Package: Invicti AppSec Core (on-demand)
Configure target alerts
Send target-level alerts so your team hears about scan failures and new findings the moment they happen, instead of discovering them the next time someone opens the target. This document explains how to route alerts from a target to one of the supported notification tools (Slack, Microsoft Teams, Mattermost, email, or Microsoft Azure mail), how target-level rules sit alongside global rules, and how to choose who receives email notifications.
Why this matters
Without alerts, a broken scan can skip days of coverage before anyone notices, and a fresh critical vulnerability can sit in your inventory unread. Pushing those events into the channels your team already watches - Slack, ticketing, or email - keeps the security signal where the work is happening, so issues get triaged instead of buried.
Prerequisites
- You need at least one active notification integration set up under Integrations - for example, Slack, Microsoft Teams, Mattermost, an email service, or Microsoft Azure mail. For more information, see Integrations overview.
When you enable alerts at the target level, Invicti AppSec sends notifications about completed and failed scans by default. You can also create custom rules for more specific scenarios.
Global and target-level alerts
You can set alert rules at two levels:
- Global level: rules apply across all projects and targets. If you mark a global preset rule as default, Invicti AppSec applies it automatically to every target. You can also scope global rules to specific teams.
- Target level: rules apply only to a specific target.
If a global default preset rule exists, any rules you add at the target level work alongside it. Invicti AppSec sends an alert for every condition that matches, at either level - so the same scan can trigger both a global and a target-level notification.
This document covers target-level alerts, configured per target in the target's Settings > Alerts tab. There's also a separate Notifications page under Settings > Global settings > Notifications with two toggles - Receive notifications for all completed scans and Receive notifications for all failed scans - that control blanket scan notifications independently of any target alert rule. The two work alongside each other.
Add an alert rule to a target
- Select Inventory > Targets from the left-side menu.
- Click the target name to open the target.
- Select the Settings tab, then select Alerts.
- Use the Via dropdown to choose the notification tool. Each target sends alerts through a single tool, even if you have several integrations activated. The dropdown lists every notification tool you've set up under Integrations - Slack, Microsoft Teams, Mattermost, email, or Microsoft Azure mail.
- Complete the additional fields that appear for the selected tool - for example, a channel name for Slack, Teams, or Mattermost, or recipient settings for email and Microsoft Azure mail.
- Add one or both of the following - a target can use either or both at the same time:
- Import global rule: import a preset rule into this target. You can then edit the imported copy at the target level without affecting the original global rule.
- Add custom alert: configure a new alert rule that exists only on this target.
Configure email recipients
For email and Microsoft Azure mail alerts, choose who receives notifications by setting two fields:
- Recipient roles: a multi-select. Pick All to send notifications to every role assigned to this target's team, or pick one or more specific roles to scope the recipients to just those people. Combine selections as needed - for example, just team leads, or team leads plus developers.
- Additional email recipients: pick named Invicti AppSec users who receive notifications on top of the Recipient roles selection. Use this when the right person isn't covered by any role on the team.
Troubleshooting
I configured a chat alert (Slack, Teams, or Mattermost) but no messages arrive
Check the integration first. Open Integrations and confirm the workspace is still connected - a revoked token, expired webhook, or removed app silently breaks delivery. Then make sure the channel name in the alert matches the channel exactly, and that the Invicti app or webhook has access to that channel. Private channels don't receive messages until the app or webhook is added as a member.
I'm getting duplicate alerts for the same scan
This usually means a global default preset rule and a target-level rule both match the event. Open the target's Alerts tab and check whether an imported global rule and a custom rule are both watching the same condition. Remove one, or narrow the conditions so they don't overlap.
The Via dropdown is empty or my notification tool isn't listed
The dropdown only lists notification tools that already have an active integration - Slack, Microsoft Teams, Mattermost, email, or Microsoft Azure mail. Open Integrations, set up the tool you want to use, then come back to the target's Alerts tab. If the integration is set up but still doesn't appear, refresh the page so the dropdown picks up the new tool.
I want to send alerts from one target through more than one tool
Each target sends alerts through a single notification tool, selected in the Via dropdown. If your team wants the same target's alerts in two places - for example, Slack for triage and email for the audit trail - set the matching condition up as a global alert rule that uses a second tool. The target rule and the global rule can route to different tools, and both will fire for matching events.
Emails aren't reaching team leads or team members
Confirm the target is assigned to a team and that the team has the right members and leads. Team leads only only sends mail if the team has at least one user marked as lead, and All team members depends on the team having members. If the team is correct, check that each recipient has a verified email address on their Invicti AppSec profile.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center