> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/configuration/configuration-notifications.md).

# Notifications

Notification rules pair **events** with **targets**. Configure them through the tenant's integration settings or `GET`/`PUT /admin/integrations/notifications`.

## Event filters

Filters vary by event type. Supported fields include repository selection, minimum severity/priority, CWE IDs, CVE IDs, secret types, cloud providers, and supply-chain finding types. Use the schema for the selected event instead of sending every filter to every event. Narrow filters can intentionally suppress delivery while findings remain visible in the dashboard.

## Destinations

The generic target model has Slack channels, email addresses, and webhook URLs, with singular and plural forms supported by the corresponding schema. Microsoft Teams conversations use the Teams integration; a Teams destination is not an extra `teams` property in the generic notification-target object.

`centralSecurityChannel` is a fallback destination for action items without a resolved owner. Configure it deliberately and ensure the integration can post there. Confirm user identity mappings before relying on direct messages.

## Delivery controls

Manager escalation delivery can enforce weekly channel/DM budgets, content deduplication, and digest grouping. Critical-severity bypass rules apply where configured. Failed channel delivery can fall back to a recovery DM when a suitable recipient is available. These controls mean a finding event and a delivered message are not always one-to-one.

Ground rules can independently disable channel or direct messages. See [Manager Configuration](/configuration/configuration-manager.md), [Slack delivery](/connectors/slack/slack-notifications.md), and [Microsoft Teams](/connectors/microsoft-teams.md). Investigate the finding's activity and delivery state before recreating a ticket or re-running a scan to force a notification.