Notification

Timely and actionable notifications play an important role in application protection. Custom notifications also help you streamline the types of notifications you wish to receive and the frequency at which you would like to receive them. Some events also have severities associated with them, for example, high, medium, or low. You can choose the severity of events for which you wish to be notified. For example, you can decide to be notified only for high and medium-severity events. Navigate to Settings () → Configuration → Notifications page to create custom notifications. Creating a custom notification is a two-step process.

1. Create a channel

2. Create a notification rule

After creating a channel, you must create a notification rule to select the type of threats or events for which you wish to receive the notification. During this configuration, you must also select the channel you created for Traceable to distribute the notification.

Step 1 - Create a Channel

A channel is a group of mediums or people you want to notify when a type of event is triggered. You can send notifications to one or more than one of the following channels:

• Email Addresses — Sends notifications directly to the specified email address(es), ensuring that users receive alerts in their inbox(es). You can send these alerts to one or more users by adding a comma-separated list of email addresses.

• Slack Webhook — Delivers notifications to Slack channels, enabling real-time collaboration and immediate visibility of events within team workflows. For information on creating a Slack webhook, see Sending messages using Incoming Webhooks.

• S3 Webhook — Stores notification payloads in Amazon S3, allowing integration according to your requirements for further analysis or compliance.

• Splunk Webhook — Integrate with Splunk to forward notification data, which supports advanced log analysis and monitoring capabilities using its dashboard. For information on Splunk webhook, see Splunk documentation.

• Syslog Server — Sends notifications to a Syslog server, enabling centralized logging and integration with traditional IT operational tools. For more information on Syslog server, see Syslog documentation.

• Custom Webhook — Provides a customizable endpoint for delivering notifications, allowing integration with third-party systems or workflows according to your requirements.

On the Settings () → Configuration → Notifications page, click Create Channel button and provide the details to configure a channel. You can later edit or delete the channel. Once you have created a channel, the next step is to create a notification rule.

Step 2 - Create a Notification Rule

A notification is sent through a channel for a category of events and event type. To create a notification rule, click + Create Notification and complete the following steps:

1. Specify the notification Name.

2. Select a channel where you wish to receive the notification. You can change the channel to which you want to send the notification at any time post-creation. However, a notification can be sent to only one channel.

   Your title goes here

   Your content goes here

3. Select the Category to which the threat or event belongs.

   Note

   Availability of the below fields depends on the Category you select.

4. Select the Environment(s) you wish to receive the notification for.

5. Select the Threat Types/Event Types for which you wish to receive notifications. Each category has different threat types or event types. For more information on the availability, see Threat and Event Types.

6. Select the Severity of the notification.

7. Select the Impact of the threat or event types you wish to receive the notification for. For example, you may wish to receive notification only for threat activities that have a High impact score.

8. Select the Confidence of the threat or event types you wish to receive the notification for. For example, you may wish to receive notification only for threat activities that have a Medium confidence.

9. (Optional) Select the frequency of notification from one notification every hour to one notification in 24 hours.

10. Click Save.

Threat and Event Types

The following tables list the different category and their corresponding threat types or event types.

You can create notifications for any change made in the notifications configurations.

In addition, you can create notifications for data collection activity. This notification category helps you keep informed when an agent comes online or goes offline.