real-time alert delivery. Connect to the SSE endpoint to receive alerts as they are generated, without polling.

Connecting to the SSE Stream

const eventSource = new EventSource(
  'https://app.veraid.io/api/v1/alerts/stream',
  {
    headers: {
      'Authorization': `Bearer ${apiKey}`
    }
  }
);

eventSource.addEventListener('alert', (event) => {
  const alert = JSON.parse(event.data);
  console.log(`[${alert.severity}] ${alert.title}`);

  if (alert.severity === 'CRITICAL') {
    // Trigger automated response
    triggerIncidentResponse(alert);
  }
});

eventSource.addEventListener('heartbeat', () => {
  // Connection keepalive, sent every 30 seconds
});

eventSource.onerror = (error) => {
  console.error('SSE connection error:', error);
  // Implement reconnection logic
};

SSE Event Types

Event	Description
alert	A new alert has been created. Payload is the full alert object.
alert_updated	An alert status has changed (acknowledged, resolved, dismissed).
heartbeat	Connection keepalive, sent every 30 seconds. No payload.

# Connect via curl for testing
curl -N \
  -H "Authorization: Bearer $API_KEY" \
  -H "Accept: text/event-stream" \
  https://app.veraid.io/api/v1/alerts/stream

Note

SSE connections are long-lived HTTP connections. Implement automatic reconnection with exponential backoff in production clients. The server sends heartbeat events every 30 seconds — if no heartbeat is received within 60 seconds, reconnect.

Integrating with External Systems

Alerts can be forwarded to external systems via webhooks:

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "slack-critical-alerts",
    "url": "https://hooks.slack.com/services/T.../B.../xxx",
    "events": ["alert"],
    "filters": {
      "minSeverity": "HIGH"
    },
    "headers": {
      "Content-Type": "application/json"
    },
    "isActive": true
  }' \
  https://app.veraid.io/api/v1/webhooks

Supported destinations include Slack, PagerDuty, Opsgenie, Microsoft Teams, and any HTTP endpoint that accepts JSON payloads.

Next Steps

• Threat Detection — Understand how behavioral anomalies generate alerts.
• Security Posture — Monitor your overall identity security health.
• Policy Evaluation — Learn how policy violations trigger alerts.