# Foxhunt Security Monitoring Configuration
alerts:
  authentication_failures:
    threshold: 5
    window: 300  # 5 minutes
    action: block_ip
    
  trading_anomalies:
    threshold: 3_sigma
    window: 60  # 1 minute
    action: alert_risk_team
    
  data_exfiltration:
    threshold: unusual_transfer
    window: 300  # 5 minutes
    action: quarantine_system
    
  api_abuse:
    threshold: rate_limit_exceeded
    window: 60  # 1 minute
    action: temporary_suspension

notifications:
  slack_webhook: "${SLACK_SECURITY_WEBHOOK}"
  email_alerts: "security@foxhunt.com"
  sms_alerts: "+1-XXX-XXX-XXXX"
  
escalation:
  level_1: 5    # 5 minutes
  level_2: 15   # 15 minutes
  level_3: 60   # 1 hour