Drift Alerts

Configure notifications for drift detection events

alertsnotificationsemailwebhookdrift

Drift Alerts

Configure how Securtea notifies you when drift is detected. Set up email, in-app, and webhook alerts based on severity and resource types.

Alert Overview

When drift is detected, Securtea can notify you through:

Channel	Description
In-App	Dashboard notifications and badge counts
Email	Messages to individuals or groups
Webhook	HTTP POST to external systems

Alert Configuration

Accessing Alert Settings

Navigate to Drift Detection > Settings
Click Alert Configuration
Configure channels and rules

Global Settings

Configure defaults that apply to all alerts:

Setting	Description
Default Severity	Minimum severity to alert on
Quiet Hours	Suppress non-critical alerts during off-hours
Digest Mode	Batch alerts into periodic summaries

In-App Alerts

How They Work

In-app alerts appear as:

Badge count on navigation icon
Notification panel entries
Dashboard widget updates

Configuration

In-app alerts are always enabled. Customize display:

Go to User Settings > Notifications
Configure display preferences
Set which severities show badges

Notification Panel

Click the bell icon to see:

Recent drift events
Event details and links
Mark as read options

Email Alerts

Setting Up Email Alerts

Go to Drift Detection > Settings > Alerts
Click Add Email Alert
Configure the alert

Configuration Options

Field	Description
Recipients	Email addresses or distribution lists
Severity Threshold	Minimum severity to send
Resource Types	Specific resources or all
Frequency	Immediate or digest

Email Content

Alert emails include:

Drift event summary
Affected resource details
Current vs. baseline values
Link to event in Securtea
Quick action buttons

Example Email

Subject: [CRITICAL] Drift Detected - Conditional Access Policy Modified

A critical configuration change was detected:

Resource: Conditional Access Policy "Require MFA for Admins"
Change Type: Modified
Severity: Critical

Changed Properties:
- state: "enabled" → "disabled"

View in Securtea: [Link]

Digest Mode

Batch multiple events into periodic emails:

Frequency	When Sent
Hourly	Top of each hour
Daily	8:00 AM (configurable)
Weekly	Monday 8:00 AM

Digests summarize:

Total events by severity
Top resource types affected
Links to individual events

Webhook Alerts

Setting Up Webhooks

Go to Drift Detection > Settings > Alerts
Click Add Webhook
Configure the webhook

Configuration Options

Field	Description
URL	HTTPS endpoint to receive events
Secret	HMAC secret for signature verification
Severity Threshold	Minimum severity to send
Resource Types	Filter to specific resources

Webhook Payload

Webhooks send JSON payload:

{
  "event": "drift.detected",
  "timestamp": "2024-01-15T09:30:00Z",
  "severity": "critical",
  "resource": {
    "type": "conditionalAccessPolicy",
    "id": "policy-123",
    "displayName": "Require MFA for Admins"
  },
  "changes": [
    {
      "property": "state",
      "baseline": "enabled",
      "current": "disabled"
    }
  ],
  "eventId": "drift-evt-456",
  "organizationId": "org-789"
}

Signature Verification

Verify webhook authenticity:

X-Securtea-Signature: sha256=...

Compute HMAC-SHA256 of request body with your secret and compare.

Integration Examples

Slack Incoming Webhook

Create Slack incoming webhook
Add as Securtea webhook destination
Use Slack's payload formatting

Microsoft Teams

Create Teams incoming webhook
Configure Securtea to send to Teams URL
Teams displays formatted card

ServiceNow

Create ServiceNow inbound action
Map Securtea payload to incident fields
Auto-create incidents for critical drift

PagerDuty

Create PagerDuty service
Use Events API v2 integration
Configure severity mapping

Alert Rules

Creating Rules

Build sophisticated alert logic:

Go to Alerts > Add Rule
Define conditions
Set actions

Rule Conditions

Combine conditions with AND/OR logic:

IF severity = "critical"
AND resourceType = "conditionalAccessPolicy"
AND change.property = "state"
THEN email security-team@company.com

Condition Options

Condition	Values
Severity	Critical, High, Medium, Low
Resource Type	Any supported resource
Property	Specific configuration property
Time	Business hours, off-hours
Change Type	Added, Modified, Deleted

Rule Actions

Action	Description
Send Email	To specified recipients
Send Webhook	To configured endpoint
Create Ticket	Via webhook to ITSM
Suppress	Don't alert for this pattern