Alerting

Path: /settings/alerting

Set notification destinations and rules.
A rule fires when an attribution report meets your severity and confidence thresholds.

An admin can change this page.
Other roles see View only.

Do this after you add Configurations. See the 15-minute quickstart.

Notification destinations first, then Alert rules. Type, endpoint, enabled, thresholds.

Add a destination

1. Open /settings/alerting.
2. Under Notification destinations, select Add.
3. Select Type.
4. Enter Label if you need a name. Label is required when type is Other.
5. Enter Endpoint. The URL must start with http:// or https://.
6. Leave Enabled on, or turn it off to save without delivery.
7. Select Save.

Destinations

Add a destination first.

Field	Meaning
Type	Discord, Microsoft Teams, Google Chat, SIEM, CTI, or Other
Label	Optional. Required when type is Other
Endpoint	URL that starts with http:// or https://
Enabled	Turn the destination on or off

Leave secrets out of the label.
Paste the webhook URL that the destination gives you.

If you remove a destination, update each rule that used that destination.

Add a rule

1. Add at least one enabled destination.
2. Under Alert rules, select Add.
3. Enter Name. Name is required.
4. Select at least one destination.
5. Set Minimum severity. Default is High.
6. Set Minimum confidence. Default is 80%.
7. Leave Enabled on.
8. Select Save.

If you have no destinations, add one before you add a rule.

Rules

Each rule needs:

Field	Meaning
Name	Required
Enabled	Turn the rule on or off
Destinations	At least one enabled destination
Minimum severity	Low, Medium, High, or Critical
Minimum confidence	50% to 100%

Default values for a new rule are High severity and 80% confidence.

A report must meet both thresholds before the rule sends a notification.
The payload omits the secret value.

Webhook body

Destinations other than Discord receive JSON:

{
  "event_type": "attribution_report_alert",
  "rule_name": "high-confidence-reports",
  "severity_label": "High",
  "severity_numeric": 3,
  "confidence": 80,
  "title": "Example report title",
  "repo_link": "https://example.com/repo",
  "report_id": 123,
  "timestamp": "2026-08-25T16:00:00+00:00"
}

Discord destinations receive an embed with the same facts.
The product sends one POST. HTTP status below 400 is success.

Type is a label on a webhook URL: Discord, Microsoft Teams, Google Chat, SIEM, CTI, or Other.

If delivery fails, see Troubleshooting.

Suggested first rule

1. Add one destination that your team already reads.
2. Add a rule named high-confidence-reports.
3. Set minimum severity to High.
4. Set minimum confidence to 80%.
5. Enable the rule.