3 min read · alerts
How to read a trigger without panicking
Source IP is often a resolver or scanner, not the human. Use exclusions for known-good noise.
Open the alert. Note token name, type, time, source IP, and user agent. For DNS, the IP is usually a recursive resolver, not the laptop that typed the hostname.
If you caused the lookup (a test, a linter, your own CI), add a trigger exclusion for that IP or user agent so the next one stays in history but skips email/Slack.
If you did not cause it, treat it as unauthorized use of a secret that should not exist. Rotate anything stored near that token and follow your incident process.