Platform Notifications

Notification Configuration

This is the main list of notification rules.

What each column means

Column Meaning
Trigger The event that causes the alert (for example DETECTION_CREATED)
Created At When the rule was created
Channel How the alert is sent (email, sms, or webhook)
Template Id Which template is used to build the message
Org Which organisation the rule applies to (org:default means the whole organisation)
Participants Who receives the alert. [] usually means all users in the org; - means no specific recipient list is set

What the actions do

  • View — open the rule details to inspect the trigger, template, channel, and recipients
  • Delete — remove the rule so that alert no longer sends

How to identify a bad notification rule

If a notification is wrong, look for a rule that matches the alert:

  1. Match the alert text to a template or template ID.
  2. Check the trigger in that rule.
  3. Confirm the channel is correct for how the message was delivered.
  4. Confirm the recipients are the intended users or groups.
  5. Remove or update the rule if it is too broad or not needed.

Common trigger examples

Trigger Meaning
DETECTION_CREATED A new detection was created
DETECTION_RESOLVE A detection was resolved or closed
DETECTION_INTELLIGENT_CLASSIFICATION_COMPLETED AI finished classifying a detection
ASSET_CREATE A new asset was added
RELEVANT_ADVISORY A new advisory was published for your org
WEEKLY_SUMMARY A scheduled weekly digest
SEND_WEEKLY A scheduled weekly send
HUNTO_SIGNUP A new user signed up

Table of Contents

  1. Getting Started
  2. Prerequisites
  3. Step-by-Step Notification Setup
  4. Configuration Examples
  5. Testing and Validation
  6. Troubleshooting Guide

Getting Started

How to Access the Notification Configuration

Direct URL Access:

  • Navigate to: /dev/manage/notification 
  • Click on the Configuration tab

Alternative Navigation:

  1. Go to System Admin in the main menu
  2. Click on Control Panel
  3. Select Manage Notification
  4. Click on Configuration tab

Main Interface Features

  • Configuration Tab: Manage notification settings and triggers
  • Add Notifications: Create new notification configurations

Prerequisites

Before Setting Up Notifications

  1. Template Creation Required
    • You must have created at least one email template first
    • Templates define the content and format of your notifications
    • Refer to the "Template Creation Guide" for detailed instructions
  2. Channel Requirements
    • Channel: Must be set to email (required)
    • Email Configuration: Must be set to smtp (required)
    • Other channels (SMS, webhook) may not be fully functional
  3. System Access
    • System Admin privileges required for notification configuration
    • Access to audit logs to understand available trigger data /dev/manage/auditlog

Step-by-Step Notification Setup

Step 1: Prepare Your Template

Before configuring notifications, ensure you have:

  • Created and tested your email template
  • Verified all variables render correctly
  • Confirmed the template is saved and available

Step 2: Start Notification Configuration

  1. Navigate to /dev/manage/notification
  2. Click on the Configuration tab
  3. Click the "Add Notifications" button

Step 3: Fill in Basic Information

Required Fields:

Trigger: Select the system event that will activate this notification

  • Available options include:
    • "EXECUTE_SCHEDULE" - For scheduled task completions
    • "CUSTOM_CHECKPOINT" - For checkpoint events
    • Action from your audit logs
  • Choose the trigger that matches when you want notifications sent

Permission: Leave blank for now

  • This field will be improved in future updates
  • Skip this field during configuration

Description: Brief description of what this notification does

  • Example: "Alerts security team when threats are detected"
  • Example: "Notifies administrators of daily backup completion"
  • Keep it clear and concise for future reference

Optional Basic Fields:

Organization: Select organization (default: "org:default")

  • Choose the organization this notification belongs to
  • Use "org:default" for system-wide notifications

Subheading: Optional subheading for the notification

  • Additional context or categorization
  • Example: "Security Alerts", "System Maintenance"

Main Heading: Primary heading for the notification

  • This may be used in notification displays
  • Example: "Threat Detection Alert", "Backup Status Report"

Notification Type: Type category for the notification

  • Helps organize and filter notifications
  • Example: "Security", "System", "Maintenance"

Step 4: Configure Channel Settings

Required Channel Configuration:

Channel: Must be set to email

  • This is the only fully supported delivery method
  • SMS and webhook options may exist but are not recommended

Email: Must be set to smtp

  • Uses the system's SMTP configuration
  • Ensures reliable email delivery

Important Channel Notes:

  • Do not change these settings unless specifically instructed
  • Email/SMTP is the primary supported delivery method
  • Other options may cause notification failures

Step 5: Select Template

Template: Choose from your previously created templates

  • Select the appropriate template for this notification type
  • Ensure the template variables match the trigger data
  • Templates must be created before they appear in this list

Step 6: Configure Recipients

Select any user, group, team or all users of the org.

