[
  {
    "name": "[MTE Relay] High/critical security event detected",
    "type": "log alert",
    "query": "logs(\"service:mte-relay @security_event.severity:(high OR critical)\").index(\"*\").rollup(\"count\").last(\"5m\") > 0",
    "message": "{{#is_alert}}A high or critical MTE Relay security event fired in the last 5 minutes (signature failures, state corruption, or state-store persistence failures). Investigate the security_event stream, grouping by event_type and origin.{{/is_alert}} @your-team-handle",
    "tags": ["service:mte-relay", "managed-by:mte-relay-docs"],
    "options": {
      "thresholds": { "critical": 0 },
      "notify_no_data": false,
      "renotify_interval": 0,
      "enable_logs_sample": true
    }
  },
  {
    "name": "[MTE Relay] Handler panic recovered",
    "type": "log alert",
    "query": "logs(\"service:mte-relay @error_event.event_type:panic\").index(\"*\").rollup(\"count\").last(\"5m\") > 0",
    "message": "{{#is_alert}}An MTE Relay handler panicked and was recovered. The error_event contains the full stack trace — file a bug with it.{{/is_alert}} @your-team-handle",
    "tags": ["service:mte-relay", "managed-by:mte-relay-docs"],
    "options": {
      "thresholds": { "critical": 0 },
      "notify_no_data": false,
      "renotify_interval": 0,
      "enable_logs_sample": true
    }
  },
  {
    "name": "[MTE Relay] State store persistence failures",
    "type": "log alert",
    "query": "logs(\"service:mte-relay @security_event.event_type:(state_save_failed OR state_not_found)\").index(\"*\").rollup(\"count\").last(\"10m\") > 5",
    "message": "{{#is_alert}}MTE Relay is failing to persist or restore encoder/decoder state. If Redis is configured, check Redis health, connectivity, and memory pressure. Sustained failures will surface to clients as 559/562 errors.{{/is_alert}} @your-team-handle",
    "tags": ["service:mte-relay", "managed-by:mte-relay-docs"],
    "options": {
      "thresholds": { "critical": 5 },
      "notify_no_data": false,
      "renotify_interval": 0,
      "enable_logs_sample": true
    }
  },
  {
    "name": "[MTE Relay] Elevated request latency",
    "type": "log alert",
    "query": "logs(\"service:mte-relay @performance_event.event_type:request_timing\").index(\"*\").rollup(\"avg\", \"@performance_event.total_time_ms\").last(\"10m\") > 500",
    "message": "{{#is_alert}}Average MTE Relay request latency exceeded 500 ms over 10 minutes. Check the phase-breakdown dashboard panel: if proxy_ms dominates, the upstream is slow; if decryption_ms/encryption_ms dominate, check CPU saturation and pool sizing. Tune this threshold to your traffic profile.{{/is_alert}} @your-team-handle",
    "tags": ["service:mte-relay", "managed-by:mte-relay-docs"],
    "options": {
      "thresholds": { "critical": 500 },
      "notify_no_data": false,
      "renotify_interval": 0
    }
  },
  {
    "name": "[MTE Relay] Client pair exhaustion spike",
    "type": "log alert",
    "query": "logs(\"service:mte-relay @security_event.event_type:client_pairs_exhausted\").index(\"*\").rollup(\"count\").last(\"15m\") > 50",
    "message": "{{#is_alert}}Many clients are exhausting their MTE pair pools and being forced to fully re-pair. This is a capacity early-warning: consider raising pair pool sizes (CLIENT_MIN_PAIRS/CLIENT_MAX_PAIRS or DEFAULT_POOL_SIZE) or scaling out relay instances.{{/is_alert}} @your-team-handle",
    "tags": ["service:mte-relay", "managed-by:mte-relay-docs"],
    "options": {
      "thresholds": { "critical": 50 },
      "notify_no_data": false,
      "renotify_interval": 0
    }
  }
]