# Attack alerts & reports

> Get notified in Telegram, e-mail or your own webhook the second an attack starts — and download the evidence.

Source: https://docs.avenlith.com/en/attack-alerts  
Category: DDoS protection  
Last updated: 2026-09-22

## Channels

Alerts can be sent to e-mail, Telegram, Slack, Microsoft Teams, PagerDuty or any HTTPS webhook.

```bash
avenlith shield alert create --channel telegram --chat-id 123456789
avenlith shield alert create --channel webhook --url https://ops.example.com/hooks/shield
avenlith shield attacks list --since 7d --output table
```

## Webhook payload

```json
{
  "event": "attack.started",
  "attack_id": "atk_9Qx2",
  "target": "203.0.113.24",
  "vector": "udp_amplification",
  "peak_bps": 412000000000,
  "peak_pps": 38200000,
  "mitigation": "scrubbing",
  "started_at": "2026-09-18T21:04:11Z"
}
```

Events: `attack.started`, `attack.updated` (every 60 s), `attack.ended`. Requests are signed with the `X-Avenlith-Signature` header (HMAC-SHA256).

## Reports

After each attack a report is generated with the vectors, peak bandwidth and packet rate, top source networks and a 10-second packet capture (PCAP) sample.

> **Note:** > Reports are kept for 13 months and can be exported as PDF for your insurer or for law enforcement.