Step 7: Save and Activate

  1. Review all configuration settings
  2. Click Save to create the notification
  3. The notification will be active immediately
  4. Test the configuration with a sample event if possible

Configuration Examples

Example 1: Daily Backup Notification

Use Case: Notify IT administrators when daily backups complete

Configuration:

  • Trigger: "EXECUTE_SCHEDULE"
  • Permission: Leave blank (not implemented yet)
  • Description: "Daily backup completion notification for IT team"
  • Organization: "org:default"
  • Main Heading: "Daily Backup Report"
  • Notification Type: "System Maintenance"
  • Channel: email
  • Email: smtp
  • Template: "Daily Backup Report" (previously created)
  • Recipients: Select any user, group, team or all users of the org.

Example 2: Security Threat Detection

Use Case: Alert security team when new threats are classified

Configuration:

  • Trigger: Event-based (from detection system)
  • Permission: Leave blank (not implemented yet)
  • Description: "Immediate security threat detection alerts"
  • Organization: "org:tikaj"
  • Main Heading: "Security Threat Detection"
  • Notification Type: "Security Alert"
  • Channel: email
  • Email: smtp
  • Template: "Detection Classification Alert" (previously created)
  • Recipients: Select any user, group, team or all users of the org.

Example 3: Checkpoint Progress Updates

Use Case: Keep stakeholders informed of long-running process progress

Configuration:

  • Trigger: "CUSTOM_CHECKPOINT"
  • Permission: Leave blank (not implemented yet)
  • Description: "Progress updates for long-running system processes"
  • Organization: "org:default"
  • Main Heading: "Process Progress Update"
  • Notification Type: "Progress Report"
  • Channel: email
  • Email: smtp
  • Template: "Checkpoint Progress Update" (previously created)
  • Recipients: Select any user, group, team or all users of the org.

Testing and Validation

Pre-Deployment Testing

  1. Configuration Review
    • Verify trigger matches expected system events
    • Confirm template is appropriate for the trigger data
    • Check recipient list is accurate and complete
  2. Template-Trigger Alignment
    • Ensure template variables match trigger data
    • Verify conditional sections work with actual data
    • Test with real audit log data when possible
  3. Test Notifications
    • Configure a test notification to your own email
    • Trigger a test event if possible
    • Verify email delivery and formatting

Validation Checklist

  • Trigger correctly identifies target events
  • Template variables align with trigger data
  • Recipients receive notifications successfully
  • Email formatting appears correctly
  • Subject line is meaningful and dynamic
  • No broken variables or missing data
  • Notification frequency is appropriate

Monitoring After Deployment

  1. Check Notification Reports
    • Go to the Report tab regularly
    • Monitor delivery success rates
    • Look for failed deliveries or errors
  2. Recipient Feedback
    • Confirm recipients are receiving notifications
    • Verify content is useful and actionable
    • Adjust configuration based on feedback
  3. System Performance
    • Monitor for notification delays
    • Check if triggers are firing correctly
    • Verify system resources are adequate

Troubleshooting Guide

Common Configuration Issues

Notifications Not Triggering

Problem: Notifications are configured but not being sent

Solutions:

  • Verify trigger name exactly matches system events in audit logs
  • Check that the triggering system events are actually occurring
  • Confirm notification is saved and active
  • Review system logs for trigger errors

Wrong Recipients Receiving Notifications

Problem: Notifications going to incorrect recipients

Solutions:

  • Review recipient configuration (All Users vs Specific Users vs Custom List)
  • Verify organization selection matches intended scope
  • Check if users have changed roles or permissions
  • Update recipient lists as team members change

Template Variables Not Rendering

Problem: Email content shows {{variable}} instead of actual values

Solutions:

  • Verify trigger provides the expected data structure
  • Check variable names match exactly with audit log data
  • Ensure template and notification are using compatible triggers
  • Review audit logs to confirm data availability

Email Delivery Failures

Problem: Notifications configured correctly but emails not delivered

Solutions:

  • Verify SMTP settings are configured in the system
  • Check recipient email addresses are valid and active
  • Confirm email addresses aren't being blocked by spam filters
  • Test with internal email addresses first

Template Not Available in Dropdown

Problem: Cannot select the desired template when configuring notification

Solutions:

  • Confirm template is saved successfully
  • Verify template type is set to "Communication Template"
  • Check that template is not marked as "Report Template"
  • Refresh the page and try again

Getting Additional Help

  1. System Logs: Check application logs for detailed error messages
  2. Audit Logs: Review to understand available trigger data
  3. Test Incrementally: Start with simple configurations and add complexity
  4. Document Working Configurations: Keep records of successful setups for replication