diff --git a/app/Console/Commands/PollMetrics.php b/app/Console/Commands/PollMetrics.php
index d5c82b0..a050a39 100644
--- a/app/Console/Commands/PollMetrics.php
+++ b/app/Console/Commands/PollMetrics.php
@@ -4,6 +4,7 @@ namespace App\Console\Commands;
 
 use App\Events\MetricsTicked;
 use App\Models\Server;
+use App\Services\AlertEvaluator;
 use App\Services\FleetService;
 use App\Support\Ssh\CredentialVault;
 use App\Support\Ssh\SshClient;
@@ -28,7 +29,7 @@ class PollMetrics extends Command
 
     protected $description = 'Poll real metrics over SSH for credentialed servers, persist + broadcast';
 
-    public function handle(FleetService $fleet, CredentialVault $vault): int
+    public function handle(FleetService $fleet, CredentialVault $vault, AlertEvaluator $alerts): int
     {
         $interval = max(2, (int) $this->option('interval'));
 
@@ -59,8 +60,9 @@ class PollMetrics extends Command
                     $clients[$server->id] ??= (new SshClient($vault, timeout: 12))->connect($server);
 
                     $m = $fleet->readMetrics($clients[$server->id]);
-                    $fleet->applyMetrics($server, $m);
+                    $fleet->applyMetrics($server, $m); // forceFills the fresh status onto $server
                     broadcast(new MetricsTicked($m['cpu'], $m['mem'], $server->name));
+                    $this->evaluateAlerts($alerts, $server, $m, $server->status);
 
                     $this->line("ok {$server->name} cpu={$m['cpu']} mem={$m['mem']} disk={$m['disk']} load={$m['load']}");
                 } catch (Throwable $e) {
@@ -70,6 +72,7 @@ class PollMetrics extends Command
                         unset($clients[$server->id]);
                     }
                     $server->forceFill(['status' => 'offline'])->save();
+                    $this->evaluateAlerts($alerts, $server, [], 'offline'); // an offline rule fires here
                     $this->warn("offline {$server->name}: ".$e->getMessage());
                 }
             }
@@ -87,4 +90,19 @@ class PollMetrics extends Command
 
         return self::SUCCESS;
     }
+
+    /**
+     * Run the alert rules for a freshly-polled server. Best-effort: an alerting/notification error
+     * must NEVER kill the poll loop, so any throwable is caught and logged as a warning line.
+     *
+     * @param  array<string, int|float|string>  $metrics
+     */
+    private function evaluateAlerts(AlertEvaluator $alerts, Server $server, array $metrics, string $status): void
+    {
+        try {
+            $alerts->evaluate($server, $metrics, $status);
+        } catch (Throwable $e) {
+            $this->warn("alert eval failed {$server->name}: ".$e->getMessage());
+        }
+    }
 }
diff --git a/app/Livewire/Alerts/Index.php b/app/Livewire/Alerts/Index.php
new file mode 100644
index 0000000..6eb7bf0
--- /dev/null
+++ b/app/Livewire/Alerts/Index.php
@@ -0,0 +1,189 @@
+<?php
+
+namespace App\Livewire\Alerts;
+
+use App\Models\AlertIncident;
+use App\Models\AlertRule;
+use App\Models\AuditEvent;
+use App\Models\Server;
+use App\Models\ServerGroup;
+use App\Models\Setting;
+use App\Services\AlertNotifier;
+use App\Support\Confirm\ConfirmToken;
+use App\Support\Confirm\InvalidConfirmToken;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\Rule;
+use Livewire\Attributes\Layout;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+/**
+ * Alert rules + notification channels + active incidents. Managing rules/channels =
+ * manage-panel (admin): route mw + mount() + a per-method gate() (since /livewire/update
+ * skips route mw). Viewing incidents is open (read-only). Rule deletion goes through the
+ * signed single-use ConfirmToken + the R5 confirm modal.
+ */
+#[Layout('layouts.app')]
+class Index extends Component
+{
+    // New-rule form
+    public string $name = '';
+
+    public string $metric = 'cpu';
+
+    public string $comparator = 'gt';
+
+    public float $threshold = 80; // float: `load` thresholds are fractional (e.g. 1.5)
+
+    public string $scopeType = 'all';
+
+    public ?string $scopeUuid = null; // group OR server uuid, resolved on create
+
+    // Channels
+    public string $emailTo = '';
+
+    public string $webhooks = '';
+
+    public function mount(): void
+    {
+        abort_unless(Auth::user()?->can('manage-panel'), 403);
+        $this->emailTo = (string) Setting::get('alert_email_to', '');
+        $this->webhooks = (string) Setting::get('alert_webhooks', '');
+    }
+
+    public function title(): string
+    {
+        return __('alerts.title');
+    }
+
+    private function gate(): void
+    {
+        abort_unless(Auth::user()?->can('manage-panel'), 403);
+    }
+
+    private function audit(string $action, string $target): void
+    {
+        AuditEvent::create([
+            'user_id' => Auth::id(),
+            'actor' => Auth::user()?->name ?? 'system',
+            'action' => $action,
+            'target' => $target,
+            'ip' => request()->ip(),
+        ]);
+    }
+
+    public function createRule(): void
+    {
+        $this->gate();
+
+        $data = $this->validate([
+            'name' => ['required', 'string', 'max:80'],
+            'metric' => ['required', Rule::in(AlertRule::METRICS)],
+            'comparator' => ['required', Rule::in(AlertRule::COMPARATORS)],
+            'threshold' => ['required', 'numeric', 'min:0', 'max:10000'], // numeric: `load` can be fractional
+            'scopeType' => ['required', Rule::in(AlertRule::SCOPES)],
+        ]);
+
+        // Resolve the scope target (a group/server uuid) to its id — never trust a client-sent id.
+        $scopeId = null;
+        if ($data['scopeType'] === 'group') {
+            $scopeId = ServerGroup::where('uuid', $this->scopeUuid)->firstOrFail()->id;
+        } elseif ($data['scopeType'] === 'server') {
+            $scopeId = Server::where('uuid', $this->scopeUuid)->firstOrFail()->id;
+        }
+
+        $rule = AlertRule::create([
+            'name' => $data['name'],
+            'metric' => $data['metric'],
+            'comparator' => $data['comparator'],
+            'threshold' => $data['metric'] === 'offline' ? 0 : $data['threshold'],
+            'scope_type' => $data['scopeType'],
+            'scope_id' => $scopeId,
+            'enabled' => true,
+        ]);
+
+        $this->audit('alert.rule_create', $rule->name);
+        $this->reset('name', 'scopeUuid');
+        $this->dispatch('notify', message: __('alerts.rule_created', ['name' => $rule->name]));
+    }
+
+    public function toggleRule(string $uuid): void
+    {
+        $this->gate();
+        $rule = AlertRule::where('uuid', $uuid)->firstOrFail();
+        $rule->update(['enabled' => ! $rule->enabled]);
+        $this->audit('alert.rule_update', $rule->name);
+    }
+
+    public function confirmDeleteRule(string $uuid): void
+    {
+        $this->gate();
+        $rule = AlertRule::where('uuid', $uuid)->firstOrFail();
+
+        $this->dispatch('openModal',
+            component: 'modals.confirm-action',
+            arguments: [
+                'heading' => __('alerts.delete_heading'),
+                'body' => __('alerts.delete_body', ['name' => $rule->name]),
+                'confirmLabel' => __('common.delete'),
+                'danger' => true,
+                'icon' => 'trash',
+                'notify' => __('alerts.rule_deleted', ['name' => $rule->name]),
+                'token' => ConfirmToken::issue('alertRuleDeleted', ['uuid' => $rule->uuid], 'alert.rule_delete', $rule->name, null),
+            ],
+        );
+    }
+
+    #[On('alertRuleDeleted')]
+    public function deleteRule(string $confirmToken): void
+    {
+        $this->gate();
+
+        try {
+            $payload = ConfirmToken::consume($confirmToken, 'alertRuleDeleted');
+        } catch (InvalidConfirmToken) {
+            return;
+        }
+
+        // NOT audited here — the confirm modal wrote alert.rule_delete from the sealed token.
+        AlertRule::where('uuid', $payload['params']['uuid'])->first()?->delete(); // incidents cascade
+    }
+
+    public function saveChannels(): void
+    {
+        $this->gate();
+
+        // SSRF guard: refuse to store a webhook whose scheme isn't http(s) or whose host resolves to
+        // an internal/loopback/private address. Checked here (immediate feedback) and again at send.
