> ## Documentation Index
> Fetch the complete documentation index at: https://docs.satyakod.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> How alerts open, what's in one, and how your team investigates, acts and closes it.

An alert gathers scans that point to the same problem, such as one serial turning up in several
cities, so your team works one case instead of hundreds of scans.

## How alerts open

Satyakod checks recent scans against your alert rules every five minutes. Each rule opens an
alert once its threshold is reached ("at least"):

| Rule | Opens when (defaults) | One alert per | Severity |
| - | - | - | - |
| **Clone pattern** | The same serial is scanned more than 50 km apart within 6 hours, on at least 1 serial | Product | High; critical from 50 serials |
| **Grey market** | At least 500 scans outside a batch's authorised region within 24 hours | Batch | High |
| **Signature failures** | At least 100 forged codes (signature doesn't match your keys) in one district within 60 minutes | District | High |
| **Revoked code scanned** | At least 1 scan of a revoked serial | Batch | Medium |
| **Serial enumeration** | At least 100 lookups of serials you never issued from one device within 10 minutes | Device | Medium |
| **Unknown code format** | At least 50 codes that aren't Satyakod serials within 24 hours | Workspace | Low |
| **Consumer reports** | A shopper reports a code as fake from the Satyakod app (at least 1 report of the same code) | Code | High |
| **Scanner account shared** | One field scanner’s scans over 50 km apart within 30 minutes: the login is probably shared | Person | Medium |

The clone rule's distance and window also decide the scan's own verdict: a copy scanned beyond
them comes back Counterfeit straight away (see
[how verification works](https://docs.satyakod.com/concepts/how-verification-works.md#the-checks)).

While an alert is open or investigating, new matching scans join it ("N more scans matched" on its
timeline) and its counts update; once it is resolved, a new alert opens instead.

A consumer report shows on its alert under **Consumer reports**: the reference (`REP-…`), the
code, where the shopper bought it, their photos of the pack, code and receipt (location data is
removed from photos), and their phone number only if they agreed to be contacted.

In **Settings → Alert rules**, admins and brand protection switch rules on or off, change their
thresholds, and choose who is told (below). Changes apply from the next check.

## Who is told

| When | Who | How |
| - | - | - |
| An alert opens | Admins and brand protection | The rule's **Notify** channels: in-app, email, WhatsApp, or the weekly digest alone |
| You're made an alert's assignee | The assignee (unless they assigned themselves) | In-app and email |
| Every week | Admins and brand protection | An email digest of the alerts from rules set to **Weekly digest** |

By default clone patterns notify in-app, by email and on WhatsApp; grey market and signature
failures in-app and by email; revoked codes and enumeration in-app; unknown formats in the weekly
digest. WhatsApp messages need WhatsApp set up for your workspace, which we do with you at
onboarding: see [Notifications](https://docs.satyakod.com/concepts/notifications.md).

## Working an alert

![An alert: status, assignee, counts, recommended actions and timeline](https://docs.satyakod.com/images/screenshot-placeholder.svg)

An alert: status, assignee, counts, recommended actions and timeline

**Alerts** lists open and investigating alerts by default; switch the filter to **Resolved** or
**All**. Open one to see its scans, districts, unique devices and affected serials, then:

1. **Assign it** and set the status to **Investigating**.
2. **Work the recommended actions**:
   * **Revoke N serials**: opens the batch's revoke dialog on the copied serials, so every copy
     comes back Counterfeit from the next scan.
   * **Notify distributor**: asks the distributor serving the area to check their dealers, with a
     reply link. See [Alert outcomes and distributor replies](https://docs.satyakod.com/guides/alert-outcomes.md).
   * **Export evidence pack**: a ZIP with a PDF report, every linked scan as CSV, the timeline, and a
     SHA-256 manifest to show the files weren't changed. It is built when you ask; each export is
     on the timeline.
3. **Add notes** for the team. Notes and every change appear on the timeline.
4. **Resolve it** and record what it achieved, or mark it **False positive**. See
   [Alert outcomes](https://docs.satyakod.com/guides/alert-outcomes.md).

**Affected serials** lists the 25 most-scanned serials with their scans and districts; **Copy list**
copies them for a revocation or a report. **All N scans** opens [Scans](https://docs.satyakod.com/guides/overview-and-scans.md)
filtered to the alert's scans, whenever they happened.

## Distributors

**Settings → Alert rules → Distributors** holds the distributors **Notify distributor** can reach:
name, areas (states or districts, such as `MH, GJ, Pune`), contact person, email and WhatsApp
number. An alert goes to the distributor named as its likely source, else the first whose areas
cover the alert's districts or states.

## Who can do what

| Action | Roles |
| - | - |
| See alerts, export evidence | Everyone |
| Change status and assignee, add notes, notify distributors | Admin, brand protection, supply chain |
| Revoke from an alert | Admin, brand protection |
| Edit alert rules and distributors | Admin, brand protection |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.