Notifications and Alerts

Overview

Fencer notifies you through rules. A rule pairs a trigger, such as a new vulnerability, an SLA alert, or a security detection, with optional conditions and one or more destinations. Organization rules send events to shared channels and to the right people. Personal rules decide what reaches you. Notifications arrive in the in-app inbox, by email, in Slack, or at your own webhook.

Prerequisites

Organization rules: permission to edit organization settings (organization admins have it). Anyone who can read organization settings can view them.
Personal rules: Administrator, Team Member, and Read Only users manage their own. Penetration Tester and custom roles cannot.
Destinations: Slack needs a connected Slack workspace, an organization email needs a verified address under Settings > Emails, and a webhook needs an HTTPS endpoint.

How it works

When an event happens, Fencer checks every active rule on that trigger. Each rule whose conditions match sends to all of its destinations, so one rule can notify Slack, email, and a webhook at once. Rules are set per organization: if you belong to several organizations, each has its own rules.

There are two kinds of rules:

Organization rules (Settings > Notifications) send to a Slack channel, an organization email address, a webhook, or to people: the assignee, the organization admins, or a specific member, by email, Slack DM, or in-app notification.
Personal rules (User settings > Notifications) always notify you, in your in-app inbox, by email, or by Slack DM.

When you join an organization, Fencer creates a personal rule for each event your role receives. By default each one notifies you in the in-app inbox and by email, but not by Slack DM. The exceptions:

Important Vulnerability Detected covers new vulnerabilities at Critical severity, except leaked secrets, and is in-app only. Turn on email if you want it.
Secret Vulnerability Detected emails go through a separate Leaked secrets to email rule that batches them into at most one email every 6 hours.
Task Assigned also sends you a Slack DM.
Vulnerability Status Change is email only.
Pentest results, vulnerability status changes, new members, broken integrations, plan limits, and API key approval requests go to admins only. Detection events need a SIEM subscription.
Penetration Testers get a fixed set instead: their own task assignments, vulnerability comments, overdue deferrals, status changes on their own engagements, and API key grant decisions.

You can edit, pause, or delete these rules. Fencer never recreates a rule you deleted.

Triggers

Trigger	Fires when
New vulnerability detected	A new vulnerability is detected on one of your assets.
Vulnerability status changed	A vulnerability’s status changes, for example resolved or reopened.
Vulnerability SLA alert	Vulnerabilities breach their SLA or approach the deadline.
Vulnerability deferral overdue	A vulnerability you deferred is due for review.
Vulnerability comment added	Someone comments on a vulnerability.
Task assigned	A task is assigned to a teammate.
Penetration test results uploaded	New penetration test results are uploaded.
Daily vulnerability digest	Daily at 06:00 UTC, a summary of new vulnerabilities.
Weekly security digest	Mondays at 10:00 UTC, a summary of your security posture.
Weekly dependency digest	Mondays, vulnerable dependencies and available upgrades.
Weekly identity digest	Mondays, new and review-needed identities.
Organization member added	Someone is invited to or joins the organization.
Integration broken	An integration stops working and needs attention.
Plan limit reached	A plan usage limit is reached.
Personal API key approval requested	Someone requests access for a personal API key.
Personal API key grant decided	A personal API key grant is approved, rejected, or revoked.
Security detection	A SIEM rule creates a detection (needs SIEM).
Detection comment added	Someone comments on a security detection (needs SIEM).

Usage / Configuration

Creating an organization rule

Go to Settings > Notifications and click New rule.
Describe the rule in plain English and click Draft it, pick a template, or click Start from scratch.
Under When this happens, choose the Trigger, then narrow it with conditions such as severity or category. Advanced conditions offers every other field. Leave the filters empty to match every occurrence. The Matching preview shows recent matches from the last 14 days without sending anything.
Under Send it to, turn on one or more destinations:
- Send Slack channel message, then pick the channel.
- Send organization email, then pick a verified address.
- Webhook, then enter your endpoint (see Webhooks).
- Notify a user by email, Send Slack direct message, or Send an in-app notification, then pick who: The assignee (on triggers that have one), Organization admins, or A specific member.
On vulnerability and Security detection triggers (not digests), use How often to send to cut noise:
- How often should this rule send? rolls matches into one message per window (Every scan, Hourly, Every 6h, Daily, or Custom).
- Skip repeats of the same vulnerability? mutes a vulnerability you were already told about (Never skip, 1h, 1d, 7d).
- Wait to confirm before sending? waits, then sends only if the vulnerability is still open (Send now, Wait 15m, Wait 1h, Wait 3d).
Enter a Rule name and click Save rule.
To check the destinations, click Test send, choose Send to all actions or one destination, and confirm with Send test. Recipients receive one real message.

