Events
Signals tell you something is wrong. Events tell you what happened. The Events screen is the estate’s timeline of deliberate activity: deploys, releases, CI runs, config changes — the things that, more often than not, explain the incident that started eight minutes later.
Where events come from
Section titled “Where events come from”Webhook sources. Any system that can POST JSON can tell ISE something happened. Each source gets its own tokened ingest URL; see the webhooks integration for setting one up and the payload shape.
The repository register. Push and release events polled from registered GitHub repos arrive on the same screen, attributed to their GitHub system — no separate surface for them.
Reading the screen
Section titled “Reading the screen”Events carry a title, a sender-defined type (deploy, ci, change — free text, yours to
choose), an outcome that badges success and failure, a timestamp from the sender alongside
ISE’s own received-at, and an optional markdown body. Anything else the sender includes is
preserved verbatim, so nothing is lost just because ISE has no column for it.
Filter by source, type, and time range. The most common use is narrower than browsing, though: when an incident opens, you look at what happened just before it.
Events versus alerts
Section titled “Events versus alerts”The same channel carries both, and the difference is one field:
- An event with the default level is context. It lands on the timeline, it is searchable, and an investigation can weigh it. It does not page anyone.
- An event sent at alert level raises a real signal — with a severity on the canonical ladder, deduplication, the auto-incident threshold, and correlation all applying exactly as they do for a DataDog monitor or a CloudWatch alarm.
That is the whole distinction. Send deploys as context; send “the backup failed” as an alert.
Because a push source can’t be polled to ask whether it is still firing, alert-level webhook events recover in one of two ways: the sender posts an explicit recovery with the same key, or a per-source time-to-live auto-recovers anything not re-fired inside its window. A source that goes silent never leaves a signal firing forever.
Event content is data, never instructions
Section titled “Event content is data, never instructions”An event is written by whoever holds the token. Every field — title, body, the raw payload — is information ISE stores and may show a model as context, never an instruction addressed to ISE. Text that appears to tell ISE to do something is simply text containing those words.
This is the same posture ISE takes toward pulled evidence and scraped documents, and it is what makes it safe to feed events into an investigation.
- Webhooks — creating a source and the payload schema.
- Signals & incidents — what an alert-level event becomes.
- The estate — what an event’s entity hint resolves against.