Alerts by e-mail and webhook

The Alerts page says where to send the news: after each audit, when a site goes down and comes back, when an unusual certificate is issued, when a domain is ready for its next DMARC step, or when a supplier’s score drops. No alert is sent until you add a channel.

Add a channel

1. Open Alerts and go to Add a channel.
2. Choose the type: E-mail, or Webhook (ntfy, Slack, Discord or any HTTPS endpoint) from the Solo plan.
3. Enter the address or URL: you@example.com, or the webhook address, such as https://ntfy.sh/your-topic.
4. Choose when to send after an audit: when something changed, when there is a critical or high finding, or after every audit.
5. On the Agency plans, choose whether the channel is for the whole workspace or only for one client.
6. Press Add channel, then Test to receive a test message.

Only owners and admins can manage channels. A workspace can have up to twenty.

Confirming an e-mail address

An address that belongs to a member of the workspace works at once. Any other address first receives a message asking its owner to confirm (“Yes, send me these alerts”); until then the channel shows “waiting for the owner to confirm” and nothing is sent to it. This way, nobody receives alerts they never asked for.

The three rules

The rule decides which audits are sent to the channel:

Rule	Sent when
changes	Something changed since the previous audit: new findings, new subdomains, look-alikes, certificates, a drop of the score.
issues	The audit has at least one critical or high finding.
always	After every audit.

The other alerts follow their own logic:

• Downtime and recovery go to every channel that accepts them (see below), whatever its rule.
• Unusual certificates go to every channel, whatever its rule.
• Newly exploited vulnerabilities (from the Solo plan) go to every channel, whatever its rule: a vulnerability the last audit saw on one of your addresses has just entered the exploited-vulnerability catalog of CISA or the EU (ENISA). It also shows on the domain page.
• DMARC steps go to the channels set to changes or always.
• Supplier alerts go to the channels that are not limited to a client.

Webhooks

The message is formatted for the service the address belongs to: Slack incoming webhooks, Discord webhooks and ntfy topics get a readable message; any other HTTPS address receives JSON. Webhook addresses must be public HTTPS addresses: private and reserved addresses are refused.

Signed webhooks

Every alert sent to a webhook carries a Perimetry-Signature header: t=<time>,v1=<signature>, where the signature is the HMAC-SHA256, in hexadecimal, of the time, a dot and the raw body, keyed with the channel’s signing secret. Owners and admins find the secret under the channel on the Alerts page (Signing secret), with a button to make a new one; the old one then stops verifying at once. Test messages are signed too.

To accept only our alerts, compute the same HMAC on the body exactly as received, compare it in constant time, and refuse a time more than five minutes away from yours:

import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody: the body exactly as received; header: the Perimetry-Signature header.
function fromPerimetry(rawBody, header, secret) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header ?? '');
  if (!m || Math.abs(Date.now() / 1000 - Number(m[1])) > 300) return false;
  const want = createHmac('sha256', secret).update(`${m[1]}.${rawBody}`).digest();
  const got = Buffer.from(m[2], 'hex');
  return got.length === want.length && timingSafeEqual(got, want);
}

Slack, Microsoft Teams and PagerDuty

Slack and Teams channels (from the Solo plan) receive the same alerts as rich messages with buttons to the report; PagerDuty (from the Agency plan) receives only critical findings and outages, resolved by themselves once fixed. See Slack, Microsoft Teams and PagerDuty. Every member also receives a weekly summary by e-mail, set in Settings.

Manage your channels

Each line of the Channels table shows the target, the rule, and the date of the last alert with how it went (sent, failed or skipped because the rule was not met). From there:

• Test sends a test message (five an hour at most);
• Pause stops a channel without removing it, and Enable starts it again;
• No downtime alerts keeps a channel for audits only; Downtime alerts takes them again;
• Remove deletes the channel.

Every alert e-mail has a link back to this page, where it can be stopped.

Language

Alerts are written in the language of the workspace, set in Settings › Language by owners and admins: e-mails, webhooks and test messages alike, finding titles included.

Clients and tickets

On the Agency plans, the same page lets you create clients to group domains and route their alerts separately (see Clients and monthly reports), and connect ticket trackers (see Tickets).