NotificationsGetting Started

Getting Started with Notifications

Overview: This guide walks you through setting up notifications in RunReveal, from creating notification channels to testing them and adding them to your detection rules so that you are notified when alerts are triggered.

What You’ll Learn

In this guide, you’ll learn how to:

  • Create notification channels in the UI
  • Test your notifications
  • View alert history
  • Add notifications to detection rules:
    • Managed Detections - Out-of-the-box detections with default detection rules enabled. These are read-only and must be cloned first to add notifications.
    • Custom Detections - Detections that you create or cloned detections.
    • Sigma Streaming Detections - Add notification channels to your sigma streaming in YAML syntax.
    • Detection as Code - Notifications for detection as code rules are not managed through the UI. See Detection as Code for information on managing notifications in your detection code.

Prerequisites

Before you begin, make sure you have:

  • Access to the RunReveal dashboard
  • Admin permissions (for creating notification channels)
  • The necessary credentials for your chosen notification platform (Slack, PagerDuty, etc.)

Steps:

1. Create a Notification Channel

Notification Channels Overview

  1. Navigate to Notification Channels

    1. Go to the RunReveal dashboard
    2. Click on Notification Channels in the left sidebar
    3. Click Create Notification Channel

  2. Choose Your Notification Type

    • Email: Simple email delivery
    • Slack: Send to Slack channels
    • PagerDuty: Incident management integration
    • Jira: Issue tracking integration
    • Webhooks: Custom HTTP endpoints
    • Tines: Security automation platform

  3. Configure the Notification Type

    1. Give your channel a descriptive name (e.g., “DevOps Security Alerts - Slack”)
    2. Input the required information (webhook URL, email address, integration keys, etc.)

  4. Save the Notification Channel

    1. Click Create Notification to save your notification channel
    2. The channel will appear in your notifications list

2. Test Your Notification Channel

  1. Send Test Notification

    1. Click Send Test to trigger a test notification
    2. This will send a sample alert to your notification channel to verify your configuration

  2. Verify Delivery

    1. Check your notification platform to confirm receipt of test notification

Test Notification

3. Add Notifications to Detections

When detection rules trigger alerts in RunReveal, they automatically send notifications to all configured notification channels associated with that detection. Each detection type has a different method for adding notification channels:

Managed Detections

Managed Detections Overview

⚠️

Managed detections are read-only. You must clone them before adding notifications. This applies to both managed SQL detections and managed sigma detections.

  1. Clone the Detection

    1. Go to Detections → Detection Queries
    2. Find the managed detection you want to customize
    3. Click Clone & Edit to create a copy of the detection

  2. Add Notification Channels

    1. In the cloned detection, scroll to Notification Channels section
    2. Click to view a dropdown of available channels
    3. Select your newly created notification channel

  3. Save and Deploy

    1. Click Save Detection to store your changes
    2. The detection will now send notifications to your channel when alerts are triggered

  4. Deactivate Original Detection

    1. Toggle the “Active” switch to off on the original managed detection to avoid duplicate alerts

4. View Alert History

Alert History Overview

Note: Alert history shows notifications from real detection alerts, not test notifications sent from the notification channel test function.

  1. Access History

    1. In the Notification Channels page in the UI, click Alert History
    2. Or utilize the History API for programmatic access

  2. Review Notifications

    1. View all sent notifications with timestamps
    2. See delivery status (success/failed)
    3. Check notification content and recipients

  3. Troubleshoot Issues

    1. Failed notifications will show error details
    2. Use this information to fix configuration issues

Next Steps

Now that you have notifications set up, explore the detailed configuration guides:

Troubleshooting

Notifications Not Sending

  1. Check channel configuration
  2. Test Notification Channel
  3. Verify platform credentials
  4. Review alert history for error messages

Duplicate Notifications

  1. Check rule notification settings
  2. Ensure no overlapping rules
  3. Review notification frequency settings

Sigma Rule Notifications Not Working

  1. Verify notificationnames field spelling matches channel names exactly
  2. Check that notification channels are active and tested
  3. Ensure sigma rule is enabled and properly configured
  4. Review sigma rule logs for any processing errors
NotificationsEmail Notifications