> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extractor.live/llms.txt
> Use this file to discover all available pages before exploring further.

# Common Configurations

> Shared configuration options available across all Hacken Extractor detectors and triggers — name, severity, alerts, cron, networks, and notifications.

## Severity

Every alert is assigned a severity level, either set manually or determined automatically by the detector.

| Level      | Meaning                                                                                                   |
| ---------- | --------------------------------------------------------------------------------------------------------- |
| `CRITICAL` | Immediate reaction required — treat as an active incident                                                 |
| `HIGH`     | Dangerous event that needs prompt attention and resolution                                                |
| `MEDIUM`   | Important or suspicious event worth investigating                                                         |
| `LOW`      | Informational event that may provide useful insights or metrics                                           |
| `INFO`     | Progress or state notification only                                                                       |
| `Auto`     | Detector chooses severity based on its own logic; overriding this forces all alerts to the selected level |

<Info>
  When a detector is set to **Auto**, it may emit alerts at different severity levels depending on conditions. Overriding forces a fixed level across all alerts from that detector.
</Info>

***

## Cron Schedule

Controls how frequently a detector evaluates. Three formats are accepted:

<Tabs>
  <Tab title="Human readable">
    Plain-language intervals — easiest to read and configure.

    ```
    10 min
    1 day
    2 hours
    30 seconds
    ```
  </Tab>

  <Tab title="Quartz cron">
    Full [Quartz cron](https://www.quartz-scheduler.org/documentation/quartz-2.3.0/tutorials/crontrigger.html) expression syntax for precise scheduling.

    ```
    0 0 12 * * ?       every day at noon
    0 0/5 * * * ?      every 5 minutes
    0 0 0 ? * MON-FRI  weekdays at midnight
    ```
  </Tab>

  <Tab title="Milliseconds">
    Raw millisecond interval — useful for programmatic configuration via the API.

    ```
    60000     1 minute
    3600000   1 hour
    86400000  1 day
    ```
  </Tab>
</Tabs>

***

## Condition (Threshold)

Conditions control when a detector fires based on a numeric value. The syntax supports basic comparisons, percentage changes, delta operations, and edge-detection operators.

<AccordionGroup>
  <Accordion title="Basic comparison" icon="equals">
    Standard numeric comparison against a fixed value.

    ```
    = 100     fires when value equals 100
    != 100    fires when value does not equal 100
    > 50      fires when |value| > 50
    < 25      fires when |value| < 25
    >= 35     fires when |value| >= 35
    <= 50     fires when |value| <= 50
    ```

    <Tip>Operators `>`, `<`, `>=`, `<=` apply **absolute value handling** by default. Prefix with `+` or `-` to compare exact signed values instead.</Tip>
  </Accordion>

  <Accordion title="Explicit sign (no absolute value)" icon="plus-minus">
    Prefix the threshold with `+` or `-` to skip absolute value handling and compare the exact signed value.

    ```
    > +10     fires when value > 10 (exact, positive only)
    > -15     fires when value > -15
    < +30     fires when value < 30
    < -20     fires when value < -20
    ```
  </Accordion>

  <Accordion title="Percentage change" icon="percent">
    Fires based on the percentage change from the previous value. Formula: `(v - v₀) / v₀ × 100`.

    ```
    > 25%     change > 25%
    < 10%     change < 10%
    >= 50%    change >= 50%
    = 100%    exact 100% change
    ```

    **Example:** if `v₀ = 1000` and `v = 700`, the change is `-30%`.
  </Accordion>

  <Accordion title="Delta (absolute change)" icon="arrow-up-arrow-down">
    Fires based on the absolute change from the previous value using `++` (increase) or `--` (decrease).

    ```
    > ++100    increase greater than 100
    < --50     decrease greater than 50
    >= ++30    increase of at least 30
    = ++20     increase of exactly 20
    ```
  </Accordion>

  <Accordion title="Once operators (edge detection)" icon="arrow-right-to-bracket">
    `>>` and `<<` variants fire **only once** when a condition transitions from false to true. Subsequent evaluations return false even if the condition remains true — useful for detecting threshold crossings without repeated alerts.

    ```
    >> 10     fires once when value crosses above 10
    << 25     fires once when value crosses below 25
    >>= 10    fires once when value reaches or exceeds 10
    <<= 25    fires once when value reaches or falls below 25
    >> ++100  fires once when increase crosses 100
    >> 25%    fires once when percentage change crosses 25%
    ```
  </Accordion>

  <Accordion title="Max/Min operators" icon="chart-line">
    `>>>` and `<<<` variants fire only when a **new all-time maximum or minimum** is reached above/below the threshold.

    ```
    >>> 100    new maximum above 100
    <<< 50     new minimum below 50
    >>>= 100   new maximum at or above 100
    <<<= 50    new minimum at or below 50
    ```

    **Example for `>>> 100`:**

    | Value | Fires? | Reason                                 |
    | ----- | ------ | -------------------------------------- |
    | 90    | No     | Below threshold                        |
    | 200   | Yes    | First value exceeding 100              |
    | 150   | No     | Above 100 but below previous max (200) |
    | 300   | Yes    | New maximum                            |
    | 200   | No     | Below current max (300)                |
  </Accordion>
</AccordionGroup>

<Info>
  Spaces in condition expressions are ignored — `> ++ 100` and `>++100` are equivalent.
</Info>
