Teleport Alerting rule cooldown and rate limiting for audit events

Direct Answers

• Configurable cooldown/rate limit: No. Teleport 13.x does not expose a user-configurable cooldown period or per-rule rate limit. The only built-in deduplication is the fixed, internal suppression window used by suppressRepeating.
• suppressRepeating scope: It applies only to identical audit events (same event type, user, resource, and other matching fields) within a short internal window (approximately 5 minutes). It does not deduplicate across related event types (e.g., session.start vs. session.end) or events that differ in resource or user.
• Required role: A role with RBAC verbs create, update, delete, list on the alert_rule resource. The built-in admin role includes these; custom roles must be granted explicitly.

Confirmed Behavior (from Teleport 13.x documentation and resource model)

• Alert rules were introduced in Teleport 13.0 and match audit events such as session.start, role.assign, etc., with notifications to Slack, PagerDuty, email, or webhook.
• The suppressRepeating flag was added in v13.4. It deduplicates identical events within a short, undocumented window (observed ~5 minutes in testing). The window is not configurable and may change between patch releases.
• Alert rules are cluster-scoped resources. Creating or modifying them is audited and requires the alert_rule verbs listed above.
• Bulk operations (e.g., mass role assignments) generate distinct events per user/resource, so they are not suppressed and can produce notification noise.

Assumptions & Uncertainty

• The exact suppression window duration is not documented; do not rely on a specific value.
• Teleport 14.x or later may introduce configurable cooldowns or rate limits—check release notes for your version.
• Misconfigured RBAC for alert_rule can allow unauthorized users to modify or disable alerting.

Verification Steps (run in your cluster)

1. Confirm version:

   teleport version

2. Inspect existing alert rules:

   tctl get alert_rule

   – look for the suppressRepeating field.
3. Check RBAC for the role managing alerts:

   tctl get role/<role-name>

   – verify alert_rule verbs are present.
4. Test suppression: generate two identical audit events (e.g., start two sessions for the same user on the same node) within a minute and observe if only one notification is sent.

One Missing Diagnostic Detail

What is the exact Teleport version (including patch) you are running? The suppression window and any new rate-limiting features can vary between patch releases, and the answer may change if you are on 13.4 vs. 13.5+.