Alerts

How alerts open, what’s in one, and how your team investigates, acts and closes it.

An alert gathers scans that point to the same problem, such as one serial turning up in several cities, so your team works one case instead of hundreds of scans.

How alerts open

Satyakod checks recent scans against your alert rules every five minutes. Each rule opens an alert once its threshold is reached (“at least”):

Rule	Opens when (defaults)	One alert per	Severity
Clone pattern	The same serial is scanned more than 50 km apart within 6 hours, on at least 1 serial	Product	High; critical from 50 serials
Grey market	At least 500 scans outside a batch’s authorised region within 24 hours	Batch	High
Signature failures	At least 100 forged codes (signature doesn’t match your keys) in one district within 60 minutes	District	High
Revoked code scanned	At least 1 scan of a revoked serial	Batch	Medium
Serial enumeration	At least 100 lookups of serials you never issued from one device within 10 minutes	Device	Medium
Unknown code format	At least 50 codes that aren’t Satyakod serials within 24 hours	Workspace	Low
Consumer reports	A shopper reports a code as fake from the Satyakod app (at least 1 report of the same code)	Code	High
Scanner account shared	One field scanner’s scans over 50 km apart within 30 minutes: the login is probably shared	Person	Medium

The clone rule’s distance and window also decide the scan’s own verdict: a copy scanned beyond them comes back Counterfeit straight away (see how verification works).

While an alert is open or investigating, new matching scans join it (“N more scans matched” on its timeline) and its counts update; once it is resolved, a new alert opens instead.

A consumer report shows on its alert under Consumer reports: the reference (REP-…), the code, where the shopper bought it, their photos of the pack, code and receipt (location data is removed from photos), and their phone number only if they agreed to be contacted.

In Settings → Alert rules, admins and brand protection switch rules on or off, change their thresholds, and choose who is told (below). Changes apply from the next check.

Who is told

When	Who	How
An alert opens	Admins and brand protection	The rule’s Notify channels: in-app, email, WhatsApp, or the weekly digest alone
You’re made an alert’s assignee	The assignee (unless they assigned themselves)	In-app and email
Every week	Admins and brand protection	An email digest of the alerts from rules set to Weekly digest

By default clone patterns notify in-app, by email and on WhatsApp; grey market and signature failures in-app and by email; revoked codes and enumeration in-app; unknown formats in the weekly digest. WhatsApp messages need WhatsApp set up for your workspace, which we do with you at onboarding: see Notifications.

Working an alert

An alert: status, assignee, counts, recommended actions and timeline

Alerts lists open and investigating alerts by default; switch the filter to Resolved or All. Open one to see its scans, districts, unique devices and affected serials, then:

1. Assign it and set the status to Investigating.
2. Work the recommended actions:
   • Revoke N serials: opens the batch’s revoke dialog on the copied serials, so every copy comes back Counterfeit from the next scan.
   • Notify distributor: asks the distributor serving the area to check their dealers, with a reply link. See Alert outcomes and distributor replies.
   • Export evidence pack: a ZIP with a PDF report, every linked scan as CSV, the timeline, and a SHA-256 manifest to show the files weren’t changed. It is built when you ask; each export is on the timeline.
3. Add notes for the team. Notes and every change appear on the timeline.
4. Resolve it and record what it achieved, or mark it False positive. See Alert outcomes.

Affected serials lists the 25 most-scanned serials with their scans and districts; Copy list copies them for a revocation or a report. All N scans opens Scans filtered to the alert’s scans, whenever they happened.

Distributors

Settings → Alert rules → Distributors holds the distributors Notify distributor can reach: name, areas (states or districts, such as MH, GJ, Pune), contact person, email and WhatsApp number. An alert goes to the distributor named as its likely source, else the first whose areas cover the alert’s districts or states.

Who can do what

Action	Roles
See alerts, export evidence	Everyone
Change status and assignee, add notes, notify distributors	Admin, brand protection, supply chain
Revoke from an alert	Admin, brand protection
Edit alert rules and distributors	Admin, brand protection