What are notifications?
Notifications let you receive alerts when scan results match specific conditions. Instead of checking every scan manually, you set up rules and only hear about what matters.How notifications work
Choose a trigger type
Select what type of scan results to monitor (vulnerability, ports, scan status, etc.).
Trigger types
Notifications can be triggered based on different types of scan results:| Trigger | Description |
|---|---|
| Vulnerability | Findings from vulnerability scans |
| Scan status | Scan completion status (finished, failed, timed out, etc.) |
| Port Scanner | Open ports discovered by the Port Scanner or Network Scanner |
| Technology found | Technologies detected by Website Scanner or Website Recon |
| Subdomains | Subdomains discovered by the Subdomain Finder |
| URL Fuzzer | Items found by the URL Fuzzer |
| Password Auditor | Credentials found by the Password Auditor |
| Domains | Domains found by the Domain Finder |
Condition examples
Vulnerability conditions
| Condition | Operators | Example |
|---|---|---|
| Risk level | is at least | Alert when risk is at least High |
| Finding name | contains, is | Alert when finding contains “SQL Injection” |
| Confirmed tag | is confirmed | Alert only for confirmed findings |
| Diff | from previous scan | Alert when new vulnerabilities appear |
Scan status conditions
| Status | Description |
|---|---|
| Finished | Scan completed successfully |
| Timed out | Scan exceeded time limit |
| Stopped by user | Scan was manually stopped |
| Failed to start | Scan could not start |
| VPN connection error | VPN agent connectivity issue |
| Authentication error | Login credentials failed |
| Connection error | Target unreachable |
| Aborted | Scan was aborted |
Port Scanner conditions
| Condition | Operators | Example |
|---|---|---|
| Open port | is any of, is not one of, is greater than, in top N, contains all of | Alert on port 22, 23, 3389 |
| Protocol | is, contains | Alert when SSH is detected |
| Diff | from previous scan | Alert when new ports appear |
Subdomains conditions
| Condition | Operators | Example |
|---|---|---|
| Subdomain name | contains | Alert when subdomain contains “admin” |
| Netname | contains | Alert when netname contains “AMAZON” |
| Country | contains | Alert when country contains “US” |
| Diff | from previous scan | Alert when new subdomains appear |
URL Fuzzer conditions
| Condition | Operators | Example |
|---|---|---|
| Items found | at least | Alert when at least 10 items are found |
| HTTP code | is | Alert when HTTP code is 200 |
Password Auditor conditions
| Condition | Operators | Example |
|---|---|---|
| Credentials found | at least | Alert when at least 1 credential is found |
Domains conditions
| Condition | Operators | Example |
|---|---|---|
| Domain name | contains | Alert when domain contains “example” |
| Company | contains | Alert when company contains “Corp” |
| contains | Alert when email contains “@example.com” | |
| Certainty | at least | Alert when certainty is at least 80 |
Technology conditions
| Condition | Operators | Example |
|---|---|---|
| Technology | contains | Alert when “WordPress” is found |
Notification destinations
Send to your account email or custom addresses.
Slack
Send to a Slack channel.
Microsoft Teams
Send to a Teams channel via webhook.
Discord
Send to a Discord channel via webhook.
Webhook
Send to any HTTP endpoint.
Nucleus
Send findings to Nucleus for vulnerability management.
Creating a notification
Select destinations
Under Notification actions, choose where to send alerts: your default email, additional addresses, or an integration like Slack, Teams, Discord, Webhook, or Nucleus.
Workspace scope
Notifications are scoped to your current workspace. Each workspace can have its own set of notification rules. The notifications configured on this page are applied to all scans running in the current workspace, whether started manually, scheduled, or via API. A notification will be sent if a scan result matches any of the defined notification rules in the workspace.Enabling and disabling
You can enable or disable notifications without deleting them:- Enabled: Notification will trigger when conditions match
- Disabled: Notification is saved but won’t trigger
Diff notifications
Diff notifications alert you when results change from a previous scan:- New vulnerabilities: alert when new findings appear
- New ports: alert when new ports are discovered
- New subdomains: alert when new subdomains are found
Best practices
Start with high-severity alerts
Start with high-severity alerts
Begin by setting up notifications for critical and high severity findings. Add more granular rules as needed.
Use meaningful names
Use meaningful names
Name notifications descriptively, for example “Critical vulns - Production”.
Combine conditions wisely
Combine conditions wisely
Use multiple conditions to reduce noise. For example, “Risk level at least High” AND “Finding name contains SQL”.
Use diff notifications
Use diff notifications
For scheduled scans, use diff notifications to only alert on changes instead of every finding.