Notifications
Deliver alerts, case activity, and scheduled reports to Slack, Microsoft Teams, PagerDuty, or any webhook endpoint via notification channels.
Notifications
nano delivers alerts and platform events to external systems through notification channels. A channel pairs a destination (a Slack channel, a Teams workflow, a PagerDuty service, a webhook endpoint) with routing rules that decide which events it receives. An event fans out to every channel whose filters match.
Manage channels at Settings → Notifications.
Channel types
| Type | Delivery mechanism |
|---|---|
| Slack | Incoming Webhook — posts a message card to one Slack channel |
| Microsoft Teams | Adaptive Card posted to an incoming-webhook / workflow URL |
| PagerDuty | Events API v2, configured with a routing key; the alert id is used as the dedup key |
| Generic webhook | HMAC-SHA256-signed JSON POST to any URL, with optional custom headers |
Setting up a Slack channel
nano uses a Slack Incoming Webhook — not Socket Mode. The app-level (xapp-) token from Socket Mode and bot (xoxb-) tokens are not used anywhere. The only credential nano needs is the https://hooks.slack.com/services/… webhook URL.
Open your Slack app
Go to api.slack.com/apps and select your app (or create one).
Activate Incoming Webhooks
Under Features → Incoming Webhooks, toggle Activate Incoming Webhooks on.
Add a webhook for the destination channel
Click Add New Webhook to Workspace and pick the Slack channel that should receive notifications. Slack generates a https://hooks.slack.com/services/… URL — copy it.
Create the channel in nano
On Settings → Notifications, create a new Slack channel and paste the webhook URL as the channel's URL. Configure its routing rules, then use Test send to confirm delivery.
Each incoming webhook posts to exactly one Slack channel. To notify multiple Slack channels (e.g. #soc-alerts and #reports), add a webhook per destination in Slack and create a matching notification channel in nano for each.
Microsoft Teams
Teams notifications are delivered as an Adaptive Card posted to an incoming-webhook / workflow URL. Create the workflow in Teams, copy its URL, and paste it as the channel's URL in nano.
PagerDuty
PagerDuty channels use the Events API v2. Configure the channel with the routing key (integration key) of the PagerDuty service that should receive events. The alert id is used as the dedup key, so repeated deliveries for the same alert de-duplicate on the PagerDuty side rather than opening new incidents.
Generic webhook
A generic channel sends an HMAC-SHA256-signed JSON POST to the URL you configure, so the receiver can verify the payload came from your nano instance. Custom headers are supported — useful for API keys or routing hints your endpoint expects.
The legacy Settings → Webhooks page has been folded into this page (it now redirects here). Existing generic webhooks were carried over and continue to work as generic channels — no reconfiguration needed.
Routing rules
Each channel subscribes to one or more event types:
| Event type | Fires on |
|---|---|
| SIEM alerts | Detection-rule alerts |
| Observability alerts | Alerts from observability (traces / metrics) rules |
| Cases | Case activity |
| Scheduled reports | Completed scheduled report runs |
On top of the event types, each channel sets:
- Minimum severity — events below it are not delivered to this channel.
- Detection-rule filter (optional) — restrict the channel to specific rules.
An event is delivered to every channel whose subscriptions and filters match — routing is fan-out, not first-match.
Base URL for deep links
Notification cards include a "view in nano" deep link back to the alert or report. That link requires the base URL to be set on the Notifications settings page. If it's unset, cards are still delivered — but without a clickable link, for both alert and report cards. Set it to your instance's external URL (the address analysts use in their browser).
Testing and delivery history
Every channel has:
- Test send — dispatches a sample notification through the real delivery path so you can verify the destination end-to-end.
- Recent delivery log — the channel's latest delivery attempts and their outcomes, for troubleshooting failed or missing notifications.
Reliability and security
The delivery spine validates egress destinations against SSRF (a channel can't be pointed at internal infrastructure), retries failed deliveries with backoff, and stores channel secrets (webhook URLs, routing keys, HMAC secrets) encrypted at rest.
Permissions
| Permission | Grants |
|---|---|
settings:webhooks | Manage notification channels and their routing rules |