The Alerts page is where Spikerz tells you what it has detected on your connected social media accounts.

Spikerz monitors your accounts around the clock - credentials and recovery details, admin access and roles, login activity, impersonators, malicious comments and DMs, bots and fake followers, community-guideline risks, and leaked data on the dark web. Whenever something notable is found, it becomes an alert.

Each alert answers four questions: what happened, which asset it affects, when it happened, and what you can do about it. From the alert itself you can jump straight to the settings or permissions page where the issue can be fixed.

This guide explains how to read the alert feed, how to narrow it down with search and filters, what the Security alerts cover, and how to move between the alerts of a single account and the alerts of all your assets at once.

Spikerz shows alerts at two levels, and both use the same feed, search, and filter controls.

When you select a specific asset - for example your Instagram profile or a Facebook page - the Alerts page shows only the alerts raised for that account.

Use this view when you are investigating one account: everything on screen belongs to it, so the feed reads as a clean timeline of that account's security history.

Switch to aggregation mode to see the alerts of every connected account consolidated into a single feed, regardless of platform or brand.

In this view each alert card carries an asset chip - the platform icon plus the account name - so you can always tell which account an alert came from without leaving the list. Selecting an alert still takes you to the right place on the right asset.

Aggregation mode is the practical starting point for a security team managing several profiles or brands: you triage everything from one screen, then drill into an individual account only when an alert needs deeper investigation. For everything else aggregation mode brings together, see the Spikerz Aggregation Mode Guide.

Alerts are listed newest first, so the most recent detection is always at the top. Every alert is presented as a card containing:

A Select all checkbox above the feed selects every alert currently loaded in the list, and shows the number selected in brackets. Combine it with a filter first when you want to act on one specific group of alerts.

Three tabs sit above the feed, each with a counter so you can see the size of your queue before opening it:

The tabs change what the feed shows, and search and filters apply to whichever tab you are on.

Use the Search bar at the top of the page to find alerts with free text. Search is case-insensitive and matches the content of the alert - its title and its description, including the names, page names, and roles highlighted inside it.

A few examples:

Results update as you type, and you can clear the search from the field to return to the full list.

Select the Filter button next to the search bar to narrow the feed. Filters can be combined with each other and with search, which is what makes a long queue manageable - for example, filtering to a single platform and a single week, then searching for a person's name.

Alerts can be filtered by parameters including:

The Filter button reflects how many filters are currently active, and the filters can be cleared to return to the default view at any time.

Tip: filters and search stack. Opening the Security tab, filtering to one platform, and searching for an employee's name is the fastest way to answer a question like "what access changes has this person been involved in on our Instagram accounts this month?"

The Display button at the top right of the page controls how the alert feed itself is presented, letting you adjust the view to suit the way you work - a compact list for fast scanning of a large queue, or a fuller layout when you want more context on each alert without opening it.

Display settings only change your own view of the feed. They never change which alerts exist, their status, or what anyone else sees.

Security alerts are raised when something happens that could affect who can reach your accounts, or how they can be recovered. These are the alerts that matter most in an incident, because they are the signals that usually precede an account takeover.

They fall into a few recognizable groups.

Changes to the details used to log in to an account, or to recover it:

Recovery details deserve particular attention. An attacker who adds their own phone number or authenticator, or removes yours, can keep access to an account even after the password is reset - so a change you do not recognize here should be treated as urgent.

Changes to who can administer your pages and assets, and at what level:

Together these alerts give you a running record of your admin surface, which is exactly what an access review needs: who was added, who was elevated, and when.

Some alerts report an action Spikerz has already taken on your behalf, rather than something you need to fix. For example, Permissions for unknown user ... were removed via Spikerz tells you that Spikerz detected an unrecognized user holding permissions on one of your assets and removed that access automatically.

These alerts are still worth reading. They confirm the protection is working, and they tell you that someone unexpected had access in the first place - which is usually worth understanding.

Note: the same activity is also written to the Activity Log, alongside user and system events, when you need the full chronological picture of a workspace rather than the alert queue.

Each alert card offers a direct route from detection to action:

Resolving an alert is a record that a human reviewed it, so it is worth resolving deliberately: check the alert, confirm the change was expected, and only then mark it as resolved. Anything you cannot account for should stay open until it is investigated.

To clear several alerts at once, select them with the checkboxes - or use Select all after filtering - and resolve them together.

A short, repeatable review keeps the queue under control:

If an alert points to access or recovery details you do not recognize, treat it as a live incident: remove the unknown access, reset the credentials, and re-check the account's recovery details before resolving the alert.