+        foreach (preg_split('/[\r\n]+/', trim($this->webhooks)) ?: [] as $line) {
+            $line = trim($line);
+            if ($line !== '' && ! AlertNotifier::isSafeWebhookUrl($line)) {
+                $this->addError('webhooks', __('alerts.webhook_invalid', ['url' => $line]));
+
+                return;
+            }
+        }
+
+        Setting::put('alert_email_to', trim($this->emailTo));
+        Setting::put('alert_webhooks', trim($this->webhooks));
+        $this->audit('alert.channels_update', __('alerts.channels'));
+        $this->dispatch('notify', message: __('alerts.channels_saved'));
+    }
+
+    public function render(): View
+    {
+        return view('livewire.alerts.index', [
+            'rules' => AlertRule::orderBy('name')->get(),
+            'incidents' => AlertIncident::with(['rule', 'server'])->where('state', 'firing')->latest('started_at')->limit(50)->get(),
+            'groups' => ServerGroup::orderBy('name')->get(['uuid', 'name']),
+            'servers' => Server::orderBy('name')->get(['uuid', 'name']),
+            // id → name maps so a rule's scope target renders without a per-rule query (no N+1).
+            'groupNames' => ServerGroup::pluck('name', 'id'),
+            'serverNames' => Server::pluck('name', 'id'),
+            'metrics' => AlertRule::METRICS,
+            'comparators' => AlertRule::COMPARATORS,
+            'scopes' => AlertRule::SCOPES,
+        ])->title($this->title());
+    }
+}
diff --git a/app/Mail/AlertNotification.php b/app/Mail/AlertNotification.php
new file mode 100644
index 0000000..f49cbc2
--- /dev/null
+++ b/app/Mail/AlertNotification.php
@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Mail;
+
+use App\Models\AlertIncident;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+/** Queued alert e-mail — one per fire/resolve transition. Plain text (no external assets). */
+class AlertNotification extends Mailable implements ShouldQueue
+{
+    use Queueable, SerializesModels;
+
+    public function __construct(
+        public AlertIncident $incident,
+        public bool $resolved,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        $server = $this->incident->server?->name ?? '—';
+        $rule = $this->incident->rule?->name ?? '—';
+        $prefix = $this->resolved ? __('alerts.mail_subject_resolved') : __('alerts.mail_subject_firing');
+
+        return new Envelope(subject: "[{$prefix}] {$rule} — {$server}");
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            text: 'mail.alert',
+            with: [
+                'incident' => $this->incident,
+                'resolved' => $this->resolved,
+                'server' => $this->incident->server?->name ?? '—',
+                'rule' => $this->incident->rule?->name ?? '—',
+                'metric' => $this->incident->rule?->metric ?? '—',
+                'value' => $this->incident->value,
+                'threshold' => $this->incident->rule?->threshold ?? 0,
+            ],
+        );
+    }
+}
diff --git a/app/Models/AlertIncident.php b/app/Models/AlertIncident.php
new file mode 100644
index 0000000..8e0f58e
--- /dev/null
+++ b/app/Models/AlertIncident.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class AlertIncident extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'value' => 'float',
+        'started_at' => 'datetime',
+        'resolved_at' => 'datetime',
+    ];
+
+    public function rule(): BelongsTo
+    {
+        return $this->belongsTo(AlertRule::class, 'alert_rule_id');
+    }
+
+    public function server(): BelongsTo
+    {
+        return $this->belongsTo(Server::class);
+    }
+
+    public function isFiring(): bool
+    {
+        return $this->state === 'firing';
+    }
+}
diff --git a/app/Models/AlertRule.php b/app/Models/AlertRule.php
new file mode 100644
index 0000000..a9a4455
--- /dev/null
+++ b/app/Models/AlertRule.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Str;
+
+/**
+ * A threshold rule over a server metric. When a targeted server crosses it, the AlertEvaluator
+ * opens a firing AlertIncident and notifies; when it recovers, the incident resolves.
+ */
+class AlertRule extends Model
+{
+    protected $guarded = [];
+
+    protected $casts = [
+        'enabled' => 'boolean',
+        'threshold' => 'float', // % metrics are whole, but `load` is fractional (see the migration)
+    ];
+
+    /** Metrics a rule can watch. `offline` fires when a server can't be polled (status offline). */
+    public const METRICS = ['cpu', 'mem', 'disk', 'load', 'offline'];
+
+    public const COMPARATORS = ['gt', 'lt'];
+
+    public const SCOPES = ['all', 'group', 'server'];
+
+    protected static function booted(): void
+    {
+        static::creating(fn (self $r) => $r->uuid ??= (string) Str::uuid());
+    }
+
+    public function getRouteKeyName(): string
+    {
+        return 'uuid';
+    }
+
+    public function incidents(): HasMany
+    {
+        return $this->hasMany(AlertIncident::class);
+    }
+
+    /** Whether this rule applies to the given server (all / a group's members / one server). */
+    public function targets(Server $server): bool
+    {
+        return match ($this->scope_type) {
+            'server' => (int) $this->scope_id === $server->id,
+            'group' => $server->groups()->where('server_groups.id', $this->scope_id)->exists(),
+            default => true, // 'all'
+        };
+    }
+
+    /**
+     * Does the reading breach this rule? For numeric metrics, compare against the threshold with the
+     * rule's comparator; for `offline`, the breach is simply that the server is not online.
+     *
+     * @param  array<string, int|string>  $metrics  cpu/mem/disk/load ints; status when offline
+     */
+    public function breached(array $metrics, string $status): bool
+    {
+        if ($this->metric === 'offline') {
+            return $status === 'offline'; // only a truly-down server, not a reachable "warning"
+        }
+
+        $value = (float) ($metrics[$this->metric] ?? 0);
+        $threshold = (float) $this->threshold;
+
+        return $this->comparator === 'lt' ? $value < $threshold : $value > $threshold;
+    }
+
+    /** The reading to record on the incident (the breached value; 0 for offline). Float for `load`. */
+    public function reading(array $metrics): float
+    {
+        return $this->metric === 'offline' ? 0.0 : (float) ($metrics[$this->metric] ?? 0);
+    }
+}
diff --git a/app/Services/AlertEvaluator.php b/app/Services/AlertEvaluator.php
new file mode 100644
index 0000000..b2a96c4
--- /dev/null
+++ b/app/Services/AlertEvaluator.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\AlertIncident;
+use App\Models\AlertRule;
+use App\Models\Server;
+use Illuminate\Database\QueryException;
+
+/**
+ * The alert state machine. Given a server's fresh reading, opens a firing incident on a new breach
+ * (and notifies) and resolves an open incident on recovery (and notifies). Idempotent: a sustained
+ * breach with an already-open incident does nothing, so one breach = one alert, not a flood.
+ */
+class AlertEvaluator
+{
+    public function __construct(private AlertNotifier $notifier) {}
+
+    /**
+     * @param  array<string, int|string>  $metrics  cpu/mem/disk/load ints (empty when offline)
+     * @param  string  $status  the server's fresh status (online|warning|offline)
+     */
+    public function evaluate(Server $server, array $metrics, string $status): void
+    {
+        $rules = AlertRule::where('enabled', true)->get();
+
+        foreach ($rules as $rule) {
+            if (! $rule->targets($server)) {
+                continue;
+            }
+
+            // Numeric metrics need a fresh reading; skip them only when the server is truly OFFLINE
+            // (stale numbers). A reachable "warning" server still has fresh metrics, so it evaluates.
+            if ($rule->metric !== 'offline' && $status === 'offline') {
+                continue;
+            }
+
+            $this->transition($rule, $server, $rule->breached($metrics, $status), $rule->reading($metrics));
+        }
+    }
+
+    private function transition(AlertRule $rule, Server $server, bool $breached, float $reading): void
+    {
+        $open = AlertIncident::where('alert_rule_id', $rule->id)
+            ->where('server_id', $server->id)
+            ->where('state', 'firing')
+            ->first();
+
+        if ($breached && ! $open) {
+            try {
+                $incident = AlertIncident::create([
+                    'alert_rule_id' => $rule->id,
+                    'server_id' => $server->id,
+                    'state' => 'firing',
+                    'value' => $reading,
+                    // Unique while firing → a concurrent tick that also tries to open this incident
+                    // hits a unique violation instead of creating a duplicate (see the migration).
