{
  "schemaVersion": "notify.rule@1",
  "ruleId": "rule-airgap-ops",
  "tenantId": "bootstrap",
  "name": "Air-gap operations alerts",
  "description": "Send time-drift, bundle import, and portable export notifications with remediation steps.",
  "enabled": true,
  "match": {
    "eventKinds": [
      "airgap.time.drift",
      "airgap.bundle.import",
      "airgap.portable.export.completed"
    ],
    "minSeverity": "medium",
    "labels": [],
    "namespaces": [],
    "repositories": [],
    "digests": [],
    "componentPurls": [],
    "verdicts": [],
    "kevOnly": false,
    "vex": {
      "includeAcceptedJustifications": true,
      "includeRejectedJustifications": true,
      "includeUnknownJustifications": true,
      "justificationKinds": []
    }
  },
  "actions": [
    {
      "actionId": "email-airgap-ops",
      "channel": "email:airgap-ops",
      "template": "airgap-ops",
      "enabled": true,
      "metadata": {
        "locale": "en-us"
      }
    }
  ],
  "labels": {
    "category": "airgap"
  },
  "metadata": {
    "source": "bootstrap-pack"
  },
  "createdBy": "bootstrap-pack",
  "createdAt": "2025-11-03T08:00:00Z",
  "updatedBy": "bootstrap-pack",
  "updatedAt": "2025-11-03T08:00:00Z"
}