Alerting

Path: /settings/alerting

Set notification destinations and rules.
A rule fires when an attribution report meets your severity and confidence thresholds.

An admin can change this page.
Other roles see View only.

Rules fire on attribution reports.

Do this after you add Configurations. See the 15-minute quickstart.

Notification destinations first, then Alert rules. Type, endpoint, enabled, thresholds.

Add a destination

1. Open /settings/alerting.
2. Under Notification destinations, select Add.
3. Select Type.
4. Enter Label if you need a name. Label is required when type is Other.
5. Enter Endpoint. The URL must start with http:// or https://.
6. Leave Enabled on, or turn it off to save without delivery.
7. Select Save.

Destinations

Add a destination first.

Field	Meaning
Type	Discord, Microsoft Teams, Google Chat, SIEM, CTI, or Other
Label	Optional. Required when type is Other
Endpoint	URL that starts with http:// or https://
Enabled	Turn the destination on or off

Do not put secrets in the label.
Use the webhook URL that your destination gives you.

If you remove a destination, rules that only pointed at that destination lose it. Fix those rules.

Add a rule

1. Add at least one enabled destination.
2. Under Alert rules, select Add.
3. Enter Name. Name is required.
4. Select at least one destination.
5. Set Minimum severity. Default is High.
6. Set Minimum confidence. Default is 80%.
7. Leave Enabled on.
8. Select Save.

If you have no destinations, add one before you add a rule.

Rules

Each rule needs:

Field	Meaning
Name	Required
Enabled	Turn the rule on or off
Destinations	At least one enabled destination
Minimum severity	Low, Medium, High, or Critical
Minimum confidence	50% to 100%

Default values for a new rule are High severity and 80% confidence.

A report must meet both thresholds before the rule sends a notification.
The payload does not include the raw secret value.

Webhook body

Non-Discord destinations receive JSON:

{
  "event_type": "attribution_report_alert",
  "rule_name": "high-confidence-reports",
  "severity_label": "High",
  "severity_numeric": 3,
  "confidence": 80,
  "title": "Example report title",
  "repo_link": "https://example.com/repo",
  "report_id": 123,
  "timestamp": "2026-08-25T16:00:00+00:00"
}

Discord destinations receive an embed with the same facts.
The product sends one POST. HTTP status below 400 is success. There is no retry button on this page.

Types are labels on a webhook URL: Discord, Microsoft Teams, Google Chat, SIEM, CTI, or Other.
The dashboard does not open those products for you. Paste the URL they give you.

If delivery fails, see Troubleshooting.

Suggested first rule

1. Add one destination that your SOC already reads.
2. Add a rule named high-confidence-reports.
3. Set minimum severity to High.
4. Set minimum confidence to 80%.
5. Enable the rule.