+                    'firing_key' => $rule->id.':'.$server->id,
+                    'started_at' => now(),
+                ]);
+            } catch (QueryException) {
+                return; // another tick opened it first — dedup, no duplicate incident/notification
+            }
+            $this->notifier->notify($incident, resolved: false);
+
+            return;
+        }
+
+        if (! $breached && $open) {
+            // Clear firing_key on resolve so a later re-breach can claim the unique key again.
+            $open->update(['state' => 'resolved', 'firing_key' => null, 'resolved_at' => now()]);
+            $this->notifier->notify($open, resolved: true);
+        }
+
+        // else: still firing with an open incident, or fine with none → dedup, no-op.
+    }
+}
diff --git a/app/Services/AlertNotifier.php b/app/Services/AlertNotifier.php
new file mode 100644
index 0000000..d1cc052
--- /dev/null
+++ b/app/Services/AlertNotifier.php
@@ -0,0 +1,140 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\Role;
+use App\Mail\AlertNotification;
+use App\Models\AlertIncident;
+use App\Models\Setting;
+use App\Models\User;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Throwable;
+
+/**
+ * Fans one alert transition (fire / resolve) out to the configured channels. Every channel is
+ * BEST-EFFORT: a broken SMTP config or an unreachable webhook is logged, never thrown, so a
+ * notification failure can never break the poll loop that triggered it.
+ */
+class AlertNotifier
+{
+    public function notify(AlertIncident $incident, bool $resolved): void
+    {
+        $this->email($incident, $resolved);
+        $this->webhooks($incident, $resolved);
+    }
+
+    private function email(AlertIncident $incident, bool $resolved): void
+    {
+        try {
+            $recipients = $this->recipients();
+            if ($recipients === []) {
+                return;
+            }
+            Mail::to($recipients)->queue(new AlertNotification($incident, $resolved));
+        } catch (Throwable $e) {
+            Log::warning('alert email failed: '.$e->getMessage());
+        }
+    }
+
+    private function webhooks(AlertIncident $incident, bool $resolved): void
+    {
+        $payload = $this->payload($incident, $resolved);
+
+        foreach ($this->webhookUrls() as $url) {
+            try {
+                // withoutRedirecting: a 30x could otherwise bounce the POST to an internal target that
+                // the SSRF host-check below never saw. timeout keeps a slow hook from stalling the loop.
+                Http::timeout(5)->withoutRedirecting()->asJson()->post($url, $payload);
+            } catch (Throwable $e) {
+                Log::warning('alert webhook failed: '.$e->getMessage());
+            }
+        }
+    }
+
+    /**
+     * SSRF guard for an operator-configured webhook URL: exactly http(s), and the host must NOT
+     * resolve to a loopback/private/link-local/reserved address (so a hook can't be pointed at an
+     * internal service). Admin-only config, but defence in depth — checked here AND at save time.
+     */
+    public static function isSafeWebhookUrl(string $url): bool
+    {
+        $parts = parse_url(trim($url));
+        if ($parts === false || ! isset($parts['scheme'], $parts['host'])) {
+            return false;
+        }
+        if (! in_array(strtolower($parts['scheme']), ['http', 'https'], true)) {
+            return false;
+        }
+
+        $host = $parts['host'];
+        // IP literal → itself; hostname → its A records (IPv4). Unresolvable / IPv6-only → refuse.
+        $ips = filter_var($host, FILTER_VALIDATE_IP) ? [$host] : (gethostbynamel($host) ?: []);
+        if ($ips === []) {
+            return false;
+        }
+
+        foreach ($ips as $ip) {
+            if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
+                return false; // loopback/private/link-local/reserved → blocked
+            }
+        }
+
+        return true;
+    }
+
+    /** @return list<string> */
+    private function recipients(): array
+    {
+        $configured = $this->splitLines((string) Setting::get('alert_email_to', ''));
+        $emails = array_values(array_filter($configured, fn (string $e) => filter_var($e, FILTER_VALIDATE_EMAIL) !== false));
+
+        if ($emails !== []) {
+            return $emails;
+        }
+
+        // Fall back to every admin's e-mail so a fresh install still alerts someone.
+        return User::query()->where('role', Role::Admin->value)
+            ->whereNotNull('email')
+            ->pluck('email')->all();
+    }
+
+    /** @return list<string> */
+    private function webhookUrls(): array
+    {
+        return array_values(array_filter(
+            $this->splitLines((string) Setting::get('alert_webhooks', '')),
+            fn (string $u) => self::isSafeWebhookUrl($u),
+        ));
+    }
+
+    /** @return array<string, mixed> */
+    private function payload(AlertIncident $incident, bool $resolved): array
+    {
+        $server = $incident->server?->name ?? '—';
+        $rule = $incident->rule?->name ?? '—';
+        $state = $resolved ? 'resolved' : 'firing';
+        $text = $resolved
+            ? __('alerts.mail_subject_resolved')." — {$rule} ({$server})"
+            : __('alerts.mail_subject_firing')." — {$rule} ({$server})";
+
+        // A single `text` field satisfies Slack/Discord/Mattermost/Telegram-relay incoming webhooks;
+        // the structured fields let a custom consumer route on server/metric/state.
+        return [
+            'text' => $text,
+            'state' => $state,
+            'server' => $server,
+            'rule' => $rule,
+            'metric' => $incident->rule?->metric,
+            'value' => $incident->value,
+            'threshold' => $incident->rule?->threshold,
+        ];
+    }
+
+    /** @return list<string> */
+    private function splitLines(string $raw): array
+    {
+        return array_values(array_filter(array_map('trim', preg_split('/[\r\n,]+/', $raw) ?: [])));
+    }
+}
diff --git a/app/Support/Confirm/ConfirmToken.php b/app/Support/Confirm/ConfirmToken.php
index c585a54..13e4889 100644
--- a/app/Support/Confirm/ConfirmToken.php
+++ b/app/Support/Confirm/ConfirmToken.php
@@ -67,6 +67,7 @@ class ConfirmToken
         'releasePublic',
         'releaseYank',
         'groupConfirmed',
+        'alertRuleDeleted',
     ];
 
     /** How long an issued confirm stays valid (seconds) — generous for a human click. */
diff --git a/database/migrations/2026_07_05_100002_create_alert_rules_table.php b/database/migrations/2026_07_05_100002_create_alert_rules_table.php
new file mode 100644
index 0000000..0d0e2ba
--- /dev/null
+++ b/database/migrations/2026_07_05_100002_create_alert_rules_table.php
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('alert_rules', function (Blueprint $table) {
+            $table->id();
+            $table->uuid('uuid')->unique();
+            $table->string('name');
+            $table->string('metric');                 // cpu|mem|disk|load|offline
+            $table->string('comparator')->default('gt'); // gt|lt (ignored for offline)
+            // decimal, not int: a % metric is 0-100 but `load` is a float (e.g. 1.5) — an int
+            // threshold would truncate it so `load 1.5 > 1` never fires.
+            $table->decimal('threshold', 8, 2)->default(0);
+            $table->string('scope_type')->default('all'); // all|group|server
+            $table->unsignedBigInteger('scope_id')->nullable();
+            $table->boolean('enabled')->default(true);
+            $table->timestamps();
+
+            $table->index(['enabled', 'metric']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('alert_rules');
+    }
+};
diff --git a/database/migrations/2026_07_05_100003_create_alert_incidents_table.php b/database/migrations/2026_07_05_100003_create_alert_incidents_table.php
new file mode 100644
index 0000000..e5b4df9
--- /dev/null
+++ b/database/migrations/2026_07_05_100003_create_alert_incidents_table.php
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('alert_incidents', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('alert_rule_id')->constrained()->cascadeOnDelete();
+            $table->foreignId('server_id')->constrained()->cascadeOnDelete();
+            $table->string('state')->default('firing'); // firing|resolved
+            $table->decimal('value', 8, 2)->default(0); // float-capable (see threshold, for `load`)
+            // Set to "{rule_id}:{server_id}" ONLY while firing, NULL once resolved. The unique index
+            // makes "at most one FIRING incident per rule+server" a DB invariant, so two concurrent
+            // poll ticks cannot both open a duplicate incident (the loser hits a unique violation).
+            $table->string('firing_key')->nullable()->unique();
+            $table->timestamp('started_at')->nullable();
+            $table->timestamp('resolved_at')->nullable();
+            $table->timestamps();
+
+            // Hot path: "is there an open incident for this rule+server?"
