Set up a notification

Notifications help your admins stay on top of what's going on in your workspace. You can create notifications via event subscriptions and have these alerts sent to Slack channels, emails, or other locations via webhook.

Optional, configure your Slack integration first.

If you want notifications to go to Slack, follow these directions to connect first then return to this guide to continue.

---

Create a notification

For deployment, we recommend you begin with a notification alerting you if a user clicks through a speedbump.

Notifications are created in event subscriptions.

1. From Integrations (the puzzle icon in the top toolbar), click API > Events.
2. Click Create Event; the new event subscription form loads.

Slack

If you want notifications to go to Slack, follow these directions to connect to Slack first.

In the Event Workflow:

1. Set the IF parameter to Issue Change . (Most event subscriptions will use Issue Change or Issue Update).
2. From the Detections list, search for then select Account clicked through speedbump on a phishing message.
3. In the THEN parameter, choose Slack.
4. Choose the Slack channel to send this notification to.
5. The default message includes a variable that displays the issue number in your notification.
6. From the Properties to Include drop down, include any properties you want displayed in your notification. Another useful parameter to include is account.acctEmail so you know which user clicked through the speedbump.
7. Optionally, add a Button to your notification. If you'd like a button to open the related issue, use the URL: ${issue.issueLink}

   
8. Click Send Test Event. You should see something like this in the Slack channel you chose:

   
9. Save, then toggle the event subscription On.

Email

In the Event Workflow:

1. Set the IF parameter to Issue Change . (Most event subscriptions will use Issue Change or Issue Update).
2. From the Detections list, search for then select Account clicked through speedbump on a phishing message.
3. In the THEN parameter, choose Email.
4. Enter one or more recipient email addresses in the To field. You can separate multiple addresses using commas.
5. In the subject line, you can also include a variable like the time or message ID.
6. In the Body, consider something concise like ${caseMsgInteracted.interactedBy.actor.acctEmail} bypassed the warning on a remediated message. You can also choose variables from the Body drop down.

   
7. Click Send Test Event. You should see something like this in the inbox you chose:

   
8. Save, then toggle the event subscription On.

Webhook

In the event workflow:

1. Set the IF parameter to Issue Change . (Most event subscriptions will use Issue Change or Issue Update).
2. From the Detections list, search for then select Account clicked through speedbump on a phishing message.
3. In the THEN parameter, choose Webhook.
4. In the method, choose Post.
5. Enter the URI from your webhook location/provider.
6. In Headers include the parameters you want to send., a quick way to create the content is to:

   1. Choose Slack and configure it with everything you need.
   2. Click Advanced Mode.
   3. Copy the content.
   4. Choose Webhook again.
   5. Paste the content into the headers.
7. Click Send Test Event. Confirm your webhook is successful.
8. Save, then toggle the event subscription On.

To send a notification to multiple channels, you need to create an event subscription for each.