Managing rules

The rules list shows each rule with its trigger and channels. Search, filter by trigger, channel, or status, and group the list with Group by. Use a rule’s toggle to pause it without losing its settings, and its menu to Edit, Duplicate, or Delete it. A rule marked Needs attention failed on its latest run, for example because Slack was disconnected.

Choosing your own notifications

Click your avatar, select User settings, and open Notifications. The page shows your personal rules for the organization you have open.
Edit a rule, or click New rule to add one.
Turn on Notify me in my in-app inbox, Send me an email, or Send me a DM on Slack.
On triggers about a person, such as Task assigned or comments, keep Only when it involves me on to hear only about your own items.
Click Save rule.

Reading the in-app inbox

Click the bell icon in the sidebar header to open the inbox. Notifications from your rules that use Notify me in my in-app inbox or Send an in-app notification land here. The inbox has two tabs, each with its unread count:

Notifications — vulnerability, secret, SLA, and detection alerts, task assignments, comments, overdue deferrals, API key decisions, and the daily and weekly digests.
Admin — penetration test results, new members, broken integrations, plan limits, and API key approval requests. Only people who can view organization settings see this tab.

Click a notification to mark it read and open what it is about. A digest opens in a window inside the inbox instead, with the full daily or weekly summary. Each row has a Mark as read / Mark as unread toggle and, on hover, a Dismiss button. Use Mark all as read or Dismiss all (which asks you to confirm and cannot be undone) to clear the current tab, Show older notifications to load more, and Notification settings to jump to your personal rules.

Routing SIEM detections

SIEM alerts are organization rules on the Security detection trigger. Open Operations > Security Monitoring and select the Alerting tab, which opens Settings > Notifications filtered to that trigger. The tab is shown to people who can view organization settings. See SIEM Alerting.

Automations

Rules that change data, rather than only send a message, live under Settings > Automations. Viewing them needs the automations:read ability and changing them needs automations:edit; among the built-in roles, only Administrator holds them. An automation can Create a ticket in Linear or Create a ticket in Jira for matching vulnerabilities or detections:

How to file: Grouped (one issue per run, the default) or Per vulnerability (one issue each).
Skip vulnerabilities that already have an issue prevents duplicates.
Max vulnerabilities per run caps each run; the rest are skipped and listed in the run log.
Assign to the vulnerability owner matches the owner to a tracker user, with a Fallback assignee.

An automation can also include a Notify action that sends to the same destinations as a notification rule. The Matching preview shows what the automation would file without opening anything, and Runs shows its run history. A rule whose only actions notify is saved under Settings > Notifications. See Automations for the full reference, including the Fix with Fencer action.

Examples

Critical vulnerabilities to your security channel

Trigger: New vulnerability detected, condition Severity is Critical.
Destination: Send Slack channel message to #security.
Skip repeats of the same vulnerability? set to 1d, so a re-scan does not alert twice.

Tell the assignee when an SLA is breached

Trigger: Vulnerability SLA alert.
Destination: Notify a user by email, recipient The assignee.

Only your own assignments in Slack

Personal rule on Task assigned with Send me a DM on Slack and Only when it involves me on.

Troubleshooting

Not receiving notifications — Open User settings > Notifications for the right organization and check that your rule for the event exists and is active. An organization rule may also be sending to you.
Slack DMs not arriving — The organization needs a connected Slack workspace, and your Slack account email must match your Fencer email.
Organization emails not sent — Add and verify an address under Settings > Emails, then select it on the rule.
“Personal notification rules are not available for your role” — Penetration Tester and custom roles cannot manage personal rules.
Digest timing — The daily vulnerability digest goes out at 06:00 UTC, and the weekly digests on Mondays around 10:00 UTC.