Skip to main content
Oso monitors agent activity and generates alerts based on your policies. Alerts are delivered via Slack, and each alert links to investigation details.

What generates an alert

Any policy with an Alert response fires when its conditions match - there’s no separate list of built-in alert types to turn on. Two common examples:

Unsanctioned agent usage

A policy with an Actor condition on agent review status (Unreviewed or Disallowed) and an Alert response fires whenever that agent is detected, whether through an EDR scan, browser extension, or edge proxy traffic.

Content patterns

A policy with a Resource condition on a content type and an Alert response fires when that pattern is detected in a monitored session - secrets like API keys and credentials, PII like names and social security numbers, or a custom regex pattern specific to your organization.

Notification and investigation

Slack notifications

Alerts are delivered to Slack. Each notification includes the alert type, the agent and user involved, the detection source, and a direct link to the trigger details page in Oso. To set up Slack notifications, see Slack integration.

Investigating an alert

The trigger details page shows:
  • What happened: the specific event that triggered the alert
  • Why it was flagged: which rule or pattern matched
  • Context: the relevant agent, tool, user, and device
  • Prior violations: previous alerts from the same trigger
For alerts on monitored agents, you can drill into the session timeline to see the full sequence of exchanges (prompts, completions, and tool calls) that led to the alert.

Configuring alerts

Alerts are configured on the Policies page - there’s no separate alerts settings screen. Add an Alert response to any policy to set its severity and how often it notifies your team. To connect the Slack channel alerts route to, see Slack integration.