> ## Documentation Index
> Fetch the complete documentation index at: https://www.osohq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> Get alerted when Oso detects unsanctioned agents or sensitive data in sessions.

Oso monitors agent activity and generates alerts based on your [policies](/docs/oso-for-agents/policies). Alerts are delivered via Slack, and each alert links to investigation details.

## What generates an alert

Any policy with an **Alert** response fires when its conditions match - there's no separate list of built-in alert types to turn on. Two common examples:

### Unsanctioned agent usage

A policy with an **Actor** condition on agent review status (Unreviewed or Disallowed) and an Alert response fires whenever that agent is detected, whether through an EDR scan, browser extension, or edge proxy traffic.

### Content patterns

A policy with a **Resource** condition on a [content type](/docs/oso-for-agents/content-tags) and an Alert response fires when that pattern is detected in a monitored session - secrets like API keys and credentials, PII like names and social security numbers, or a custom regex pattern specific to your organization.

## Notification and investigation

### Slack notifications

Alerts are delivered to Slack. Each notification includes the alert type, the agent and user involved, the detection source, and a direct link to the trigger details page in Oso.

To set up Slack notifications, see [Slack integration](/docs/oso-for-agents/integrations/slack).

### Investigating an alert

The trigger details page shows:

* **What happened**: the specific event that triggered the alert
* **Why it was flagged**: which rule or pattern matched
* **Context**: the relevant agent, tool, user, and device
* **Prior violations**: previous alerts from the same trigger

For alerts on monitored agents, you can drill into the [session timeline](/docs/oso-for-agents/session-monitoring) to see the full sequence of exchanges (prompts, completions, and tool calls) that led to the alert.

## Configuring alerts

Alerts are configured on the [Policies](/docs/oso-for-agents/policies) page - there's no separate alerts settings screen. Add an Alert response to any policy to set its severity and how often it notifies your team.

To connect the Slack channel alerts route to, see [Slack integration](/docs/oso-for-agents/integrations/slack).