Policy Alerts

Policy Alerts are alerts configured inside a tag-based or column-based masking policy that log — and optionally block — access when a configured rule is violated. Policy Alerts are available only on Snowflake, for data sources connected through default masking (external function); columns connected using pushdown (native masking) don’t generate the query activity Policy Alerts evaluate.

Note

Policy Alerts are a legacy feature, distinct from DAM Alerting, ALTR’s newer, cross-platform alert-rule engine. Policy Alerts are configured inside a masking policy and can block access; DAM Alerting is notification-only and configured separately. The two features are not interchangeable.

There are two alert types:

• Access rate alert — triggers when a user accesses more records than a configured limit within a time window.
• Time window alert — triggers when data is accessed outside a configured range of allowed days and times.

Each alert type takes one of two actions when triggered:

• ALERT — logs the event.
• BLOCK — logs the event and blocks the user from further queries until the alert is resolved.

Access-rate alerting evaluates from Snowflake query audit records, via the cloud integration. ALTR attempts to block at runtime by parsing query text, but a guaranteed block can’t happen until the audit log entry for the violating query exists, which can lag behind the query itself.

Add an Alert

Policy Alerts are added while creating or editing a tag-based or column-based masking policy.

To add a policy alert to a policy:

1. Select Policy in the navigation menu.
2. Create a new policy or edit an existing one.
3. Click Add an Alert.
4. Select the alert to apply:
   1. values exceed [number] within every [time frame] — an access rate alert.
   2. access on [day of week] in [time zone] between [time] and [time] — a time window alert.
5. Set the alert’s parameters.
6. (Optional) Select Block users who violate this rule to restrict access for the offending user.
7. Click Save.
8. Add additional alerts to the policy as needed.

View Triggered Alerts

To view active policy alerts, select Alerts in the navigation menu. Each entry shows when the alert was triggered and which rule statement triggered it.

Resolve Alert

Resolving an alert restores normal access to the data if access was blocked.

To resolve an alert:

1. Select Alerts in the navigation menu.
2. Click the alert to resolve.
3. (Optional) Click the Notes tab, add a note documenting the violation, click Post Note, then return to the Overview tab.
4. Click Resolve Alert.
5. (Optional) Enter a description of why you’re resolving the alert.
6. Click Resolve. If the alert was blocking access, access is restored once the alert is resolved.

To view alerts that have been resolved, click the Resolved Alerts tab.