+            $table->index(['alert_rule_id', 'server_id', 'state']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('alert_incidents');
+    }
+};
diff --git a/lang/de/alerts.php b/lang/de/alerts.php
new file mode 100644
index 0000000..2989022
--- /dev/null
+++ b/lang/de/alerts.php
@@ -0,0 +1,82 @@
+<?php
+
+return [
+    'eyebrow' => 'Betrieb',
+    'title' => 'Alarme',
+    'subtitle' => 'Schwellwert-Regeln + Benachrichtigungen für die Flotte',
+
+    // New rule
+    'new_rule' => 'Neue Regel',
+    'name_label' => 'Name',
+    'name_placeholder' => 'CPU hoch, Server offline …',
+    'metric_label' => 'Metrik',
+    'comparator_label' => 'Bedingung',
+    'threshold_label' => 'Schwelle',
+    'scope_label' => 'Geltungsbereich',
+    'scope_target_label' => 'Ziel',
+    'create' => 'Anlegen',
+
+    // Metrics
+    'metric_cpu' => 'CPU',
+    'metric_mem' => 'Arbeitsspeicher',
+    'metric_disk' => 'Festplatte',
+    'metric_load' => 'Load',
+    'metric_offline' => 'Server offline',
+
+    // Comparators
+    'comparator_gt' => 'größer als',
+    'comparator_lt' => 'kleiner als',
+
+    // Scopes
+    'scope_all' => 'Ganze Flotte',
+    'scope_group' => 'Gruppe',
+    'scope_server' => 'Einzelner Server',
+
+    // Rules list
+    'rules_title' => 'Regeln',
+    'no_rules_title' => 'Keine Regeln',
+    'no_rules' => 'Noch keine Alarmregeln. Lege oben die erste an.',
+    'enabled' => 'Aktiv',
+    'disabled' => 'Inaktiv',
+    'rule_summary_offline' => ':scope · Server offline',
+    'rule_summary' => ':scope · :metric :comparator :threshold',
+
+    // Incidents
+    'incidents_title' => 'Aktive Alarme',
+    'incidents_subtitle' => 'derzeit ausgelöst',
+    'no_incidents_title' => 'Alles ruhig',
+    'no_incidents' => 'Derzeit keine aktiven Alarme.',
+    'incident_value' => 'Wert: :value',
+    'incident_since' => 'seit :time',
+
+    // Channels
+    'channels' => 'Kanäle',
+    'channels_title' => 'Benachrichtigungs-Kanäle',
+    'channels_subtitle' => 'wohin Alarme gehen',
+    'email_label' => 'E-Mail-Empfänger',
+    'email_hint' => 'Eine Adresse pro Zeile. Leer = alle Admins.',
+    'webhooks_label' => 'Webhooks',
+    'webhooks_hint' => 'Eine URL pro Zeile (Slack/Discord/Mattermost/eigene).',
+    'save' => 'Speichern',
+
+    // Toasts
+    'rule_created' => 'Regel „:name“ angelegt.',
+    'rule_deleted' => 'Regel „:name“ gelöscht.',
+    'channels_saved' => 'Kanäle gespeichert.',
+    'webhook_invalid' => 'Ungültige oder unsichere Webhook-URL: :url (nur http/https zu öffentlichen Hosts).',
+
+    // Delete confirm
+    'delete_heading' => 'Regel löschen',
+    'delete_body' => 'Die Regel „:name“ und ihre Alarm-Historie werden gelöscht.',
+
+    // Mail
+    'mail_subject_firing' => 'ALARM',
+    'mail_subject_resolved' => 'BEHOBEN',
+    'mail_firing_line' => 'Ein Alarm wurde ausgelöst.',
+    'mail_resolved_line' => 'Ein Alarm wurde behoben.',
+    'mail_server' => 'Server',
+    'mail_rule' => 'Regel',
+    'mail_metric' => 'Metrik',
+    'mail_value' => 'Wert',
+    'mail_threshold' => 'Schwelle',
+];
diff --git a/lang/de/audit.php b/lang/de/audit.php
index 4d86fd5..d7ee025 100644
--- a/lang/de/audit.php
+++ b/lang/de/audit.php
@@ -33,6 +33,10 @@ return [
 
     // Human-readable labels for the raw action codes shown in the event list.
     'actions' => [
+        'alert.rule_create' => 'Alarmregel angelegt',
+        'alert.rule_update' => 'Alarmregel geändert',
+        'alert.rule_delete' => 'Alarmregel gelöscht',
+        'alert.channels_update' => 'Alarm-Kanäle geändert',
         'audit.retention_set' => 'Aufbewahrung geändert',
         'auth.login_failed' => 'Fehlgeschlagene Anmeldung',
         'auth.2fa_failed' => 'Fehlgeschlagene 2FA-Prüfung',
diff --git a/lang/de/shell.php b/lang/de/shell.php
index 3f8d6f7..dc71e54 100644
--- a/lang/de/shell.php
+++ b/lang/de/shell.php
@@ -22,6 +22,7 @@ return [
     'nav_terminal' => 'Terminal',
     'nav_settings' => 'Einstellungen',
     'nav_system' => 'System',
+    'nav_alerts' => 'Alarme',
     'nav_threats' => 'Bedrohungen',
     'nav_versions' => 'Version',
     'nav_help' => 'Hilfe',
diff --git a/lang/en/alerts.php b/lang/en/alerts.php
new file mode 100644
index 0000000..9ad8f27
--- /dev/null
+++ b/lang/en/alerts.php
@@ -0,0 +1,82 @@
+<?php
+
+return [
+    'eyebrow' => 'Operations',
+    'title' => 'Alerts',
+    'subtitle' => 'Threshold rules + notifications for the fleet',
+
+    // New rule
+    'new_rule' => 'New rule',
+    'name_label' => 'Name',
+    'name_placeholder' => 'High CPU, server offline …',
+    'metric_label' => 'Metric',
+    'comparator_label' => 'Condition',
+    'threshold_label' => 'Threshold',
+    'scope_label' => 'Scope',
+    'scope_target_label' => 'Target',
+    'create' => 'Create',
+
+    // Metrics
+    'metric_cpu' => 'CPU',
+    'metric_mem' => 'Memory',
+    'metric_disk' => 'Disk',
+    'metric_load' => 'Load',
+    'metric_offline' => 'Server offline',
+
+    // Comparators
+    'comparator_gt' => 'greater than',
+    'comparator_lt' => 'less than',
+
+    // Scopes
+    'scope_all' => 'Whole fleet',
+    'scope_group' => 'Group',
+    'scope_server' => 'Single server',
+
+    // Rules list
+    'rules_title' => 'Rules',
+    'no_rules_title' => 'No rules',
+    'no_rules' => 'No alert rules yet. Create the first one above.',
+    'enabled' => 'Enabled',
+    'disabled' => 'Disabled',
+    'rule_summary_offline' => ':scope · server offline',
+    'rule_summary' => ':scope · :metric :comparator :threshold',
+
+    // Incidents
+    'incidents_title' => 'Active alerts',
+    'incidents_subtitle' => 'currently firing',
+    'no_incidents_title' => 'All quiet',
+    'no_incidents' => 'No active alerts right now.',
+    'incident_value' => 'Value: :value',
+    'incident_since' => 'since :time',
+
+    // Channels
+    'channels' => 'Channels',
+    'channels_title' => 'Notification channels',
+    'channels_subtitle' => 'where alerts go',
+    'email_label' => 'E-mail recipients',
+    'email_hint' => 'One address per line. Empty = all admins.',
+    'webhooks_label' => 'Webhooks',
+    'webhooks_hint' => 'One URL per line (Slack/Discord/Mattermost/custom).',
+    'save' => 'Save',
+
+    // Toasts
+    'rule_created' => 'Rule “:name” created.',
+    'rule_deleted' => 'Rule “:name” deleted.',
+    'channels_saved' => 'Channels saved.',
+    'webhook_invalid' => 'Invalid or unsafe webhook URL: :url (only http/https to public hosts).',
+
+    // Delete confirm
+    'delete_heading' => 'Delete rule',
+    'delete_body' => 'The rule “:name” and its alert history will be deleted.',
+
+    // Mail
+    'mail_subject_firing' => 'ALERT',
+    'mail_subject_resolved' => 'RESOLVED',
+    'mail_firing_line' => 'An alert has fired.',
+    'mail_resolved_line' => 'An alert has resolved.',
+    'mail_server' => 'Server',
+    'mail_rule' => 'Rule',
+    'mail_metric' => 'Metric',
+    'mail_value' => 'Value',
+    'mail_threshold' => 'Threshold',
+];
diff --git a/lang/en/audit.php b/lang/en/audit.php
index 65ae915..3b51256 100644
--- a/lang/en/audit.php
+++ b/lang/en/audit.php
@@ -33,6 +33,10 @@ return [
 
     // Human-readable labels for the raw action codes shown in the event list.
