Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions docs/getting_started/manage_notifications.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# Manage notifications

This article describes how to view, modify, or disable your existing notification rules within the Sekoia.io platform.

## View existing notifications

To see your active rules, navigate to **Settings > Notifications**.

The listing page displays all notifications you have created. You can search for specific rules by name or use the filters to sort by **Trigger type** or **Action type**.

!!! warning "User Visibility"
Notifications are personal. A notification rule is only visible to and manageable by the user who created it within the community where it was created.

## Modify a notification

1. Navigate to **Settings > Notifications**.
2. Locate the notification you wish to change.
3. Click the notification line.
4. Update the name, triggers, conditions, or actions as needed.
5. Click **Save**.

## Disable or delete a notification

If you want to stop receiving messages without losing your configuration, use the toggle switch:

1. Navigate to **Settings > Notifications**.
2. Locate the notification in the list.
3. Click the status toggle to switch it to **Off**.

To permanently remove a rule:

1. Locate the notification in the list.
2. Click the three dots **...** button.
3. Click **Delete**.
4. Confirm the deletion in the pop-up window.

!!! warning "Permanent Action"
Deleting a notification is permanent. This action cannot be undone, and the rule must be recreated from scratch if needed again.

## Related articles

* [The notification system](/getting_started/notification_concept.md): Context on how notifications work.
* [Create a notification](/getting_started/notifications-Listing_Creation.md): Detailed steps for setting up new alerts.
* [Notification examples](/getting_started/notifications-Examples.md): Inspiration for your notification setup.
57 changes: 57 additions & 0 deletions docs/getting_started/notification_concept.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# The notification system

The Sekoia.io notification system allows you to stay informed about specific activities within your workspace through various channels. By defining triggers and conditions, you ensure that relevant security events reach the right stakeholders immediately.

Notifications function as automated rules that monitor your communities for specific events, such as alert updates or system errors. When an event matches your predefined criteria, the system executes an action, such as sending an email or triggering a message in a third-party application.



## Notification triggers

You can monitor several categories of events within the platform:

* **Alerts**: Creation of new alerts, status updates, or automated case modifications.
* **Intelligence**: New rules added to the Rules Catalog, or rules scheduled for deprecation.
* **Operations**: Playbook execution errors, connector failures, or detection rules entering a rate-limited state.
* **Reporting**: Availability of new reports.
* **Data Ingestion**: Notifications when no events are received for a specific period (intake monitoring).

??? note "Triggers comprehensive list"
- A new alert is raised
- An alert is updated
- A report is available
- A new rule is added to the Rules Catalog by Sekoia.io
- No events are received
- A playbook encountered an error
- A connector encountered an error
- A rule from the Rules Catalog is scheduled for deprecation
- A rule from the Rules Catalog is deprecated
- An automated case is created
- An automated case is edited
- A detection rule entered rate-limited state


## Delivery channels

The system supports multiple ways to receive information:

* **In-app**: Notifications appear directly within the Sekoia.io interface.
* **Email**: Direct messages sent to an email address.
* **Messaging Platforms**: Real-time messages sent to Slack, Microsoft Teams, or Mattermost channels.
* **Custom Webhooks**: JSON payloads sent to a specific URL for custom automation.

## Workspace modes

The behavior of notifications depends on your workspace hierarchy:

* **Single-tenant mode**: Notifications apply only to the current workspace.
* **Multi-tenant mode**: Notifications can monitor all managed communities or be restricted to specific ones.

!!! note "User Visibility"

Notifications are personal. A notification rule is only visible to and manageable by the user who created it within the community where it was created.

## Next steps
* [Create a notification](/getting_started/notifications-Listing_Creation.md): Learn how to set up your first notification rule.
* [Manage notifications](/getting_started/manage_notifications.md): Instructions on editing, disabling, or deleting rules.
* [Notification examples](/getting_started/manage_notifications.md): Practical use cases for common security scenarios.
80 changes: 35 additions & 45 deletions docs/getting_started/notifications-Listing_Creation.md
Original file line number Diff line number Diff line change
@@ -1,56 +1,46 @@
# Create a notification

# Notifications
This procedure explains how to set up a new notification rule to monitor events and receive alerts through your preferred channel(s).

