Alert status

An alert’s status tells you whether it needs you yet.

Status	What it means	What you do
Under review	Rivanorth is still checking the finding.	Nothing yet.
Action required	The finding is confirmed and it concerns you.	Read it and act.
Resolved	You have closed it.	Nothing, unless it reopens.

Only confirmed alerts notify you

Email, Inbox and webhook notifications are sent when an alert becomes Action required. You are not notified while something is under review.

Resolving an alert

1. Open the alert.
2. Choose Resolve.
3. Pick the outcome: Fixed it, No action or False positive.
4. Add a closing comment if it is useful to the next person.

The outcome matters: it helps Oko show you fewer things like the false positives you flag.

Reopening

On a resolved alert, choose Reopen. Reopening does not resend email or webhook notifications. People working the alert see a note in their Inbox.

Deleting alert data

On a resolved alert, Delete data permanently removes the exposed data from the alert. You type delete to confirm. The alert itself stays in your history, marked Resolved (Deleted).