     'actions' => [
+        'alert.rule_create' => 'Alert rule created',
+        'alert.rule_update' => 'Alert rule changed',
+        'alert.rule_delete' => 'Alert rule deleted',
+        'alert.channels_update' => 'Alert channels changed',
         'audit.retention_set' => 'Retention changed',
         'auth.login_failed' => 'Failed sign-in',
         'auth.2fa_failed' => 'Failed 2FA check',
diff --git a/lang/en/shell.php b/lang/en/shell.php
index 056edf5..6c3a040 100644
--- a/lang/en/shell.php
+++ b/lang/en/shell.php
@@ -22,6 +22,7 @@ return [
     'nav_terminal' => 'Terminal',
     'nav_settings' => 'Settings',
     'nav_system' => 'System',
+    'nav_alerts' => 'Alerts',
     'nav_threats' => 'Threats',
     'nav_versions' => 'Version',
     'nav_help' => 'Help',
diff --git a/resources/views/components/sidebar.blade.php b/resources/views/components/sidebar.blade.php
index b96328f..1928653 100644
--- a/resources/views/components/sidebar.blade.php
+++ b/resources/views/components/sidebar.blade.php
@@ -10,6 +10,12 @@
             ->where('created_at', '>', now()->subDay())
             ->count(),
     );
+    // Active (firing) alert incidents → the Alarme nav badge. Cached like the threats count.
+    $alertCount = \Illuminate\Support\Facades\Cache::remember(
+        'alerts:firing_count',
+        60,
+        fn () => \App\Models\AlertIncident::where('state', 'firing')->count(),
+    );
 @endphp
 {{-- Fixed on desktop, off-canvas drawer on mobile/tablet (toggled by `nav` in the layout). --}}
 <aside class="fixed inset-y-0 left-0 z-40 flex w-[272px] -translate-x-full flex-col border-r border-line bg-surface transition-transform duration-200 lg:translate-x-0"
@@ -51,6 +57,7 @@
         <x-nav-item icon="settings" href="/settings" :active="request()->is('settings*')" data-tour="settings">{{ __('shell.nav_settings') }}</x-nav-item>
         <x-nav-item icon="shield" href="/system" :active="request()->is('system*')">{{ __('shell.nav_system') }}</x-nav-item>
         @can('manage-panel')
+            <x-nav-item icon="alert" href="/alerts" :active="request()->is('alerts*')" :badge="$alertCount > 0 ? $alertCount : null" :badge-title="$alertCount > 0 ? __('alerts.incidents_title') : null">{{ __('shell.nav_alerts') }}</x-nav-item>
             <x-nav-item icon="shield-alert" href="/threats" :active="request()->is('threats*')" :badge="$threatCount > 0 ? $threatCount : null" :badge-title="$threatCount > 0 ? __('shell.threats_badge', ['count' => $threatCount]) : null">{{ __('shell.nav_threats') }}</x-nav-item>
         @endcan
         <x-nav-item icon="tag" href="/versions" :active="request()->is('versions*')" :badge="$updateAvailable ? '1' : null" :badge-title="$updateAvailable ? __('shell.update_available') : null">{{ __('shell.nav_versions') }}</x-nav-item>
diff --git a/resources/views/livewire/alerts/index.blade.php b/resources/views/livewire/alerts/index.blade.php
new file mode 100644
index 0000000..152455f
--- /dev/null
+++ b/resources/views/livewire/alerts/index.blade.php
@@ -0,0 +1,176 @@
+@php
+    $field = 'h-9 w-full rounded-md border border-line bg-inset px-3 text-sm text-ink focus:border-accent/40 focus:outline-none';
+    $label = 'mb-1 block font-mono text-[11px] uppercase tracking-wider text-ink-3';
+    $scopeName = function ($rule) use ($groupNames, $serverNames) {
+        return match ($rule->scope_type) {
+            'group' => $groupNames[$rule->scope_id] ?? __('alerts.scope_group'),
+            'server' => $serverNames[$rule->scope_id] ?? __('alerts.scope_server'),
+            default => __('alerts.scope_all'),
+        };
+    };
+@endphp
+
+<div class="space-y-5">
+    {{-- Header --}}
+    <div>
+        <p class="font-mono text-[11px] uppercase tracking-[0.2em] text-accent-text">{{ __('alerts.eyebrow') }}</p>
+        <h2 class="mt-0.5 font-display text-xl font-semibold text-ink sm:text-2xl">{{ __('alerts.title') }}</h2>
+        <p class="mt-1 text-sm text-ink-3">{{ __('alerts.subtitle') }}</p>
+    </div>
+
+    {{-- Active incidents --}}
+    <x-panel :title="__('alerts.incidents_title')" :subtitle="__('alerts.incidents_subtitle')" :padded="false">
+        @if ($incidents->isEmpty())
+            <div class="flex flex-col items-center gap-2 py-8 text-center">
+                <x-status-dot status="online" class="h-2.5 w-2.5" />
+                <p class="font-display text-sm font-semibold text-ink">{{ __('alerts.no_incidents_title') }}</p>
+                <p class="text-xs text-ink-3">{{ __('alerts.no_incidents') }}</p>
+            </div>
+        @else
+            <div class="divide-y divide-line">
+                @foreach ($incidents as $incident)
+                    <div wire:key="inc-{{ $incident->id }}" class="flex flex-wrap items-center gap-3 px-4 py-3 sm:px-5">
+                        <x-status-dot status="offline" :ping="true" class="h-2.5 w-2.5" />
+                        <div class="min-w-0 flex-1">
+                            <p class="truncate text-sm font-medium text-ink">{{ $incident->rule?->name ?? '—' }}</p>
+                            <p class="truncate font-mono text-[11px] text-ink-3">{{ $incident->server?->name ?? '—' }} · {{ __('alerts.incident_value', ['value' => $incident->value]) }}</p>
+                        </div>
+                        <span class="shrink-0 font-mono text-[11px] text-ink-4">{{ __('alerts.incident_since', ['time' => $incident->started_at?->diffForHumans() ?? '—']) }}</span>
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </x-panel>
+
+    {{-- New rule --}}
+    <x-panel :title="__('alerts.new_rule')">
+        <form wire:submit="createRule" class="space-y-4">
+            <div class="grid gap-4 sm:grid-cols-2">
+                <div>
+                    <label class="{{ $label }}">{{ __('alerts.name_label') }}</label>
+                    <input wire:model="name" type="text" maxlength="80" placeholder="{{ __('alerts.name_placeholder') }}" class="{{ $field }} placeholder:text-ink-4" />
+                    @error('name') <p class="mt-1 flex items-center gap-1.5 font-mono text-[11px] text-offline"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+                </div>
+                <div>
+                    <label class="{{ $label }}">{{ __('alerts.metric_label') }}</label>
+                    <select wire:model.live="metric" class="{{ $field }}">
+                        @foreach ($metrics as $m)
+                            <option value="{{ $m }}">{{ __('alerts.metric_'.$m) }}</option>
+                        @endforeach
+                    </select>
+                </div>
+            </div>
+
+            @if ($metric !== 'offline')
+                <div class="grid gap-4 sm:grid-cols-2">
+                    <div>
+                        <label class="{{ $label }}">{{ __('alerts.comparator_label') }}</label>
+                        <select wire:model="comparator" class="{{ $field }}">
+                            @foreach ($comparators as $c)
+                                <option value="{{ $c }}">{{ __('alerts.comparator_'.$c) }}</option>
+                            @endforeach
+                        </select>
+                    </div>
+                    <div>
+                        <label class="{{ $label }}">{{ __('alerts.threshold_label') }}</label>
+                        <input wire:model="threshold" type="number" min="0" max="100" class="{{ $field }} font-mono" />
+                        @error('threshold') <p class="mt-1 flex items-center gap-1.5 font-mono text-[11px] text-offline"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+                    </div>
+                </div>
+            @endif
+
+            <div class="grid gap-4 sm:grid-cols-2">
+                <div>
+                    <label class="{{ $label }}">{{ __('alerts.scope_label') }}</label>
+                    <select wire:model.live="scopeType" class="{{ $field }}">
+                        @foreach ($scopes as $s)
+                            <option value="{{ $s }}">{{ __('alerts.scope_'.$s) }}</option>
+                        @endforeach
+                    </select>
+                </div>
+                @if ($scopeType === 'group')
+                    <div>
+                        <label class="{{ $label }}">{{ __('alerts.scope_target_label') }}</label>
+                        <select wire:model="scopeUuid" class="{{ $field }}">
+                            <option value="">—</option>
+                            @foreach ($groups as $grp)
+                                <option value="{{ $grp->uuid }}">{{ $grp->name }}</option>
+                            @endforeach
+                        </select>
+                    </div>
+                @elseif ($scopeType === 'server')
+                    <div>
+                        <label class="{{ $label }}">{{ __('alerts.scope_target_label') }}</label>
+                        <select wire:model="scopeUuid" class="{{ $field }}">
+                            <option value="">—</option>
+                            @foreach ($servers as $srv)
+                                <option value="{{ $srv->uuid }}">{{ $srv->name }}</option>
+                            @endforeach
+                        </select>
