Alerts

Route findings + scan events to Slack, PagerDuty, email, or custom webhooks. Per-severity, per-channel, with deduplication and quiet hours.

Channels

Slack (#channel + per-user DMs)
Microsoft Teams
PagerDuty (on-call rotation)
Opsgenie
Email (multi-recipient)
SMS (Twilio integration)
Webhook (HMAC-signed)
Discord

Alert types

  • New finding — fired when a scan introduces a finding not previously seen on this target.
  • Severity escalation — finding's severity changed (e.g. NVD updated, KEV added).
  • SLA breach approaching — finding within 24h of SLA deadline.
  • SLA breached — finding past SLA deadline.
  • Scan failed — scan job errored.
  • Shield blocking — unusual volume of Shield blocks (likely attack underway).
  • Verify-fix result — verify-fix returned Fixed or Still-exploitable.
  • Supply-chain signal — new pre-CVE signal on your dep graph.
  • Leaked credential — Shield's leaked-creds detection fired.

Routing rules

Configure at Settings → Alerts. Each rule:

  • When — alert type + severity threshold + (optional) project filter
  • Where — one or more channels
  • Quiet hours — suppress during configured windows (e.g. 22:00–08:00 local time)
  • Throttle — max N alerts per minute to avoid storming during attacks
  • Dedupe — same finding fingerprint within N hours = single alert with updated count

Common patterns

Critical findings → PagerDuty on-call (24/7)
High findings → #sec-alerts Slack channel
Medium findings → daily email digest at 09:00
Low findings → weekly Monday digest
SLA breach approaching → Slack + email to assignee
Shield blocking surge → PagerDuty (potential active attack)
Supply-chain signals → #infra Slack channel
Leaked credentials → security team DM + PagerDuty Sev2

Webhook payload

POST /your-endpoint
X-Sectora-Signature: t=1716643200,v1=abc...
{
  "type": "new_finding",
  "finding_id": "...",
  "severity": "critical",
  "title": "SQLi in /api/users/search",
  "url": "https://sectora.io/vulns/...",
  "scan_id": "...",
  "target": "https://example.com"
}

HMAC-SHA256 over the body, timestamp prevents replay (reject if > 5 min stale).

What's next