Conditional Based Notification

Why conditions matter

Without conditions, a rule sends alerts for every matching trigger. Conditions help you avoid noise by limiting alerts to the situations that truly matter. Conditions let a rule fire only in specific situations.

How conditions work

A condition is a statement about a field in the event data. It compares that field to a value using an operator.

Example condition:

• severity equals critical

This means the rule will only send the alert when the event has severity = critical.

Deduplication

Deduplication TTL is a time window in minutes. If the same trigger fires again within that window, Hunto sends only the first alert.

• Set to 0 to send every alert.
• Set to a higher value to reduce duplicate messages.

Conditions add precision to notifications. They let you send an alert only when the event meets specific criteria.

Common condition operators

Operator	What it means	Example
Equals	field exactly matches the value	status equals open
Not Equals	field does not match the value	status not equals closed
Contains	field includes the value	message contains threat
Not Contains	field does not include the value	message not contains false positive
Greater than	field is larger than the value	count greater than 10
Less than	field is smaller than the value	count less than 5
Exists	field is present in the event	user exists
Not Exists	field is missing from the event	user not exists

Combining conditions

You can add more than one condition to a rule. Use:

• AND when every condition must be true
• OR when any one condition being true is enough

Example 1 — narrow rule with AND:

• severity equals critical
• status equals open

This means the alert only sends when the event is both critical and open.

Example 2 — broader rule with OR:

• severity equals critical
• severity equals high

This means the alert sends if the event is either critical or high.

Practical customer examples

Situation	Suggested condition	What it does
Only alert on urgent items	severity equals critical	Sends only the highest-severity alerts
Only alert when a task is open	status equals open	Prevents alerts for closed tasks
Only alert when the user field exists	user exists	Sends alerts only for events tied to a user
Avoid known false positives	message not contains false positive	Blocks alerts when the message explicitly indicates a false positive

Best practice

Start with a simple condition and add more only as needed. Use conditions to make alerts:

• more relevant,
• less frequent,
• and easier to act on.