+                    </div>
+                @endif
+            </div>
+
+            <div class="flex justify-end">
+                <x-btn variant="primary" size="lg" type="submit">{{ __('alerts.create') }}</x-btn>
+            </div>
+        </form>
+    </x-panel>
+
+    {{-- Rules --}}
+    <x-panel :title="__('alerts.rules_title')" :padded="false">
+        @if ($rules->isEmpty())
+            <div class="px-4 py-8 text-center sm:px-5">
+                <p class="font-display text-sm font-semibold text-ink">{{ __('alerts.no_rules_title') }}</p>
+                <p class="mt-1 text-xs text-ink-3">{{ __('alerts.no_rules') }}</p>
+            </div>
+        @else
+            <div class="divide-y divide-line">
+                @foreach ($rules as $rule)
+                    <div wire:key="rule-{{ $rule->uuid }}" class="flex flex-wrap items-center gap-3 px-4 py-3 sm:px-5">
+                        <div class="min-w-0 flex-1">
+                            <p class="truncate text-sm font-medium text-ink">{{ $rule->name }}</p>
+                            <p class="truncate font-mono text-[11px] text-ink-3">
+                                @if ($rule->metric === 'offline')
+                                    {{ __('alerts.rule_summary_offline', ['scope' => $scopeName($rule)]) }}
+                                @else
+                                    {{ __('alerts.rule_summary', ['scope' => $scopeName($rule), 'metric' => __('alerts.metric_'.$rule->metric), 'comparator' => __('alerts.comparator_'.$rule->comparator), 'threshold' => $rule->threshold]) }}
+                                @endif
+                            </p>
+                        </div>
+                        <button type="button" wire:click="toggleRule('{{ $rule->uuid }}')"
+                                @class([
+                                    'inline-flex min-h-9 shrink-0 items-center gap-1.5 rounded-md border px-2.5 text-xs transition-colors',
+                                    'border-online/20 bg-online/10 text-online' => $rule->enabled,
+                                    'border-line bg-inset text-ink-3 hover:bg-raised' => ! $rule->enabled,
+                                ])>
+                            <x-status-dot :status="$rule->enabled ? 'online' : 'offline'" class="h-2 w-2" />
+                            {{ $rule->enabled ? __('alerts.enabled') : __('alerts.disabled') }}
+                        </button>
+                        <x-modal-trigger variant="danger-soft" action="confirmDeleteRule('{{ $rule->uuid }}')">{{ __('common.delete') }}</x-modal-trigger>
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </x-panel>
+
+    {{-- Channels --}}
+    <x-panel :title="__('alerts.channels_title')" :subtitle="__('alerts.channels_subtitle')">
+        <form wire:submit="saveChannels" class="space-y-4">
+            <div>
+                <label class="{{ $label }}">{{ __('alerts.email_label') }}</label>
+                <textarea wire:model="emailTo" rows="2" class="{{ $field }} h-auto py-2.5 font-mono" placeholder="ops@example.com"></textarea>
+                <p class="mt-1 font-mono text-[11px] text-ink-4">{{ __('alerts.email_hint') }}</p>
+            </div>
+            <div>
+                <label class="{{ $label }}">{{ __('alerts.webhooks_label') }}</label>
+                <textarea wire:model="webhooks" rows="2" class="{{ $field }} h-auto py-2.5 font-mono" placeholder="https://hooks.slack.com/…"></textarea>
+                @error('webhooks') <p class="mt-1 flex items-center gap-1.5 font-mono text-[11px] text-offline"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
+                <p class="mt-1 font-mono text-[11px] text-ink-4">{{ __('alerts.webhooks_hint') }}</p>
+            </div>
+            <div class="flex justify-end">
+                <x-btn variant="primary" size="lg" type="submit">{{ __('alerts.save') }}</x-btn>
+            </div>
+        </form>
+    </x-panel>
+</div>
diff --git a/resources/views/mail/alert.blade.php b/resources/views/mail/alert.blade.php
new file mode 100644
index 0000000..55f1184
--- /dev/null
+++ b/resources/views/mail/alert.blade.php
@@ -0,0 +1,9 @@
+{{ $resolved ? __('alerts.mail_resolved_line') : __('alerts.mail_firing_line') }}
+
+{{ __('alerts.mail_server') }}: {{ $server }}
+{{ __('alerts.mail_rule') }}: {{ $rule }}
+{{ __('alerts.mail_metric') }}: {{ $metric }}
+{{ __('alerts.mail_value') }}: {{ $value }}
+{{ __('alerts.mail_threshold') }}: {{ $threshold }}
+
+— Clusev
diff --git a/routes/web.php b/routes/web.php
index 7509159..5e2c6d2 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -5,6 +5,7 @@ use App\Http\Middleware\BlockBannedIp;
 use App\Http\Middleware\EnsureSecurityOnboarded;
 use App\Http\Middleware\SetLocale;
 use App\Http\Middleware\VerifyTerminalSidecarSecret;
+use App\Livewire\Alerts;
 use App\Livewire\Audit;
 use App\Livewire\Auth;
 use App\Livewire\Dashboard;
@@ -227,6 +228,7 @@ Route::middleware('auth')->group(function () {
         // Honeypot intelligence dashboard — admin-only (defense-in-depth: the route middleware here
         // AND Threats\Index::mount() abort_unless both gate on manage-panel).
         Route::get('/threats', Threats\Index::class)->name('threats')->middleware('can:manage-panel');
+        Route::get('/alerts', Alerts\Index::class)->middleware('can:manage-panel')->name('alerts');
 
         Route::get('/settings', Settings\Index::class)->name('settings');
         Route::get('/versions', Versions\Index::class)->name('versions');
diff --git a/tests/Feature/AlertEvaluatorTest.php b/tests/Feature/AlertEvaluatorTest.php
new file mode 100644
index 0000000..9942407
--- /dev/null
+++ b/tests/Feature/AlertEvaluatorTest.php
@@ -0,0 +1,195 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\AlertIncident;
+use App\Models\AlertRule;
+use App\Models\Server;
+use App\Models\ServerGroup;
+use App\Services\AlertEvaluator;
+use App\Services\AlertNotifier;
+use Illuminate\Database\QueryException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Mockery;
+use Tests\TestCase;
+
+class AlertEvaluatorTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function tearDown(): void
+    {
+        Mockery::close();
+        parent::tearDown();
+    }
+
+    /** Evaluator with a notifier spy so no real mail/http is sent; returns [$evaluator, $notifier]. */
+    private function make(): array
+    {
+        $notifier = Mockery::mock(AlertNotifier::class);
+
+        return [new AlertEvaluator($notifier), $notifier];
+    }
+
+    private function server(string $ip = '10.0.0.1'): Server
+    {
+        return Server::create(['name' => 'box', 'ip' => $ip, 'ssh_port' => 22, 'status' => 'online']);
+    }
+
+    public function test_a_numeric_breach_opens_a_firing_incident_and_notifies(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once()->with(Mockery::type(AlertIncident::class), false);
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        $eval->evaluate($server, ['cpu' => 95, 'mem' => 10, 'disk' => 10, 'load' => 1], 'online');
+
+        $this->assertDatabaseHas('alert_incidents', ['server_id' => $server->id, 'state' => 'firing', 'value' => 95]);
+    }
+
+    public function test_a_sustained_breach_does_not_open_a_second_incident(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once(); // fired once, deduped after
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        $eval->evaluate($server, ['cpu' => 95], 'online');
+        $eval->evaluate($server, ['cpu' => 96], 'online'); // still breached → dedup
+
+        $this->assertSame(1, AlertIncident::where('state', 'firing')->count());
+    }
+
+    public function test_recovery_resolves_the_incident_and_notifies(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once()->with(Mockery::type(AlertIncident::class), false);
+        $notifier->shouldReceive('notify')->once()->with(Mockery::type(AlertIncident::class), true);
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        $eval->evaluate($server, ['cpu' => 95], 'online'); // fire
+        $eval->evaluate($server, ['cpu' => 20], 'online'); // recover
+
+        $this->assertSame(0, AlertIncident::where('state', 'firing')->count());
+        $this->assertDatabaseHas('alert_incidents', ['state' => 'resolved']);
+    }
+
+    public function test_lt_comparator_fires_below_the_threshold(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once();
+        AlertRule::create(['name' => 'Disk free low', 'metric' => 'disk', 'comparator' => 'lt', 'threshold' => 10, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        $eval->evaluate($server, ['disk' => 5], 'online');
+
+        $this->assertDatabaseHas('alert_incidents', ['state' => 'firing', 'value' => 5]);
+    }
+
+    public function test_offline_rule_fires_when_not_online_and_skips_numeric(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once()->with(Mockery::type(AlertIncident::class), false);
+        AlertRule::create(['name' => 'Down', 'metric' => 'offline', 'scope_type' => 'all', 'enabled' => true]);
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 1, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        // Offline poll: stale metrics, status offline → only the offline rule fires, cpu is skipped.
+        $eval->evaluate($server, [], 'offline');
+
+        $this->assertSame(1, AlertIncident::where('state', 'firing')->count());
+        $this->assertDatabaseHas('alert_incidents', ['alert_rule_id' => AlertRule::where('metric', 'offline')->first()->id]);
+    }
+
+    public function test_offline_incident_resolves_when_the_server_comes_back(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->twice();
+        AlertRule::create(['name' => 'Down', 'metric' => 'offline', 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        $eval->evaluate($server, [], 'offline');                  // fire
+        $eval->evaluate($server, ['cpu' => 5], 'online');         // back online → resolve
+
+        $this->assertSame(0, AlertIncident::where('state', 'firing')->count());
+    }
+
+    public function test_a_fractional_load_breach_fires_and_is_not_truncated(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once();
+        // Regression: load 1.5 with threshold 1 used to truncate to `1 > 1` = false and never fire.
+        AlertRule::create(['name' => 'Load', 'metric' => 'load', 'comparator' => 'gt', 'threshold' => 1, 'scope_type' => 'all', 'enabled' => true]);
+
+        $eval->evaluate($this->server(), ['cpu' => 5, 'load' => 1.5], 'online');
+
+        $this->assertDatabaseHas('alert_incidents', ['state' => 'firing', 'value' => 1.5]);
+    }
+
+    public function test_firing_key_is_a_unique_db_invariant(): void
+    {
+        $rule = AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+        $key = $rule->id.':'.$server->id;
+        AlertIncident::create(['alert_rule_id' => $rule->id, 'server_id' => $server->id, 'state' => 'firing', 'value' => 90, 'firing_key' => $key, 'started_at' => now()]);
+
+        // A concurrent tick opening the same firing incident hits the unique index → no duplicate.
+        $this->expectException(QueryException::class);
+        AlertIncident::create(['alert_rule_id' => $rule->id, 'server_id' => $server->id, 'state' => 'firing', 'value' => 91, 'firing_key' => $key, 'started_at' => now()]);
+    }
+
+    public function test_a_resolved_incident_frees_the_firing_key_for_a_re_breach(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->times(3); // fire, resolve, fire again
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = $this->server();
+
+        $eval->evaluate($server, ['cpu' => 95], 'online'); // fire
+        $eval->evaluate($server, ['cpu' => 10], 'online'); // resolve → firing_key nulled
+        $eval->evaluate($server, ['cpu' => 95], 'online'); // re-breach can claim the key again
+
+        $this->assertSame(1, AlertIncident::where('state', 'firing')->count());
+        $this->assertSame(2, AlertIncident::count()); // one resolved + one new firing
+    }
+
+    public function test_a_disabled_rule_never_fires(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->never();
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 1, 'scope_type' => 'all', 'enabled' => false]);
+
+        $eval->evaluate($this->server(), ['cpu' => 99], 'online');
+
+        $this->assertDatabaseCount('alert_incidents', 0);
+    }
+
+    public function test_scope_server_only_targets_that_server(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->never();
+        $target = $this->server('10.0.0.1');
+        $other = $this->server('10.0.0.2');
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 50, 'scope_type' => 'server', 'scope_id' => $target->id, 'enabled' => true]);
+
+        $eval->evaluate($other, ['cpu' => 99], 'online'); // not the targeted server → nothing
+
+        $this->assertDatabaseCount('alert_incidents', 0);
+    }
+
+    public function test_scope_group_targets_only_members(): void
+    {
+        [$eval, $notifier] = $this->make();
+        $notifier->shouldReceive('notify')->once();
+        $group = ServerGroup::create(['name' => 'prod', 'color' => 'online']);
+        $member = $this->server('10.0.0.1');
+        $group->servers()->attach($member->id);
+        AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 50, 'scope_type' => 'group', 'scope_id' => $group->id, 'enabled' => true]);
+
+        $eval->evaluate($member, ['cpu' => 99], 'online');
+
+        $this->assertDatabaseHas('alert_incidents', ['server_id' => $member->id, 'state' => 'firing']);
+    }
+}
diff --git a/tests/Feature/AlertNotifierTest.php b/tests/Feature/AlertNotifierTest.php
new file mode 100644
index 0000000..a049098
--- /dev/null
+++ b/tests/Feature/AlertNotifierTest.php
@@ -0,0 +1,108 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Mail\AlertNotification;
+use App\Models\AlertIncident;
+use App\Models\AlertRule;
+use App\Models\Server;
+use App\Models\Setting;
+use App\Models\User;
+use App\Services\AlertNotifier;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Mail;
+use Tests\TestCase;
+
+class AlertNotifierTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function incident(): AlertIncident
+    {
+        $rule = AlertRule::create(['name' => 'CPU', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = Server::create(['name' => 'box', 'ip' => '10.0.0.1', 'ssh_port' => 22, 'status' => 'online']);
+
+        return AlertIncident::create(['alert_rule_id' => $rule->id, 'server_id' => $server->id, 'state' => 'firing', 'value' => 95, 'started_at' => now()]);
+    }
+
+    public function test_email_is_queued_to_the_configured_recipients(): void
+    {
+        Mail::fake();
+        Setting::put('alert_email_to', "ops@example.com\nsecond@example.com");
+
+        app(AlertNotifier::class)->notify($this->incident(), resolved: false);
+
+        Mail::assertQueued(AlertNotification::class, fn (AlertNotification $m) => $m->hasTo('ops@example.com'));
+    }
+
+    public function test_falls_back_to_admin_emails_when_none_configured(): void
+    {
+        Mail::fake();
+        $admin = User::factory()->create(['email' => 'admin@example.com', 'must_change_password' => false]); // admin by default
+
+        app(AlertNotifier::class)->notify($this->incident(), resolved: false);
+
+        Mail::assertQueued(AlertNotification::class, fn (AlertNotification $m) => $m->hasTo('admin@example.com'));
+    }
+
+    public function test_a_webhook_is_posted_with_the_payload(): void
+    {
+        Mail::fake();
+        Http::fake();
+        Setting::put('alert_webhooks', 'https://8.8.8.8/incoming'); // public IP literal (no DNS, passes the SSRF check)
+
+        app(AlertNotifier::class)->notify($this->incident(), resolved: false);
+
+        Http::assertSent(fn ($request) => $request->url() === 'https://8.8.8.8/incoming'
+            && $request['state'] === 'firing'
+            && $request['server'] === 'box'
+            && (int) $request['value'] === 95); // value is a float column (95.0)
+    }
+
+    public function test_a_non_http_webhook_value_is_ignored(): void
+    {
+        Mail::fake();
+        Http::fake();
+        Setting::put('alert_webhooks', "javascript:alert(1)\nnot a url");
+
+        app(AlertNotifier::class)->notify($this->incident(), resolved: false);
+
+        Http::assertNothingSent();
+    }
+
+    public function test_unsafe_webhook_urls_are_rejected(): void
+    {
+        $unsafe = [
+            'http://127.0.0.1/hook',                     // loopback
+            'https://10.0.0.5/hook',                     // private
+            'http://192.168.1.10/x',                     // private
+            'http://169.254.169.254/latest/meta-data',   // link-local (cloud-metadata SSRF classic)
+            'http://localhost/x',                        // resolves to loopback
+            'ftp://example.com/x',                       // bad scheme
+            'httpx://8.8.8.8/x',                         // bad scheme
+            'https:///x',                                // no host
+        ];
+
+        foreach ($unsafe as $url) {
+            $this->assertFalse(AlertNotifier::isSafeWebhookUrl($url), "should reject {$url}");
+        }
+    }
+
+    public function test_public_https_webhook_is_accepted(): void
+    {
+        $this->assertTrue(AlertNotifier::isSafeWebhookUrl('https://8.8.8.8/hook')); // public IP, no DNS needed
+    }
+
+    public function test_a_failing_channel_is_swallowed(): void
+    {
+        Mail::fake();
+        Http::fake(fn () => throw new \RuntimeException('connection refused'));
+        Setting::put('alert_webhooks', 'https://8.8.8.8/incoming');
+
+        // Must NOT throw — a broken channel can never break the poll loop that called notify().
