Notification

Timely and actionable notifications play an important role in application protection. Custom notifications also help you streamline the types of notifications you wish to receive and the frequency at which you would like to receive them. Some events also have severities associated with them, for example, high, medium, or low. You can choose the severity of events for which you wish to be notified. For example, you can decide to be notified only for high and medium-severity events. Navigate to Settings () → Configuration → Notifications page to create custom notifications. Creating a custom notification is a two-step process.

1. Create a channel

2. Create a notification rule

A notification is distributed through a channel.

Step 1 - Create a channel

A channel is a group of mediums or people to whom you want to notify when a type of event is triggered. You can send notifications to one or more than one of the following channels:

• Email addresses - A comma separated list of email addresses.

• Slack webhook - For information on creating a Slack webhook, see Sending messages using Incoming Webhooks.

• S3 webhook

• Splunk webhook - For information on Splunk webhook, see Splunk documentation.

• Syslog Server - For more information on Syslog server, see Syslog documentation.

• Custom webhook.

On the Settings () → Configuration → Notifications page, click on Create Channel button and ptrovide the details to configure a channel. You can later edit or delete the channel. Once you have created a channel, the next step is to create a notification rule.

Step 2 - Create a notification rule

A notification is sent through a channel for a category of events and event type. You can create notifications for different categories. In each category, there are either different threat types or event types. The notifications are created for a specific Environment or all the environments. Select the environment from the Environment drop-down list. After configuring all the notification rules, choose a channel from the list of channels you created earlier. You can change the channel to which you want to send the notification at any time. However, a notification can be sent to only one channel. Ultimately, decide the frequency of notifications from one notification every hour to one notification in 24-hours.

The following tables list the different category and their corresponding threat types or event types.

You can create notifications for any change made in the notifications configurations.

In addition, you can create notifications for data collection activity. This notification category helps you keep informed when an agent comes online or goes offline.

If you delete a channel that is associated with a notification rule, then you have to manually associate the notification to an already available channel or create a new channel to associate with the notification rule.