Available for:
Cloud SIEM
|
Cloud Security Management
|
Application Security Management
Overview
Security notification rules play a key role in keeping your team informed of issues without you having to manually edit notification preferences for individual detection rules. Notification rules can span across multiple detection rules and signals based on parameters such as severities, rule types, rule tags, signal attributes, and signal tags.
Create notification rules
To create a notification rule, you define the logic for when the notification rule is triggered based on conditions such as severity, detection rule type, tags, and attributes.
As you configure the rule, a preview of issues matching the notification rule conditions appears on the Example of matching issues panel. This can be useful in determining if the notification rule is too specific or broad.
- On the Notification Rules page, click New Notification Rule.
- Under Source Types, select the detection rule types you want to include in the notification rule.
- (Optional) For ASM, select the ASM Vulnerability Management source type, or leave the source type empty and select the Include Application level vulnerabilities checkbox.
- Under Rule Criteria, select one or more severity levels.
- Specify the tags and attributes that must be present in order for the notification rule to be triggered.
- Under Notification Details, specify the recipients you want to notify when the notification rule is triggered. You can notify individuals, teams, create Jira issues, and more. See Notifications for more information.
- Enter a name for the notification rule.
- Click Save and Activate.
If the notification rule matches the specified conditions, the resulting notification includes details about the matched notification rule in the notification footer.
Manage notification rules
Enable or disable a notification rule
To enable or disable a notification rule, toggle the switch on the notification rule card.
Edit a notification rule
To edit a notification rule, click the notification rule card. After you finish making your changes, click Save and Activate.
Clone a notification rule
To clone a notification rule, click the vertical three-dot menu on the notification rule card and select Clone.
Delete a notification rule
To delete a notification rule, click the vertical three-dot menu on the notification rule card and select Delete.
Further Reading
Additional helpful documentation, links, and articles:
