feat(adt): add custom alerts + editorial improvements

pages/audit-trail/concepts.mdx

@@ -3,48 +3,58 @@ title: Audit Trail - Concepts
 description: Learn fundamental concepts of Scaleway's Audit Trail.
 tags: audit-trail log events access
 dates:
-  validation: 2025-11-10
+  validation: 2026-10-20
 ---
 
 ## Audit Trail
 
 Audit Trail is a tool that holds a record of events and changes performed within a Scaleway Organization. Audit Trail allows you to keep track of all actions, whether successful, attempted, or failed, performed on your Scaleway resources.
 
-With Audit Trail you can view actions taken by any [principal](/iam/concepts/glossary/#principal) in any Project and on any of your Scaleway resources. You can also see the API methods used, the outcome of the action performed (status), and the IP address from which a principal performed an action.
+With Audit Trail, you can view actions taken by any [principal](/iam/concepts/glossary/#principal) in any Project and on any of your Scaleway resources. You can also see the API methods used, the outcome of the action performed (status), and the IP address from which a principal performed an action.
 
 Audit Trail allows you to view the metadata of the API method used, allowing you to investigate incidents and troubleshoot issues.
 
+## Custom alert
+
+A custom alert is an automated notification triggered when one or more Audit Trail events match a rule you define. When you create the rule, you can specify:
+
+- the type of event to monitor
+- the number of occurrences required to trigger the alert
+- the timeframe in which these occurrences are counted
+
 ## Event
 
-An event is a record of any activity related to your Scaleway resources, encompassing actions by users, applications, or Scaleway.
+An event is a record of any activity related to your Scaleway resources, spanning actions by users, applications, or Scaleway.
 
 ## Export
 
 Audit Trail exports allow you to upload your [event](#event) logs from the past 90 days to any [Object Storage](/object-storage/) bucket. By default, your event logs are exported to the `Standard` [storage class](/object-storage/concepts/#storage-class) or to the storage class you have selected upon bucket creation.
 
-This feature leverages Object Storage benefits which include:
+This feature leverages Object Storage benefits, which include:
 
 - Fine-grained access management with [bucket policies](/object-storage/api-cli/bucket-policy/)
 - Versioning of events for traceability and recovery
 - Lifecycle rules to automate data archiving or deletion
 - Flexible backup options through integration with third-party tools
 - Object lock to protect data from accidental deletion
 
-Once configured, your export runs automatically. Every day, the previous day’s Audit Trail events are exported to your chosen bucket. This provides a secure, durable, and centralized location for long-term retention, analysis, and compliance.
+Your export runs automatically after you configure it. Every day, the Audit Trail events of the previous day are exported to your chosen bucket. This provides a secure, durable, and centralized location for long-term retention, analysis, and compliance.
+
+An export includes all Audit Trail events by default, allowing only one active export configuration per region. 
+
+## Method
 
-  <Message type="note">
-    At this stage, an export includes all Audit Trail events by default, allowing only one active export configuration per region. Future updates will let you select specific events for export.
-  </Message>
+In the context of Audit Trail, a method is the API call sent to the Audit Trail API whenever a principal takes an action (whether successful, attempted, or failed) on any Scaleway resource.
 
 ## Prefix
 
-A prefix is a string of characters at the beginning of the [object key name](/object-storage/concepts/#object). They are often used to organize your data similarly to directories.
+A prefix is a string of characters at the beginning of an [object key name](/object-storage/concepts/#object). Prefixes are often used to organize your data in a way similar to directories.
 
 In the context of Scaleway Object Storage, prefixes are used to display folders in the Scaleway console for practical reasons. The `/` character in a prefix is used as a delimiter to allow you to organize your objects hierarchically.
 
-Your Audit Trail export's event logs are stored in your Object Storage according to the following structure: `prefix/YYYY/MM/DD/logs_xxxxxxxxx.json`.
+The event logs of your Audit Trail export are stored in your Object Storage according to the following structure: `prefix/YYYY/MM/DD/logs_xxxxxxxxx.json`.
 
-Below is an example of what your export might look like:
+Here is an example of what your export might look like:
 
 - `audit-trail-export/2025/09/15/logs_xxxxxxxxx.json`
 - `audit-trail-export/2025/10/20/logs_xxxxxxxxx.json`
@@ -54,20 +64,15 @@ Below is an example of what your export might look like:
 
 In the context of Audit Trail, a Project refers to the place where the Scaleway resources being monitored are located. They can be located in different Scaleway Projects, of different Scaleway Organizations.
 
-## Method
-
-A method in the context of Audit Trail is the API call sent to the Audit Trail API whenever a principal takes an action (whether successful, attempted, or failed) on any Scaleway resource.
-
 ## Region
 
-A region is the geographical area in which your resources are located (Paris, Amsterdam, Warsaw).
+A region is the geographical area in which your resources are located (e.g., Paris, Amsterdam, Warsaw).
 
-Audit Trail allows you to select and filter your resources by region and Scaleway Project. This allows you to better sort through your resources.
+Audit Trail allows you to select and filter your resources by region and Scaleway Project, making it easier to quickly sort through and locate your resources.
 
 ## Status
 
-A status is the API response returned whenever an action was taken on a resource by a principal. There are two statuses:
+A status is the API response returned whenever an action was taken on a resource by a principal. The following statuses are available:
 
 - `Successful`: the API request was executed.
-
 - `Forbidden`: permission to access the API was denied.

pages/audit-trail/faq.mdx

@@ -1,15 +1,15 @@
 ---
 title: Audit Trail FAQ
-description: Get answers on using Scaleway's Audit Trail to monitor events, enhance security, and track activities across your resources
+description: Get answers on using Scaleway Audit Trail to monitor events, enhance security, and track activities across your resources
 productIcon: AuditTrailProductIcon
 dates:
-  validation: 2026-07-30
+  validation: 2026-10-20
 ---
 
 ## Overview
 
 ### What is Audit Trail?
-Audit Trail is a tool that holds a record of events and changes performed within a Scaleway Organization.
+Audit Trail is a tool that records the events and changes that occur within a Scaleway Organization. It lets you track every action performed on your Scaleway resources, whether it succeeded, failed, or was only attempted.
 
 ### Why do I need Audit Trail?
 Audit Trail helps you ensure accountability and security by recording who did what and when within your Scaleway Organization. It tracks activity across all your resources (identity of the principal, date of activity, source IP address, API method used, and status of the request).
@@ -21,16 +21,19 @@ You can use Audit Trail for troubleshooting, compliance verification, and analys
 ### Where are my Audit Trail events stored?
 Audit Trail events are stored in the same region where the activity occurred. This means that if an event takes place in a specific region, it will be saved and accessible in that same region.
 
-Events from global products which are not region-specific, such as [IAM](/iam/), are stored in the Paris region.
-Find out more about product availability in see [Product availability by region](https://www.scaleway.com/en/product-availability-by-region/).
+Events from global products which are not region-specific, such as [IAM](/iam/), are stored in the Paris region. See [Product availability by region](https://www.scaleway.com/en/product-availability-by-region/) to find out more about product availability.
 
 ## Pricing and billing
 
 ### How am I billed for using Audit Trail?
-Audit Trail is free of charge.
+Audit Trail is free of charge, with the exception of alerts. 
+
+[Preconfigured alerts](/audit-trail/how-to/activate-adt-preconfigured-alerts) and [custom alerts](/audit-trail/how-to/configure-audit-trail-custom-alerts) are automated notifications that are triggered when one or more Audit Trail events satisfy a rule (predefined by Scaleway for preconfigured alerts, or by you for custom alerts). 
+
+Preconfigured alerts are only billed when you activate them, whereas custom alerts are billed even when they are disabled. In order no to be billed for a custom alert, you have to [delete the alert](/audit-trail/how-to/configure-audit-trail-custom-alerts/#delete-a-custom-alert).
 
