Monitor security automation with four signals: a heartbeat showing it ran, queue depth showing it is keeping up, failure counts showing errors, and an expected volume check showing it is still receiving events. Silence is the dangerous case, because a broken integration and a quiet week look identical.
The signals
| Signal | What it catches | Example alert |
|---|---|---|
| Heartbeat | Job stopped or scheduler broke | No successful run in 2 hours |
| Queue depth | Worker too slow or stuck | Backlog above a set size for 15 minutes |
| Failure rate | Expired token, API errors | More than a few failures in an hour |
| Event volume | Webhook stopped or filter changed | Zero events in a window that normally has several |
| Latency | Slow receivers | Time from event to ticket above a limit |
Heartbeats, step by step
- Have each scheduled job write a "last success" timestamp to a store at the end of a run.
- A separate checker reads the timestamp on its own schedule.
- If the value is older than your threshold, alert a human.
- Make the checker independent of the thing it checks, so one failure cannot silence both.
Why a volume check matters
Webhook senders can stop delivering. For example, Atlassian documents that dynamic webhooks expire 30 days after creation or refresh, and that a receiver that fails for 30 minutes is limited to one attempt per webhook until a delivery succeeds. Receivers that never hear anything may never notice. A rule such as "no events for six hours on a weekday" catches this. Back it with a reconciliation poll, as described in webhook or polling.
Have a dead letter queue
Events that fail after several tries should land in a separate queue with the error, not disappear. Review it daily at first. Each entry is a bug or a data gap.
Write a short runbook
For each alert, say what it means, how to check, and how to fix the usual cause. A runbook of five lines is better than none. Include the kill switch from testing security automation.
Track automation as an asset
List each automation, its owner, its token and its alerts. An automation with no owner is an incident waiting for a date.
Quick check
How do I know if a webhook sender stopped sending?
Alert when no events arrive in a window that is normally busy, and run a periodic poll to catch anything missed.
What is a dead letter queue?
A holding queue for events that failed after retries, so they can be inspected and replayed instead of lost.
Safeguard includes continuous scanning and asset discovery, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- Atlassian, Jira Cloud webhooks
Last reviewed: 19 October 2026.
