Yang Yang Xie
69ddc0d88b
Self-hosted Envoy gateway with AI threat analysis, TLS automation, and real-time security dashboard. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2.0 KiB
Notifications
Aegis can send alerts to Telegram, Discord, Slack, or any webhook endpoint.
Channel types
Telegram
- Create a bot via @BotFather — save the bot token
- Start a chat with your bot (send
/start) - In Aegis: Integrations → Add Channel → Telegram
- Enter the bot token, then click ID to auto-detect your chat ID
Owl AI Chat via Telegram: Enable the "Owl Chat" toggle on a Telegram channel to let Owl respond to messages sent to your bot.
Webhook (Discord, Slack, generic)
- Discord: Server Settings → Integrations → Webhooks → New Webhook → copy URL
- Slack: Create an Incoming Webhook app → copy URL
- Generic: any URL that accepts a POST with a JSON body
Events
Toggle which events trigger notifications:
| Event | Description |
|---|---|
| IP Blocked | An IP was auto-blocked by a detection rule |
| DDoS Pattern | High-volume flood detected |
| Error Spike | Unusual 5xx error rate |
| Client Flagged | AI classified an IP as suspicious |
| Cert Expiry | A managed certificate is expiring soon |
| Daily Digest | Daily summary of traffic and security events |
| Owl Patrol | Owl found a threat during an autonomous sweep |
Suppression
Duplicate alerts for the same IP/pattern within a time window are suppressed and bundled into a follow-up message (e.g. "+12 more suppressed"). This prevents alert fatigue during attacks.
Daily Digest
Sent on a cron schedule (default: 08:00 daily). Includes traffic summary, top threats, cert status, and — if AI is enabled — a natural-language narrative written by Owl.
Change the schedule under Integrations → Daily Digest → Cron schedule. Use crontab.guru to build expressions.
Owl Patrol
Owl analyses recent traffic on a schedule and sends a notification only when it finds something genuinely concerning. Configure the sweep interval and whether Owl is allowed to auto-block IPs during a sweep.
Requires at least one notification channel to be configured.