Low · 10
One mild signal. It is stored as an event and does not page you.
Scores
How a score becomes an alert
Every forwarded request is an event, including a normal GET /api/v1/users?page=1, which scores 0. An alert opens only when the score reaches 50. Mark it seen when you have looked.
Medium · 25
Two of these together reach the alert line. One of them waits.
High · 50
One match opens an alert. Email follows your workspace setting (off, high, or all).
Critical · 80
A request that looks like it is reaching for secrets or a command. Same alert path, higher score.