Deliver events to Teams, Slack, ticketing, or a webhook
Create a notification destination, subscribe it to the right rule, detection, and assistant events, and verify delivery.
Before you start
- An approved public HTTPS endpoint or incoming webhook URL for the intended destination.
- For Webhook or Ticketing, a signing secret of at least 32 characters and a secure way to configure the receiver.
- Administrator membership and a recent MFA check for creating, testing, changing, or deleting targets.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Open the outbound destination controls
Open Admin → Integrations. In Notify targets, choose Add target. Existing cards show the target name, kind, saved destination origin, enabled/off state, rule usage, and subscribed-event count; choose a card to edit that target.
Choose the destination kind and address
In Add notify target, choose Kind, enter a meaningful Name, and supply the destination URL. The offered kinds are Slack, Microsoft Teams, Webhook, and Ticketing. Teams and Slack label the address New incoming webhook URL; Webhook and Ticketing use New endpoint URL. The destination must use a public HTTPS hostname and cannot contain a username or password.
Configure machine-receiver signing when required
For Webhook or Ticketing, enter Signing secret with at least 32 characters and configure the receiver to use the same secret. Slack and Teams use their incoming-webhook credential and do not show a separate signing-secret field. When editing a machine target, leave Signing secret blank to retain its current value; enter a new value only when rotating it with the receiver.
| Field or control | What to do |
|---|---|
| X-DEX-Event-Id and X-DEX-Delivery-Id | Stable event and delivery identifiers let a receiver recognize retries without processing the same event twice. |
| X-DEX-Timestamp and X-DEX-Signature-V2 | Verify HMAC-SHA256 over the timestamp, a period, and the exact request body. Check timestamp freshness and reject invalid or replayed requests. |
Choose event filters, templates, and state
Under Deliver these events, select any needed events: rule fired, rule needs approval, rule needs a person, rule stayed unresolved, rule proposed, assistant finding, or alert raised. Leaving every event unchecked delivers all supported event types. Set optional Title template and Message template values when the destination needs a specific format, then confirm whether Enabled should be on.
Test the reviewed configuration and save it
Choose Test send before or after saving and complete MFA. For a new target, Rapport tests the values currently in the dialog; for an existing target, it tests the saved target. Inspect Delivered in … ms or the failure message, then confirm receipt in the actual channel or receiving application. Choose Save, complete MFA, and verify the card’s kind, destination origin, event count, and enabled state.
What you should see: The destination accepts the test notification and the saved target card matches the reviewed configuration.
Verify a real event, then disable or remove unused targets
Trigger an authorized event covered by the target’s filter and confirm it arrives in the intended destination. To pause future delivery, reopen the target, turn Enabled off, and Save. To remove it, first change any rules that reference it. Then enter Deletion reason, choose Delete, complete MFA, and verify the card is gone.
If something doesn’t work
The URL or secret is rejected.
Use a public HTTPS hostname without embedded credentials, and a signing secret of at least 32 characters. A private IP, local hostname, or non-HTTPS URL is not accepted.
A real event did not arrive after the test succeeded.
Check that the target is enabled and that its event filter contains the actual event type. An empty filter accepts all supported types; a nonempty filter accepts only the selected types.
The delete control is disabled.
The target is still referenced by one or more rules, or a deletion reason is missing. Change those rules first, reopen the target, and enter a reason.
A save or delete says the target changed.
Close and reopen the destination to review the latest saved settings before retrying. The console protects edits using the target’s last-update revision.