Notification channels + rules

What it is

A three-piece notification system that delivers Umbra events to the places your team watches:

• Channels: destinations. Six channel kinds: Slack incoming webhook, email digest, generic webhook, Jira, GitHub Issues, and SIEM (Splunk HEC / Microsoft Sentinel). Add as many as you need. See Ticket integrations for the Jira / GitHub kinds and SIEM outbound for Splunk / Sentinel.
• Rules: what to send where. “All critical findings to #security-critical.” “Daily digest of new services to [email protected].” Filterable by severity, kind, company, internal/external.
• Suppressions: opt-out rules for noisy categories. “Mute info-severity findings on hosts in this tag.” “Skip alerts on services with a specific banner.”

What it produces

• For every event matching a rule, a delivery to the rule’s channel (deduplicated against the suppression list).
• A notify_outbox view: every delivery the system attempted, with status (sent / failed / suppressed) and the message payload. Audit + debug trail.

What to use it for

• Severity routing: critical → #security-critical, the rest → a daily digest
• Per-company isolation (MSSP setup): each customer gets their own channel
• Compliance: “every KEV on PCI scope alerts the on-call within 5 minutes”

Why it matters

Notification policy is where most security-tool integrations rot: either too few signals (operator misses the critical one) or too many (everyone mutes the channel and the next critical goes unnoticed). The rule-based system lets you ratchet sensitivity per destination without playing the global firehose game.

Why it’s valuable

• Multiple channels. Slack, email, generic webhook, Jira, GitHub Issues, and SIEM (Splunk / Sentinel) can all coexist.
• Per-rule filters. Same SmartSearch grammar: severity: critical company:Acme is a rule, not just a query.
• Suppression list. Mute by tag, by kind, by service id. Noisy categories don’t drown the actual signals.
• Outbox visible. Every delivery is logged. “Did the alert fire?” is one click away.

How to use it

1. Admin → Notifications → Channels → Add. Configure the destination (Slack webhook URL, email address, generic webhook URL).
2. Admin → Notifications → Rules → Add. Pick which events, which channel.
3. Admin → Notifications → Suppressions for the categories you want to mute globally.
4. Use Test on each channel to verify connectivity before relying on it.

The Outbox view (in the same drawer) shows every delivery so you can confirm a rule fired when expected.