Channels & Events

Warden notifies you when monitors change state. Set up a notification channel and you’ll start receiving alerts immediately — no extra configuration needed.

Notification Channels

Warden supports three channel types:

Type	Description
Email	Plain-text and HTML alerts through an SMTP server you provide
Slack	Rich formatted messages via Slack Incoming Webhooks
Webhook	JSON payloads to any HTTP endpoint

All enabled channels receive every notification. You can create as many as you need.

Adding a Channel

1. Go to Settings → Notifications
2. Click Add Integration
3. Choose Email, Slack or Webhook
4. Enter a name and the destination settings
5. Click Send Test to verify it works
6. Click Add Integration to save

The test sends a sample “monitor down” event so you can verify formatting and delivery before saving.

Slack

Messages are color-coded by event type:

Event	Color
Down	Red
Degraded	Yellow
SSL Expiring	Orange
Flapping	Purple
Stabilized	Blue
Up (Recovery)	Green

Each message includes the monitor name, URL, event details, and timestamp.

To set up Slack, create an Incoming Webhook in your Slack workspace and paste the URL when creating the channel.

Email

Email channels connect to an SMTP server. Configure the server and port, an optional username/password, the From address and one or more comma-separated recipients.

Provider	Server	Port
Resend	smtp.resend.com	465
Postmark	smtp.postmarkapp.com	587
SendGrid	smtp.sendgrid.net	587
Gmail (app password)	smtp.gmail.com	587

Port 465 uses TLS from the first byte. Other ports use STARTTLS when the server offers it. Warden refuses to send credentials or alert contents over an unencrypted connection by default. Allow insecure local relay exists only for a trusted, unauthenticated relay.

Use Send Test to exercise the same SMTP path as a real alert. SMTP passwords are masked after saving.

Webhook

Webhooks send a JSON POST to your endpoint with a 10-second timeout:

{
  "event": "down",
  "monitorId": "m-api-server-a1b2c3",
  "monitorName": "API Server",
  "monitorUrl": "https://api.example.com",
  "message": "Connection refused",
  "timestamp": "2026-03-20T12:00:00Z"
}

Event Types

Event	Trigger
Down	Monitor confirmed down after consecutive failures
Up	Monitor recovered
Degraded	Latency exceeded threshold
Flapping	Rapid state changes detected
Stabilized	Flapping stopped
SSL Expiring	Certificate approaching expiry (30, 14, 7, or 1 day)

Each event type can be independently enabled or disabled in Settings → Notifications → Event Types. All are enabled by default. Disabled events are still logged — they just don’t trigger notifications.

Notification Intelligence

These settings help reduce noise so you only get alerted when it matters. The defaults work well for most setups — adjust them if you’re seeing too many or too few alerts.

Sustained Outages

Confirmation and notification are separate moments. Once consecutive checks confirm a failure, Warden opens an outage. It alerts only if the outage remains open for the sustained window.

Default: announce after 180 seconds, remind after 30 minutes, then every 60 minutes. Set the sustained window to 0 for an alert as soon as the outage is confirmed.

Confirmation Threshold

Warden waits for multiple consecutive failures before confirming a monitor is down. This filters out one-off network blips; the sustained window then decides when the confirmed outage is announced.

Default: 3 consecutive failures. Set to 1 for immediate alerting. Range: 1–100.

Notification Cooldown

Cooldown applies to repeated flapping and stabilized events. Ongoing down and degraded outages use the reminder ladder instead, so reminders reflect how long the outage has lasted.

Default: 30 minutes. Set to 0 to disable. Range: 0–1440 minutes.

Recovery Confirmation

Require consecutive successful checks before confirming recovery, preventing false recovery alerts from intermittent issues.

Default: 1 check. Range: 1–20.

Flap Detection

If a monitor keeps switching between up and down, Warden detects the instability and sends a single “flapping” alert instead of repeated up/down notifications. Once the monitor stabilizes, you get a “stabilized” notification with a 5-minute grace period before it can re-trigger.

Default: Enabled, analyzing the last 21 checks with a 25% state transition threshold.

All of these settings can be changed in Settings. Confirmation threshold and cooldown can also be overridden per monitor.

Correlation and Repeat Offenders

When enough monitors in one group fail within the correlation window, Warden sends one grouped incident instead of one alert per monitor. If most monitors across multiple groups fail together, it identifies a likely probe-wide network failure. A monitor that repeatedly interrupts within the configured window is damped while its outages remain visible in the dashboard and digest.

Daily Digest

The daily digest summarizes selected events. It does not replace or suppress immediate notifications; delivery and digest inclusion are separate settings.

Setting	Default	Description
Enabled	Off	Send a daily summary
Time	09:00	Delivery time in your timezone
Event Types	degraded, flapping, stabilized, ssl_expiring	Which events to include

An event can appear in the digest and still alert immediately. Disable its event toggle if it should not be sent immediately.

Permissions

• Admin and Editor can create, edit, delete, and test channels
• Admin only can change notification settings (thresholds, event toggles, digest)
• Viewer can see channels (webhook URLs masked) but cannot modify them
• Status Viewer has no access to notifications