# Event Rules

Event Rules (formerly Alerts) allow you to define when and how you'll be notified of important changes and findings. You can configure rules to send notifications via email, trigger actions in integrated tools like Jira and Slack, or send webhooks to your own applications.

## Setting up event rules

Event rules are highly configurable. To add an event rule, go to *Events →* [Event Rules](https://app.halosecurity.com/user/settings/event-rules/) and click the **+** icon. Give your event rule a name.

Each rule consists of two parts:

1. Rules that determine which events will trigger notifications
2. Actions that define how you'll be notified

## Add rules

You can configure multiple conditions to determine which events will trigger your actions:

You can filter the rules that will trigger actions for the Event Rule on:

* **Match Key**: Only match [event types](/docs/platform/events/event-types.md) with selected key(s).
* **Match Tag**: Only match events for targets having the selected tag(s).
* **Exclude Tag**: Exclude events for targets with the selected tag(s).
* **Issue Severity**: For issue events, only match issues with the selected severity.
* **Target**: Only match events related to the selected target(s).
* **Host:** Only match events with the selected host(s).
* **Options:** Additional filtering criteria including:
  * **Require CISA KEV:** Only include issues designated as Known Exploited Vulnerabilities by CISA.

## Add actions

Choose one or more actions to trigger when events match your rules.

### Integration

Connect with workflow tools like [Jira](/docs/integrations/workflow-integrations/jira.md) or [Slack](/docs/integrations/workflow-integrations/slack.md). Select an existing integration and specify the profile to use when events match your rules.

### User Email

Send email notifications to all or specific users on your account.

{% hint style="info" %}
**Default Rules:** We include several predefined email alerts. Individual users can manage their email preferences under [Account → Settings → Notifications](https://app.halosecurity.com/user/account/notifications) or opt-out of default rules on the [Event Rules](https://app.halosecurity.com/user/settings/event-rules/) page.

Default email alerts are triggered for the following [event types](/docs/platform/events/event-types.md):

* New issue (`issue-add`)
* All PCI related events (`pci-...`)
  {% endhint %}

### Webhooks

Send event notifications to your own applications via [webhook URLs](#webhooks).

## Managing event rules

To edit or remove a rule:

1. Navigate to *Events →* [Event Rules](https://app.halosecurity.com/user/settings/event-rules/)
2. Click the cog icon next to the rule you want to modify
3. Make your changes or click the trash icon to delete
4. Click Save to apply any changes


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.halosecurity.com/docs/platform/events/alerts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.