Audit & Alerts

Complete security event logging with configurable retention and real-time alert delivery.

What It Does

Every security event from every guard flows into the Audit system. It's the central record of everything CrabShield sees and does — every detection, every action taken, every configuration change. You can review events in the dashboard, filter by guard or severity, and track trends over time.

Beyond logging, the system can send real-time alerts when important events happen. You can route alerts to a messaging channel within CrabShack or to an external service like Slack via webhook (a URL that receives automated notifications). Alert batching and deduplication prevent alert fatigue — you get notified about important events without being overwhelmed by duplicates.

Think of it as the security operations center for your AI agents. It gives you a single place to see everything that's happening, understand what matters, and take action when needed.

Why It Matters

Without an audit trail, you're flying blind. You wouldn't know if an attack was attempted, whether your guards are working as expected, or how your security posture is changing over time. The audit log gives you visibility into what's happening, evidence for compliance requirements, and the data you need to tune your security settings for your specific environment.

What Gets Logged

Every security event from every guard is recorded, including:

• Blocked actions — messages or tool calls that were stopped by a guard
• Sanitized content — messages that were cleaned before delivery
• Warnings — suspicious activity that was allowed but flagged
• Configuration events — changes to guard settings, lockdown activations
• System events — guard startup, health checks, integrity verification results

Each event includes a timestamp, which guard generated it, what action was taken, and a severity level. You can filter and search events in the dashboard under Security > Audit Log.

Event Details

Click on any event row to expand it and see additional context, including:

• Skill — which skill triggered the event (if applicable)
• Channel — which channel the message came from (e.g., webchat, slack)
• Session — the session key for the conversation
• Agent — which agent was involved
• Context — guard-specific details like tool names, file paths, or detection labels

This context is especially useful when creating exemptions — you can see the exact skill name or channel ID you need without guessing.

Example

Scenario

The Prompt Injection guard blocks a message containing an instruction override attempt. The event is automatically recorded in the audit log with the guard name, detection label (instruction_override), action taken (Block), severity (Alert), and a timestamp. If alerts are configured, a notification is sent to the designated channel or webhook (a URL that receives automated notifications) within the batching window. In the dashboard, the security team can filter the audit log by guard, severity, or time range to review the event alongside any related detections from other guards.

Settings

Setting	What It Controls
Retention Period	How long to keep security events
Alert Mode	How to deliver alerts: disabled, in-app channel, or external webhook
Alert Channel	Which CrabShack channel to send alerts to
Webhook URL	External URL for alert delivery (e.g., Slack)
Batching Window	How long to collect alerts before sending a batch

How It Responds

All events are logged automatically. Alerts are delivered based on your configuration.

Severity levels:

• Info — routine activity, guard events
• Warning — suspicious activity that was allowed
• Alert — significant threats detected and acted on
• Critical — high-severity events needing immediate attention

If This Guard Blocks You

1. Check the audit log. Navigate to Security > Audit Log in the CrabShack dashboard. Filter by Audit & Alerts to find the relevant event. Click on the event row to expand it and see details including which skill and channel triggered it, the session key, and additional context.

2. Understand the detection. Audit & Alerts is an observability guard — it doesn't block messages or actions itself. If you're not seeing expected events in the audit log, check that the relevant guard is enabled and set to a mode that generates events (all modes log events, but Block and Sanitize generate more visible entries). If alerts aren't being delivered, check the alert configuration — verify the alert mode is set, the channel or webhook URL is correct, and the batching window is appropriate.

3. Adjust if needed. Configure alert delivery in the dashboard — choose between in-app channel alerts or external webhooks (a URL that receives automated notifications when events occur, such as a Slack integration). Adjust the batching window to control how frequently alerts are sent. See the Configuration page for details.

tip

Prefer creating a targeted exemption for a specific skill or channel over disabling the guard entirely. If you're seeing frequent false positives, a suppression lets you silence a specific detection label temporarily while you refine your settings.

Default Behavior

Logging is enabled. Alerts are disabled by default — configure them in the dashboard when you're ready.

Related Guards

All guards feed events into this system.