 ### How am I billed for Audit Trail exports to an Object Storage bucket?
-Audit Trail exports are free of charge, but using Object Storage may incur additional charges. Refer to the [Object Storage FAQ](/object-storage/faq/#how-am-i-billed-for-object-storage) for more information on pricing.
+Audit Trail exports are free of charge, but using Object Storage may incur charges. See the [Object Storage FAQ](/object-storage/faq/#how-am-i-billed-for-object-storage) for more information on pricing.
 
 ## Compatibility and integration
 

pages/audit-trail/how-to/activate-adt-preconfigured-alerts.mdx

@@ -1,43 +1,42 @@
 ---
 title: How to activate Audit Trail preconfigured alerts
 description: Learn how to activate Audit Trail preconfigured alerts to monitor actions and get alerted about abnormal behavior
-tags: audit-trail alerts monitor
+tags: audit-trail preconfigured alerts monitor
 dates:
-  validation: 2026-06-12
+  validation: 2026-10-20
   posted: 2026-04-07
 ---
 
 import Requirements from '@macros/iam/requirements.mdx'
 
-Audit Trail Alerting Management allows you to proactively monitor the actions performed on your Scaleway resources. You can enable or disable a set of preconfigured alerts based on your security and monitoring needs, and Audit Trail will notify you of abnormal or sensitive behavior.
+Audit Trail Alerting Management allows you to proactively monitor the actions performed on your Scaleway resources. You can enable or disable a set of preconfigured alerts or [create custom alerts](/audit-trail/how-to/configure-audit-trail-custom-alerts/) based on your security and monitoring needs, and Audit Trail will notify you of abnormal or sensitive behavior. This page explains how to use preconfigured alerts.
 
 <Requirements />
 
 - A Scaleway account logged in to the [console](https://console.scaleway.com)
 - [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to view and manage Audit Trail
 
-  <Message type="note">
-    Global events (such as IAM, Account, or Edge Services activities) are considered FR-PAR (Paris) events.
-  </Message>
-
+<Message type="note">
+  Events related to global products which are not region-specific (such as IAM, Account, or Edge Services activities) are considered FR-PAR (Paris) events.
+</Message>
 
 ## Enable or disable preconfigured alerts
 
 1. Click **Audit Trail** in the **Monitoring** section of the [Scaleway console](https://console.scaleway.com/) side menu.
-2. Click the **Region** drop-down and select a region for which you want to manage alerts.
+2. Click the **Region** dropdown and select a region for which you want to manage alerts.
 3. Click the **Alerts** tab. A list of preconfigured alerts appears.
 4. Toggle specific alerts to control which behaviors should trigger a notification.
     1. Locate the alert you wish to enable/disable.
         - **Alert name**: The technical identifier of the alert (e.g., ApiKeyCreated).
         - **Rule description**: A brief explanation of what activity triggers the alert.
-    2. Check or uncheck the box in the **Active** column:
+    2. In the **Active** column, check or uncheck the box:
         - **Checked**: The alert is active and will trigger notifications.
         - **Unchecked**: The alert is disabled.
-5. Click **Save changes** at the bottom of the page to apply your configuration. A pop-up window displays, confirming the action you are about to take. Click **Save changes** again.
+5. At the bottom of the page, click **Save changes** to apply your configuration. A confirmation dialog box appears. Click **Save changes** again.
 
 ### Understand preconfigured alerts
 
-The **Alerts** tab in the console displays a rule description for each alert, helping you to interpret the behavior of an alert. The table below provides a non-exhaustive list of a few examples.
+The **Alerts** tab > **Preconfigured** setting in the console displays a rule description for each alert, helping you to interpret the behavior of an alert. The following table provides a non-exhaustive list of a few examples.
 
 | Alert  | Description |
 |---|---|
@@ -67,6 +66,7 @@ Email notifications contain:
 - recommended actions to help you with investigation and mitigation steps
 - a link to check the Audit Trail page in the console with filters helping you to see what happened around the affected timeframe
 
-## Related documents
+## Related documentation
 
-- Learn more about [how to view your Audit Trail events](/audit-trail/how-to/use-audit-trail/).
+- Learn more about [how to view your Audit Trail events](/audit-trail/how-to/use-audit-trail/).
+- Learn [how to configure custom alerts](configure-audit-trail-custom-alerts).