Skip to main content
Red-team evaluations and cloud scans give you point-in-time security assessments, but they don’t tell you what’s happening to your agent right now in production. Signals fill that gap. A Signal is a no-code threshold monitor that watches a specific metric — error rate, response latency, LLM spend, or new finding count — and fires an alert the moment that metric crosses a boundary you define. You configure a Signal once and Trident watches it continuously, routing alerts to Slack, PagerDuty, or email so your team can act before a minor spike becomes a major incident.

​
Available metrics

​
Create a Signal

1

Open the Signals view

In the Trident dashboard, navigate to Signals in the left sidebar and click New Signal.
2

Select the metric and scope

Choose the metric you want to monitor from the dropdown. Then set the scope: either All agents in the project or a specific agent by name. Scoping to a single agent is useful when different agents have very different baseline characteristics.
3

Set the threshold condition

Define the condition that should trigger the alert. For example:
  • error_rate > 5% over a 15-minute window
  • latency_p95 > 2000ms over a 5-minute window
  • llm_cost > $10 over a 1-hour window
  • new_findings >= 1 with severity filter Critical
Select the comparison operator, value, and evaluation window from the controls.
4

Configure the alert destination

Choose where Trident should send the alert when the Signal fires:You can configure multiple destinations for a single Signal.
5

Save the Signal

Click Save. The Signal becomes active immediately and begins evaluating on the next metric interval. Its initial state is Active.

​
Signal states

Trident sends a resolution notification automatically when a Firing Signal returns to the Active state, so your team knows the issue has cleared without manually checking the dashboard.

​
Mute a Signal

During planned deployments or maintenance windows, you can suppress a Signal temporarily without deleting it:
  1. Open the Signal from the Signals list
  2. Click Mute and select a duration: 1 hour, 8 hours, or 24 hours
The Signal continues to evaluate the metric during the mute window but does not send alerts. It returns to normal alerting behavior automatically when the mute period expires.
Create a new_findings Signal scoped to Critical severity as your first Signal. This gives you an immediate notification any time the firewall or a red-team run opens a Critical finding — the one category where faster response time directly reduces blast radius.