# Alarms

> See the security alarms that QuickDesk devices report, and send them to your webhooks.

A QuickDesk device reports a security alarm when it detects a risky event.
You can see alarms in the console. You can also receive them as webhook
events.

## Alarm types

| Alarm | Meaning |
| --- | --- |
| IP not in the allow list | A connection came from an IP address that is not in the allow list. |
| More than 30 failed password attempts | The device counted more than 30 failed password attempts. |
| 6 failed attempts within one minute | Someone failed the password 6 times in one minute. |
| Too many attempts from one IPv6 prefix | Many failed attempts came from one IPv6 prefix. |
| Terminal OS login back-off | The terminal OS login slowed down after failed attempts. |
| Terminal OS login concurrency limit | Too many terminal OS logins ran at the same time. |
| Session scope violation | A session tried to do something outside its scope. |
| Device ID not in the allow list | A connection used a device ID that is not in the allow list. |

## See alarms in the console

Open the **Sessions** screen. Find the **Alarms** card.

The card shows these columns:

- Time
- Device
- Alarm
- Source IP
- Peer ID
- Name

You can search the list. You can also export it as CSV.

## Receive alarms as webhooks

Each alarm also goes to the webhooks of the organization. The event type is
`quickdesk.alarm.raised`. The `data` object has these fields:

| Field | Meaning |
| --- | --- |
| `device_id` | The device that reported the alarm. |
| `alarm` | The alarm type. |
| `ip` | The source IP address. |
| `peer_id` | The ID of the peer. |
| `name` | The name of the peer. |

To receive the event, subscribe to it on the **Webhooks** screen. For the
event catalogue, signing, and retries, read [QuickDesk webhooks](/modalities/quickdesk/webhooks).

## Who can report an alarm

The server accepts an alarm only from the device itself. The device ID and
the private device UUID of the device must match. The server rejects all
other alarm reports.

## Related

- [QuickDesk webhooks](/modalities/quickdesk/webhooks) — events and handlers
- [Security & audit](/modalities/quickdesk/security) — the audit trail
- [Audit log](/modalities/quickdesk/audit-log) — session and file records