Skip to main content
Red-team evaluations and cloud scans give you point-in-time security assessments, but they don’t tell you what’s happening to your agent right now in production. Signals fill that gap. A Signal is a no-code threshold monitor that watches a specific metric — error rate, response latency, LLM spend, or new finding count — and fires an alert the moment that metric crosses a boundary you define. You configure a Signal once and Trident watches it continuously, routing alerts to Slack, PagerDuty, or email so your team can act before a minor spike becomes a major incident.

​
Available metrics

MetricDescriptionTypical use
error_ratePercentage of agent runs that result in an error, over a rolling time windowDetect regressions after a deploy
latency_p9595th-percentile response latency in millisecondsSurface degradation before users notice
trace_volumeTotal number of traces recorded per time windowCatch unexpected traffic spikes or drops
llm_costEstimated LLM API spend per time window, in USDSet a spend ceiling and alert before budgets are blown
negative_feedbackRate of negative user feedback signals attached to tracesCatch quality regressions from user reports
new_findingsCount of new findings opened (filterable by severity)Get an immediate alert when the firewall or a scan opens something serious

​
Create a Signal

1

Open the Signals view

In the Trident dashboard, navigate to Signals in the left sidebar and click New Signal.
2

Select the metric and scope

Choose the metric you want to monitor from the dropdown. Then set the scope: either All agents in the project or a specific agent by name. Scoping to a single agent is useful when different agents have very different baseline characteristics.
3

Set the threshold condition

Define the condition that should trigger the alert. For example:
  • error_rate > 5% over a 15-minute window
  • latency_p95 > 2000ms over a 5-minute window
  • llm_cost > $10 over a 1-hour window
  • new_findings >= 1 with severity filter Critical
Select the comparison operator, value, and evaluation window from the controls.
4

Configure the alert destination

Choose where Trident should send the alert when the Signal fires:You can configure multiple destinations for a single Signal.
5

Save the Signal

Click Save. The Signal becomes active immediately and begins evaluating on the next metric interval. Its initial state is Active.

​
Signal states

StateMeaning
ActiveThe Signal is running and the metric is within the defined threshold
FiringThe threshold has been breached; an alert has been sent to configured destinations
ResolvedThe metric has returned below the threshold; a resolution notification is sent if configured
Trident sends a resolution notification automatically when a Firing Signal returns to the Active state, so your team knows the issue has cleared without manually checking the dashboard.

​
Mute a Signal

During planned deployments or maintenance windows, you can suppress a Signal temporarily without deleting it:
  1. Open the Signal from the Signals list
  2. Click Mute and select a duration: 1 hour, 8 hours, or 24 hours
The Signal continues to evaluate the metric during the mute window but does not send alerts. It returns to normal alerting behavior automatically when the mute period expires.
Create a new_findings Signal scoped to Critical severity as your first Signal. This gives you an immediate notification any time the firewall or a red-team run opens a Critical finding — the one category where faster response time directly reduces blast radius.