# Alerts & Events

The Alerts & Events feed is a real-time log of everything happening across your agent fleet — every spend, policy violation, balance shift, and escrow event. It is the fastest way to identify issues, understand agent behaviour, and respond to anomalies.

Navigate here from the sidebar under **Events**.

***

## The live feed

The events feed shows every event emitted across your organisation, ordered newest-first. Each event shows:

* **Timestamp** - precise to the millisecond
* **Event type** - e.g. `transaction.completed`, `transaction.blocked`, `balance.low`
* **Vault** - which vault the event originated from (clickable — navigates to Vault Detail)
* **Summary** - a human-readable description of the event
* **Details** - expandable JSON payload

The feed updates in real-time without requiring a page refresh.

***

## Filtering

Filter the feed by:

* **Event type** - select one or more event types from the full catalogue
* **Vault** - narrow to events from a specific vault
* **Severity** - `info`, `warning`, `critical`
* **Date range** - query historical events up to 90 days back

***

## Severity levels

| Severity   | Event types                                                                                     |
| ---------- | ----------------------------------------------------------------------------------------------- |
| `info`     | `transaction.completed`, `wallet.created`, `wallet.funded`, `escrow.created`, `escrow.released` |
| `warning`  | `balance.low`, `transaction.blocked`, `escrow.disputed`, `policy.expired`                       |
| `critical` | `wallet.frozen` (manual), `escrow.refunded` (after dispute)                                     |

***

## One-click wallet freeze

On any event row where the vault is operational, a **Freeze Vault** button is available. Click it to immediately freeze that vault — no navigation required. Confirmation is required for freeze actions.

***

## Alert configuration

Configure per-vault alert thresholds and notification channels from the Vault Detail view or globally via **Settings → Alerts**.

### Alert types

| Alert                 | Configuration                                                    |
| --------------------- | ---------------------------------------------------------------- |
| **Balance low**       | Set a per-vault threshold. Alert fires when balance drops below. |
| **Policy violation**  | Fires on any `transaction.blocked` event. On by default.         |
| **Inactivity**        | Alert if a wallet has had no transactions for N hours.           |
| **Velocity spike**    | Alert if transactions per hour exceeds N.                        |
| **Large transaction** | Alert if a single transaction exceeds $N.                        |

### Notification channels

* **Dashboard** - events appear in this feed (always on)
* **Email** - configure one or more email addresses per alert type
* **Webhooks** - deliver events to your server (configure in Settings → Webhooks)
* **Slack** *(coming soon)* - post alerts to a Slack channel

***

## Event history

Events are retained in TherosAI's indexed database for 90 days, queryable via the dashboard or the API (`GET /v1/events`). The on-chain transaction record is permanent and independently accessible via Solana explorers regardless of TherosAI's retention window. The chain does not forget.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.therosai.com/dashboard/alerts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.