Notifications

Aegis can send alerts to Telegram, Discord, Slack, or any webhook endpoint.

Channel types

Create a bot via @BotFather — save the bot token
Start a chat with your bot (send /start)
In Aegis: Integrations → Add Channel → Telegram
Enter the bot token, then click ID to auto-detect your chat ID

Owl AI Chat via Telegram: Enable the "Owl Chat" toggle on a Telegram channel to let Owl respond to messages sent to your bot.

Webhook (Discord, Slack, generic)

Discord: Server Settings → Integrations → Webhooks → New Webhook → copy URL
Slack: Create an Incoming Webhook app → copy URL
Generic: any URL that accepts a POST with a JSON body

Events

Toggle which events trigger notifications:

Event	Description
IP Blocked	An IP was auto-blocked by a detection rule
DDoS Pattern	High-volume flood detected
Error Spike	Unusual 5xx error rate
Client Flagged	AI classified an IP as suspicious
Cert Expiry	A managed certificate is expiring soon
Daily Digest	Daily summary of traffic and security events
Owl Patrol	Owl found a threat during an autonomous sweep

Suppression

Duplicate alerts for the same IP/pattern within a time window are suppressed and bundled into a follow-up message (e.g. "+12 more suppressed"). This prevents alert fatigue during attacks.

Daily Digest

Sent on a cron schedule (default: 08:00 daily). Includes traffic summary, top threats, cert status, and — if AI is enabled — a natural-language narrative written by Owl.

Change the schedule under Integrations → Daily Digest → Cron schedule. Use crontab.guru to build expressions.

Owl Patrol

Owl analyses recent traffic on a schedule and sends a notification only when it finds something genuinely concerning. Configure the sweep interval and whether Owl is allowed to auto-block IPs during a sweep.

Requires at least one notification channel to be configured.