What generates an alert
Any policy with an Alert response fires when its conditions match - there’s no separate list of built-in alert types to turn on. Two common examples:Unsanctioned agent usage
A policy with an Actor condition on agent review status (Unreviewed or Disallowed) and an Alert response fires whenever that agent is detected, whether through an EDR scan, browser extension, or edge proxy traffic.Content patterns
A policy with a Resource condition on a content type and an Alert response fires when that pattern is detected in a monitored session - secrets like API keys and credentials, PII like names and social security numbers, or a custom regex pattern specific to your organization.Notification and investigation
Slack notifications
Alerts are delivered to Slack. Each notification includes the alert type, the agent and user involved, the detection source, and a direct link to the trigger details page in Oso. To set up Slack notifications, see Slack integration.Investigating an alert
The trigger details page shows:- What happened: the specific event that triggered the alert
- Why it was flagged: which rule or pattern matched
- Context: the relevant agent, tool, user, and device
- Prior violations: previous alerts from the same trigger