Notifications

Notification rules pair events with targets. Configure them through the tenant's integration settings or GET/PUT /admin/integrations/notifications.

Event filters

Filters vary by event type. Supported fields include repository selection, minimum severity/priority, CWE IDs, CVE IDs, secret types, cloud providers, and supply-chain finding types. Use the schema for the selected event instead of sending every filter to every event. Narrow filters can intentionally suppress delivery while findings remain visible in the dashboard.

Destinations

The generic target model has Slack channels, email addresses, and webhook URLs, with singular and plural forms supported by the corresponding schema. Microsoft Teams conversations use the Teams integration; a Teams destination is not an extra teams property in the generic notification-target object.

centralSecurityChannel is a fallback destination for action items without a resolved owner. Configure it deliberately and ensure the integration can post there. Confirm user identity mappings before relying on direct messages.

Delivery controls

Manager escalation delivery can enforce weekly channel/DM budgets, content deduplication, and digest grouping. Critical-severity bypass rules apply where configured. Failed channel delivery can fall back to a recovery DM when a suitable recipient is available. These controls mean a finding event and a delivered message are not always one-to-one.

Ground rules can independently disable channel or direct messages. See Manager Configuration, Slack delivery, and Microsoft Teams. Investigate the finding's activity and delivery state before recreating a ticket or re-running a scan to force a notification.