+        app(AlertNotifier::class)->notify($this->incident(), resolved: false);
+
+        $this->assertTrue(true);
+    }
+}
diff --git a/tests/Feature/AlertsComponentTest.php b/tests/Feature/AlertsComponentTest.php
new file mode 100644
index 0000000..4a8ed2a
--- /dev/null
+++ b/tests/Feature/AlertsComponentTest.php
@@ -0,0 +1,182 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Livewire\Alerts\Index;
+use App\Models\AlertIncident;
+use App\Models\AlertRule;
+use App\Models\Server;
+use App\Models\ServerGroup;
+use App\Models\Setting;
+use App\Models\User;
+use App\Support\Confirm\ConfirmToken;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+use Tests\TestCase;
+
+class AlertsComponentTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private function admin(): User
+    {
+        return User::factory()->create(['must_change_password' => false]);
+    }
+
+    private function operator(): User
+    {
+        return User::factory()->operator()->create(['must_change_password' => false]);
+    }
+
+    private function viewer(): User
+    {
+        return User::factory()->viewer()->create(['must_change_password' => false]);
+    }
+
+    // ── route gating (manage-panel = admin) ─────────────────────────────────────
+
+    public function test_viewer_cannot_open_alerts(): void
+    {
+        $this->actingAs($this->viewer())->get('/alerts')->assertForbidden();
+    }
+
+    public function test_operator_cannot_open_alerts(): void
+    {
+        $this->actingAs($this->operator())->get('/alerts')->assertForbidden();
+    }
+
+    public function test_admin_can_open_alerts(): void
+    {
+        $this->actingAs($this->admin())->get('/alerts')->assertOk();
+    }
+
+    // ── rule create ─────────────────────────────────────────────────────────────
+
+    public function test_admin_creates_a_fleet_wide_numeric_rule(): void
+    {
+        $this->actingAs($this->admin());
+
+        Livewire::test(Index::class)
+            ->set('name', 'CPU high')
+            ->set('metric', 'cpu')
+            ->set('comparator', 'gt')
+            ->set('threshold', 90)
+            ->set('scopeType', 'all')
+            ->call('createRule')
+            ->assertHasNoErrors();
+
+        $this->assertDatabaseHas('alert_rules', ['name' => 'CPU high', 'metric' => 'cpu', 'threshold' => 90, 'scope_type' => 'all', 'enabled' => true]);
+        $this->assertDatabaseHas('audit_events', ['action' => 'alert.rule_create', 'target' => 'CPU high']);
+    }
+
+    public function test_group_scope_resolves_the_uuid_to_an_id(): void
+    {
+        $this->actingAs($this->admin());
+        $group = ServerGroup::create(['name' => 'prod', 'color' => 'online']);
+
+        Livewire::test(Index::class)
+            ->set('name', 'prod cpu')
+            ->set('metric', 'cpu')
+            ->set('scopeType', 'group')
+            ->set('scopeUuid', $group->uuid)
+            ->call('createRule')
+            ->assertHasNoErrors();
+
+        $this->assertDatabaseHas('alert_rules', ['name' => 'prod cpu', 'scope_type' => 'group', 'scope_id' => $group->id]);
+    }
+
+    public function test_offline_metric_stores_threshold_zero(): void
+    {
+        $this->actingAs($this->admin());
+
+        Livewire::test(Index::class)
+            ->set('name', 'down')
+            ->set('metric', 'offline')
+            ->set('threshold', 80)
+            ->set('scopeType', 'all')
+            ->call('createRule')
+            ->assertHasNoErrors();
+
+        $this->assertDatabaseHas('alert_rules', ['name' => 'down', 'metric' => 'offline', 'threshold' => 0]);
+    }
+
+    public function test_create_rejects_an_unknown_metric(): void
+    {
+        $this->actingAs($this->admin());
+
+        Livewire::test(Index::class)
+            ->set('name', 'x')
+            ->set('metric', 'temperature')
+            ->call('createRule')
+            ->assertHasErrors('metric');
+
+        $this->assertDatabaseCount('alert_rules', 0);
+    }
+
+    // ── toggle / delete ─────────────────────────────────────────────────────────
+
+    public function test_toggle_flips_enabled(): void
+    {
+        $this->actingAs($this->admin());
+        $rule = AlertRule::create(['name' => 'r', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+
+        Livewire::test(Index::class)->call('toggleRule', $rule->uuid);
+
+        $this->assertFalse($rule->fresh()->enabled);
+    }
+
+    public function test_admin_deletes_a_rule_via_a_confirmed_token(): void
+    {
+        $this->actingAs($this->admin());
+        $rule = AlertRule::create(['name' => 'gone', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+
+        $token = ConfirmToken::issue('alertRuleDeleted', ['uuid' => $rule->uuid], 'alert.rule_delete', $rule->name, null);
+        ConfirmToken::confirm($token);
+
+        Livewire::test(Index::class)->call('deleteRule', $token)->assertOk();
+
+        $this->assertDatabaseMissing('alert_rules', ['id' => $rule->id]);
+    }
+
+    // ── channels ────────────────────────────────────────────────────────────────
+
+    public function test_admin_saves_notification_channels(): void
+    {
+        $this->actingAs($this->admin());
+
+        Livewire::test(Index::class)
+            ->set('emailTo', "ops@example.com\n")
+            ->set('webhooks', 'https://8.8.8.8/x') // public IP literal — passes the SSRF host check
+            ->call('saveChannels');
+
+        $this->assertSame('ops@example.com', Setting::get('alert_email_to'));
+        $this->assertSame('https://8.8.8.8/x', Setting::get('alert_webhooks'));
+        $this->assertDatabaseHas('audit_events', ['action' => 'alert.channels_update']);
+    }
+
+    public function test_save_channels_rejects_an_unsafe_webhook_url(): void
+    {
+        $this->actingAs($this->admin());
+
+        Livewire::test(Index::class)
+            ->set('webhooks', 'http://169.254.169.254/latest/meta-data') // SSRF to cloud metadata
+            ->call('saveChannels')
+            ->assertHasErrors('webhooks');
+
+        $this->assertNull(Setting::get('alert_webhooks')); // not stored
+    }
+
+    // ── incidents render ────────────────────────────────────────────────────────
+
+    public function test_active_incidents_are_shown(): void
+    {
+        $this->actingAs($this->admin());
+        $rule = AlertRule::create(['name' => 'CPU high', 'metric' => 'cpu', 'comparator' => 'gt', 'threshold' => 80, 'scope_type' => 'all', 'enabled' => true]);
+        $server = Server::create(['name' => 'web1', 'ip' => '10.0.0.1', 'ssh_port' => 22, 'status' => 'online']);
+        AlertIncident::create(['alert_rule_id' => $rule->id, 'server_id' => $server->id, 'state' => 'firing', 'value' => 95, 'started_at' => now()]);
+
+        Livewire::test(Index::class)
+            ->assertSee('CPU high')
+            ->assertSee('web1');
+    }
+}