Alerting

Route detection alerts to the right people through email, Slack, Discord, PagerDuty, or custom webhooks with severity-based filtering.

Alert Channels

SentinelNerd supports multiple alert channels. Each channel can be configured with severity filters so you only receive the alerts that matter.

Email

Email alerting is built-in and enabled by default. All team members with alert permissions receive notifications.

• HTML-formatted alert emails with event details
• Configurable digest mode (immediate, hourly, daily)
• Per-user severity thresholds

Slack

Send alerts to Slack channels with rich formatting, action buttons, and thread-based updates.

Webhook URL: https://hooks.slack.com/services/T00/B00/xxxxx Channel: #security-alerts Username: SentinelNerd Min Severity: medium Include Event Details: true Thread Follow-ups: true

Discord

Send alerts to Discord channels via webhook. Alerts appear as rich embeds with color-coded severity.

Webhook URL: https://discord.com/api/webhooks/xxxxx/yyyyy Min Severity: medium Mention Role: @security-team

PagerDuty

Trigger PagerDuty incidents for critical alerts with automatic resolution when the condition clears. Pro

Integration Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Min Severity: high Auto-resolve: true Dedup Key: rule_name + group_by

Custom Webhooks

Send alert data to any HTTP endpoint. Use this to integrate with ticketing systems, SOAR platforms, or custom automation.

URL: https://your-app.com/api/sentinel-alerts Method: POST Headers: Authorization: Bearer your-token Content-Type: application/json Min Severity: low Retry: 3 attempts with exponential backoff

Webhook Payload

All webhooks receive a JSON payload with the following structure:

{
  "alert_id": "alt_abc123",
  "rule_name": "net.ssh_brute_force",
  "severity": "high",
  "title": "SSH Brute Force Detected",
  "description": "10 failed SSH logins from 203.0.113.42 in 5 minutes",
  "source": "unifi_network",
  "timestamp": "2025-01-15T14:32:01Z",
  "events": [...],
  "enrichment": {
    "geo": { "country": "CN", "city": "Beijing" },
    "threat_score": 87,
    "abuse_reports": 142
  },
  "instance_id": "inst_xyz789",
  "dashboard_url": "https://app.sentinelnerd.com/alerts/alt_abc123"
}

Severity Routing

Configure which severities go to which channels:

Alert Suppression

Prevent alert fatigue with suppression rules:

• Deduplication — Group identical alerts within a time window
• Rate limiting — Max alerts per rule per time period
• Maintenance windows — Suppress alerts during planned downtime
• Acknowledgment — Suppress follow-ups once an alert is acknowledged