# Detection Alert Formatting {% hint style="warning" %} Detection alert formatting depends on [scalar functions and operators](/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators.md), which are currently in beta and may change in the future. {% endhint %} Detection alert formatting allows teams to customize the content in detection alerts that are sent to event sinks, like Slack and webhooks. You can add custom formatting by going to the create/edit detection rule page and going to the **Format Alert** section. This feature is also support in Detections as Code, see [Writing Detection Rules](/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-rules-as-code/writing-detection-rules.md) for more information. In **Information**, you can add section headers and text for the alert body. In the example below, there is a section titled **Description** and the section text includes the description of the detection rule. In **Actions**, you can add action names and URLs, such as a runbook link for the alert. Actions will appear as buttons in Slack and as links in Markdown. If the value is an invalid URL or not a URL, the key/value will appear as text in the alert, rather than as a button or link. The Preview button will allow you to view the formatting in Slack, Markdown, and JSON. Note that some event sinks may have limits on the length of text that may be sent; in that case, Scanner will truncate the alert text to fit.

## Alert object The `@alert` object represents a detection alert and contains the following fields:

Field	Type	Description
`id`	string	Unique identifier for the detection alert
`detection_rule_id`	string	Unique identifier for the detection rule that triggered the alert
`tenant_id`	string	Unique identifier for the tenant
`severity_id`	number	The severity of the detection. See /pages/jGhTgW4L8kk9lhkHS7x7#detection-severity for more information.
`name`	string	Name of the detection rule
`description`	string	Description of the detection rule
`query_text`	string	Query for the detection rule
`detected_in_time_range.start`	string	Start of the detection time range
`detected_in_time_range.end`	string	End of the detection time range
`timestamp`	string	The time the detection was triggered. Note that this can be outside of the detection time range.
`tags[i]`	string	The `i+1`th tag for the detection rule, e.g. `tags[0]`will return the first tag for the detection rule.
`results_table.total_row_count`	string	Total size of the results table. Note that this is the final results table of the query, not the total number of log events scanned. E.g. `* \| count` will always have a `total_row_count` of 1, since `count` always produces only a single row.
`results_table.rows[i].<column>`	string	The value of the given `<column>`in the `i+1`th row in the results table, e.g. `results_table.rows[0].foo` will return the value of the `foo` column from the first row of results. Detection events contain a maximum of 10 rows in the results table.

## Templating Fields from the `@alert` object can be templated using double curly-braces `{{`and `}}` , for example, `{{@alert.name}}` will template the name of the detection rule. Templating can be combined with normal strings, e.g `Name: {{@alert.name}}`. Templating supports all [scalar functions and operators](/scanner/using-scanner-complete-feature-reference/beta-features/scalar-functions-and-operators.md). For example, `{{@alert.results_table.total_row_count + 1}}`will add 1 to the total row count from the `@alert` object. Closing double-curly braces `}}`are expected whenever there are open double curly-braces `{{`, otherwise, the template will not parse. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.