Stay updated on your workspace's latest activities by setting up notifications for multiple features.
### Prerequisites

## What notifications can do
* Access to the community where you want to monitor activities.
* (Optional) Incoming webhook URLs if you plan to integrate with Slack, Teams, or Mattermost.

Notifications, accessible through the main menu or Settings, allow you to:
## Procedure

- Focus on specific events such as:
- A new alert is raised
- An alert is updated
- A report is available
- A new rule is added to the Rules Catalog by Sekoia.io
- No events are received
- A playbook encountered an error
1. Navigate to the bottom of the left-hand panel and click **Settings**.
2. Select the **Notifications** tab.

- Add specific conditions:
- Focus on the name, reference, pattern, source, intake...
3. Click the **+ New notification rule** button.
!!! note "Initial Setup"
If no notifications exist, the listing page appears blank with the **+ Notification** button.
4. Enter a descriptive name in the **Notification name** field.
5. Select the event category from the **Trigger** drop-down list.
6. Define specific criteria (such as Alert Status, Urgency, or Involved Asset) in the **Conditions** section.
7. Select the delivery method in the **Action to perform** section:
* **In-app notification**: View alerts within the Sekoia.io platform.
* **Email**: Send a notification to a specific email address.
* **External Tools**: Select Slack, Teams, or Mattermost or provide a webhook URL.
8. Click **Save**.

- In a multi-tenant setup, specify if the notification applies to all your communities or specific ones
- Configure actions such as sending an email or displaying an in-app notification
### Result

This documentation provides detailed information on the Sekoia.io notifications mechanism.
Your new notification appears in your personal listing. The system begins monitoring for the specified trigger immediately.

## Notifications Listing
??? example "Example: High-Urgency Alert Notification"
**Problem**: You need to be immediately alerted when a critical asset is involved in a high-priority incident so you can begin remediation.

* **Trigger**: New alert is raised.
* **Conditions**:
* `Urgency` is greater than `80`
* `Asset name` contains `Production-Database`
* **Action**: Send an email and a Slack message.

**Result**: Whenever an alert matching these criteria occurs, you receive a direct email and a notification in your designated Slack channel with the alert details.

If no notifications are set up in your community, the listing page will be blank with a highlighted `+ New Notification` button for creating new notifications.
## Related articles

Once notifications are created, you can edit, duplicate, delete, and (de)activate them from the main Notification page in the Settings. You can also search and filter notifications by trigger type or action type.

!!! Warning
Each notification is only visible to the user who created it and within the community where it was created.

You can access your in-app notifications from the main navigation.

## Create a new notification

**Single-tenant mode**: Notifications apply only to the current workspace.

**Multi-tenant mode**: By default, notifications come from all communities, but you can choose to receive notifications from a specific community.

1. Go to Settings > Notifications > `+ New notification`
1. Choose the event and conditions that will trigger your notification rule (e.g., new or existing alerts)
2. Set conditions like alert status, urgency, and involved asset
3. Decide on actions like in-app notifications, emails, texts via webhooks, or Mattermost channels
4. Give your notification a name
5. Save your settings

## Example notification criteria

New alert status is `Ongoing`
Alert urgency is `higher than 80`
Involved asset is `My Critical Asset`

Other examples can be found in [this section of the documentation](notifications-Examples.md).
* [The notification system](/getting_started/notification_concept.md): Understand the logic and triggers behind the system.
* [Manage notifications](/getting_started/manage_notifications.md): Learn how to update or deactivate existing rules.
* [Notification examples](/getting_started/notifications-Examples.md): Explore more configuration templates.
4 changes: 3 additions & 1 deletion mkdocs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,9 @@ nav:
- Custom roles: getting_started/custom_roles.md
- Intake Restricted roles: getting_started/intake_restricted_roles.md
- Notifications:
- Create and manage notifications: getting_started/notifications-Listing_Creation.md
- Notification system: getting_started/notification_concept.md
- Create notifications: getting_started/notifications-Listing_Creation.md
- Manage notifications: getting_started/manage_notifications.md
- Notification examples: getting_started/notifications-Examples.md
- API Keys: getting_started/manage_api_keys.md
- Subscriptions: getting_started/subscriptions.md
Expand Down