You know the alert you want — "tell me when p95 latency crosses 300ms on the checkout endpoint" — but wiring it up means picking the right metric, the right comparison, the right window, and the right endpoint from a form you touch twice a year. When you generate metric alerts with ai, you skip the form: say the condition in plain English and Iris, the AI built into the Ngris gateway, drafts the alert rule for you to review and enable. It's the same draft-then-review pattern as the rest of the Iris generators — you stay in control of what actually turns on.
Say the condition, get a rule
Open a chat and describe the threshold you care about:
# describe it, Iris drafts the alert rule
"Alert me if p95 latency goes over 300ms on checkout"
"Warn me when my error rate crosses 1% over 5 minutes"
"Tell me when I hit 80% of my data cap"
"Alert on a spike in firewall-blocked requests"Iris turns that into a concrete metric-alert rule: the metric (latency, error rate, request volume, usage, blocked traffic), the comparison and threshold, the evaluation window, and the endpoint or account scope. You get the drafted rule back to review — adjust the threshold, retarget the endpoint, or enable it as-is. Nothing is armed until you say so.
What the alert does — and doesn't
A metric alert is a notification, not an autopilot. When the condition is met, the alert fires so you know to look; Iris does not silently change your configuration to "fix" a latency breach or an error spike. That's deliberate. Latency and error rate usually point at your origin, and usage is a business decision — the right response is a human one. Iris drafts the alert; you decide what to do when it fires.
This is the honest boundary worth stating plainly: Iris is a rule generator and assistant, not an operations narrator. There's no "explain this outage" button and no continuous goal that Iris reconciles on its own. It drafts the alert that tells you a threshold was crossed, and it can help you draft the firewall or rate-limit rule you reach for in response — each behind its own confirmation card.
Part of the generator family
Metric alerts are one of a set of things Iris drafts from plain English. The same pattern powers the firewall rule generator, the rate-limit generator, and the traffic-policy generator — describe the behavior, review the draft, apply it. For rules that change how traffic is handled (firewall, rate-limit, traffic-policy), Iris adds a blast-radius dry-run that replays the change against your recent real traffic before you approve, so you see what a rule would have done to the last requests. A metric alert is read-only by nature — it observes and notifies — so it doesn't need the dry-run, but like every AI action it lands in the AI-activity ledger.
Once an alert fires, the natural next steps are already in the toolbox: use the smart-filter and per-request explain to narrow to the requests behind a spike, and the Traffic Inspector and Replay to test a fix against the exact bytes that failed.
Try it in one command
If you're already running endpoints on Ngris, an alert is one message away. Get set up and point a tunnel at a local service:
# install, then expose a local app
brew install ngris
ngris http 3000 --url app.ngris.comThen open the chat and describe the threshold you want to watch. The free plan gives you 5 endpoints with no credit card — enough to draft an alert, review it, and enable it end to end.