概要

Notifications allow you to keep your team informed when a security signal is generated. A security signal is generated when at least one case defined in a detection rule is matched over a given period of time.

Notification types

Notifications can be set up for individual detection rules and also more broadly with notification rules.

検出ルール

When you create or modify a detection rule, you can define the notifications that are sent. For example, you can add rule cases to determine when a detection rule triggers a security signal. You can also customize the notification message in the Say what’s happening section.

Say what’s happening

Use the Say what’s happening section to customize the notification message using Markdown and notification variables. This allows you to provide additional details about the signal by referencing its tags and event attributes. You can also add tags to the generated signal, for example, attack:sql-injection-attempt.

通知ルール

Notification rules allow you to set general alerting preferences that span across multiple detection rules and signals instead of having to set up notification preferences for individual detection rules. For example, you can set up a notification rule to send a notification if any CRITICAL or HIGH severity signal is triggered. See Notification Rules for more information on setup and configuration.

通知チャンネル

Notifications can be sent to individuals and teams through email, Slack, Jira, PagerDuty, webhooks, and more.

Email

• Notify an active Datadog user by email with @<DD_USER_EMAIL_ADDRESS>.

  Note: An email address associated with a pending Datadog user invitation or a disabled user is considered inactive and does not receive notifications. Blocklists, IP or domain filtering, spam filtering, or email security tools may also cause missing notifications.

• Notify any non-Datadog user by email with @<EMAIL>.

Note: Email notifications don’t support addresses that contain slashes /, for example, @DevOpS/West@example.com.

インテグレーション

Notify your team through connected integrations by using the format @<INTEGRATION_NAME>-<VALUES>.

This table lists prefixes and example links:

Handles that include parentheses ((, )) are not supported. When a handle with parentheses is used, the handle is not parsed and no alert is created.

参考資料

お役に立つドキュメント、リンクや記事:

通知ルールの設定と構成ドキュメント 通知をカスタマイズするための通知変数についてドキュメント セキュリティ検出ルールについてドキュメント