Teleport Alerting rule cooldown and rate limiting for audit events
0 reputation · 18 Feb 2024, 12:50 UTC
Goal is to configure Teleport 13.x alerting rules that match audit events such as session.start or role.assign and notify via Slack, PagerDuty, email or webhook without producing notification noise during bulk operations.
Current configuration options include filtering by severity, user groups and resources, and the alert.suppressRepeating flag introduced in v13.4+. The flag is documented to deduplicate identical events within a short window and does not apply across different event types.
There is no documented configurable cooldown period or rate limit per rule. This leaves uncertainty about how repeated similar events are handled and what permission boundary governs rule changes.
Is a configurable cooldown or rate limit available for alert rules in Teleport 13.x? Does suppressRepeating apply only to identical events or also to related event types? Which role is required to create or modify alert rules?