Route alerts to the right people

Why start with the recipient?

More messages do not resolve an exposure unless someone is responsible for responding. Define who monitors each channel and what they handle. Route relevant events to that channel.

Recommended routing

Set up a channel your response team monitors in the Notification channels tab of Integrations. In the Alert rules tab on the same screen, select the event conditions and destination for that team. Setup instructions are available for Slack, Telegram and webhooks.

To reduce noise, first check for overlapping rules that send to the same destination. Before suppressing repeated messages, distinguish duplicates from separate secrets or exposed locations. Hand over channel and rule responsibilities when the response team changes.

Use email and channel alerts according to their purpose. For sharing approvals and value-sharing emails, select the person responsible for the task as the recipient. Do not assume these messages replace channel alerts.

Check channel connectivity separately from event delivery. A successful connection does not prove that a rule is enabled or that an event matches its conditions. Find the notification record for an event that matches the rule. Compare it with the message received in the channel.

Common mistakes

Silence is not evidence that no secrets were exposed. Check rule status, conditions, connection health and scan results together. Avoid sending everything to an unattended channel. Investigate delivery failures before broadening rule conditions.

Checklist

• Name a response team for each destination.
• Match rule conditions to that team's responsibilities.
• Review overlapping rules sending to the same place.
• Confirm that designated email recipients know their task.
• Compare a real matching event with its delivery record.