The Problem
Exposure changes between scans — coverage slips, a fresh KEV lands, a certificate quietly enters its last 30 days — but nobody’s watching until the next report. Every risk number silently assumes the data is complete and current; when that stops being true, no one is told.
What It Does
Alert Raven watches navi.db for the conditions worth waking a human — credentialed-scan coverage drops, scans running long, new CISA KEV, expiring certificates, ownerless or EOL assets rising, or any tag / software / cert / path condition you craft in plain English. It fires on change (once, until it clears) and delivers a gated email digest.
Key Capabilities
- Plain-English alerts — describe the condition in a sentence; Alert Raven drafts a read-only query you can test before saving.
- Fires on change — a condition emails once when it first trips and stays quiet until it clears — no nightly noise.
- Test & test-email — dry-run any alert, and send yourself a real test email to confirm delivery end-to-end.
- Runs itself — evaluation rides the AI Contract loop; delivery is a gated digest (NAVI_EMAIL).
How It Works
Each alert is a metric (a read-only count) plus a condition (an operator vs a threshold, optionally vs the previous run). Alert Raven prefers navi’s purpose-built tables — software, certs, routes, paths, plugins — over scanning raw plugin output, with an opt-in to search output when the text lives nowhere else. Detection is read-only; only the email send is gated.
Who It’s For
Teams who need to know the moment coverage or exposure moves — not at the next quarterly review; anyone running the pack on a schedule who wants a between-runs watchdog.
Proof Points
Evaluated 7 alerts, 1 newly fired: “New CISA KEV exposure” rose to 4 assets — a gated digest went to the security team. Seed patterns ship with live counts from your own navi.db; craft your own across tags, software, certs, and paths.
Works Better With
Rides the Covenant (AI Contract) loop for scheduling and hands its digests to Gabriel’s delivery path. Complements Chronos (scan health) and Laelaps (KEV) as the between-runs early warning.
Why It’s Different
- A raven, not a hound — the pack’s scout: it doesn’t hunt an exposure, it watches for change and calls it out.
- Confidence in the number — its first-class alerts are coverage and freshness, the blind spots other tools assume away.
- Structured over raw — prefers navi’s parsed tables to slow scans of plugin output, so alerts stay fast.