Alerts

Get told when something changes: an agent surge, a new AI company crawling your site, people's conversions falling. Alerts are checked once a day for the previous UTC day, and everything that fired arrives as one digest. Quiet days send nothing.

Set them up in Alerts in the dashboard.

Kinds

• A number above or below. For example, agent share above 40%, or people's sessions below 100.
• A change from the usual. The day's value against the median of the previous 14 days: up, down or either, by at least a percentage. A minimum volume keeps small numbers from setting it off (for rates, measured in sessions). It waits for 7 days of history.
• A new agent operator. An AI company or crawler operator not seen in the previous 30 days, with the agents it used. It waits for a week of traffic, so a new install isn't all "new".
• A company researching you. A company's agents reach a strong (or moderate) signal over the last 7 days. Each company is reported once a week. Needs company domains from your forms: see Accounts.

Any metric from the query model works, filtered by who: everyone, people, people from AI assistants, agents or crawlers, and for conversions a goal or for events an event name. Who counts as an agent follows the confidence setting, so "people's conversions dropped" isn't hidden by agents converting at the same time.

Quick add

Alert	Fires when
Agent share spike	Agent share rises 50% or more on the usual (at least 50 sessions a day)
New agent operator	An operator not seen in 30 days appears
People's conversions dropped	Conversions by people fall 30% or more (at least 10 a day)
A company is researching you	A company's agents reach a strong signal over 7 days
AI assistant referrals dropped	Visits from people sent by AI assistants fall 40% or more (at least 20 a day)

Where they go

• Email, up to 10 addresses.

• Slack, through an incoming webhook: in Slack, add the Incoming Webhooks app to a channel and paste its URL. The URL is a credential: it's stored so Punchline can post, and never shown again.

• Webhook, for your CRM: an https URL that receives the digest as JSON, with structured detail (for account signals: each company's domain, signal, summary and top intents). Requests are signed with Punchline-Signature; the signing secret is shown once when you save the URL. See Webhooks for the payload and how to check the signature. Only public hosts are allowed, and redirects aren't followed.

Each item in the digest says what happened and links to the report behind it. Send a test checks the destinations.

Privacy

Digests contain totals for the alert's own condition, and operator and agent names; never paths, sessions or anything about an individual visitor. Names that come from traffic are stripped of formatting and mentions before they reach Slack.