Skip to main content
Every alert in Flarehawk follows a defined lifecycle: a detection rule fires, the alert is deduplicated and enriched, it moves through a set of states as you investigate and respond, and eventually it is resolved or marked as a false positive. Understanding this lifecycle helps you triage alerts faster and get the most out of Flarehawk’s feedback loop.

​
How an alert is created

When a detection rule determines that a metric has crossed its threshold, Flarehawk creates an alert with a fingerprint — a hash derived from the asset, the rule, and the entity being flagged (for example, a specific IP address or URL path). The fingerprint serves two purposes:
  1. Deduplication: if the same rule fires for the same entity within its cooldown window, Flarehawk updates the existing open alert rather than creating a duplicate. This prevents alert storms during sustained incidents.
  2. False positive tracking: when you mark an alert as a false positive, the fingerprint is recorded so that Flarehawk can adjust the baseline threshold for that rule and entity combination.
Cooldown windows are configured per rule and typically range from 5 to 30 minutes. Once a cooldown expires and the condition is still true, a new alert is created.

​
Enrichment

Before an alert appears in your dashboard, Flarehawk automatically enriches it with additional context: This enrichment is included in every alert at no extra step. You do not need to look up IPs separately — the context is already attached when the alert opens.

​
Severity levels

Every alert is assigned one of four severity levels based on how far the detected signal deviates from baseline, combined with rule-specific severity mappings:
Severity is determined at alert creation time. If the underlying condition escalates after the initial alert, the event count and signal values in the alert update, but the severity label does not change automatically.

​
Alert states

An alert moves through the following states during its lifecycle:
1

Open

The alert has been created and is waiting for review. New alerts appear at the top of the Alerts page. You can filter by severity to prioritize critical issues.
2

Acknowledged

You have reviewed the alert and are actively investigating. Acknowledging an alert signals to your team that someone is on it. The alert remains visible and active.
3

Resolved

The incident is over and no further action is needed. Resolved alerts move out of the active queue but remain in your alert history for 90 days.
At any state, you can also mark an alert as a false positive. This is distinct from resolving — it tells Flarehawk that the detection was incorrect, which feeds directly into baseline calibration.

​
False positive feedback

Marking an alert as a false positive does more than dismiss it. Flarehawk records the fingerprint, the signal value, and the z-score at the time of the alert, and uses this data to adjust the detection threshold for that rule and entity. Over time, repeated false positive feedback on a specific rule narrows its sensitivity for your traffic profile, reducing noise without manual threshold tuning.
Submit false positive feedback as soon as you identify one. Timely feedback produces more accurate baselines than feedback submitted days after the fact.

​
Alert retention

Flarehawk retains alerts for 90 days. After 90 days, alerts are permanently deleted. If you need to preserve alert history beyond this window, export the data from the Logs page before it expires.

​
Viewing alert evidence

Every alert includes an evidence panel with the raw signal data that triggered it. Depending on the rule type, this may include:
  • The observed signal value and the threshold that was crossed
  • The statistical baseline mean and standard deviation at alert time
  • The z-score or EWMA value
  • A timeline graph showing the metric over time with the baseline overlaid
  • Top contributing IPs, paths, user agents, and countries with their enrichment data
  • Upstream request identifiers (such as Cloudflare Ray IDs) when provided by the connected source
For ML-based alerts on the Complete tier, the evidence panel also shows which features contributed most to the anomaly score and how far each deviated from its expected range.