How do I create custom message alerts?

Message rules are configurable patterns that trigger an alert when a message matching specific structure or content is sent to a configured channel or channels. When Chronicle detects a match, an alert is sent to admins in the #chronicles channel and logged in the dashboard. Message rules can be applied to any channel or set of channels. By default, they apply to all channels except those explicitly marked as ignored under Channels. Each rule can also be named and toggled on or off as needed.

Every Chronicle installation automatically includes three built-in message rules:

1. Profanity – Matches any mention of profanity in a message (disabled by default)
2. Credit Cards – Matches any mention of a credit card number in a message
3. Passwords – Matches any mention of sharing a password in a message

To create a custom message alert:

1. Sign in to the Chronicle dashboard using the Add to Slack button on the homepage 
2. Select Messages in the left-hand sidebar 
3. Select New Rule in the top right corner

When creating a new rule, you'll fill in the following fields:

• Title – The name of the pattern, shown in the dashboard and in Slack
• Enable Pattern – Toggles the pattern on or off, useful if you want to disable it temporarily without deleting it
• Pattern Type – Determines how the pattern is matched against messages
• Pattern – The text or expression used to scan messages
• Channels – The channels the pattern applies to

The two fields that matter most are Pattern Type and Pattern. Three types of message rules are available:

• Exact Match – Matches the pattern exactly, including case
• Case-Insensitive Match – Matches the pattern regardless of case; supports a comma-separated list of terms
• Regex – Matches the pattern as a regular expression, following Python's regex syntax

For simple matching, like catching specific words or phrases, Case-Insensitive Match usually works well. The default Profanity pattern is a good example — it uses a case-insensitive list of flagged words.

For more precise control, use Regex. The default Credit Cards and Passwords patterns both use regex to match more complex or variable text. If you're building your own regex pattern, Regex101 (set to Python) is a helpful tool for testing it before adding it to your rule.

If you need help building a pattern or have questions about setting up a rule, contact support and we'll help you get it working.