Notifications and SIEM integrations
Connect Slack, PagerDuty, Splunk, and Elastic while tracking delivery and deduplicating retries.
Integrations deliver selected Guard events to external responders or analysis systems. Delivery state belongs to the integration and does not determine whether a security response succeeded.
To share resource context with Infra, use Connector product connections. Those grants are separate from external notification destinations.
Configure a destination
An Administrator opens Organization → Integrations → Add integration. Choose Slack, PagerDuty, webhook, or syslog. Store webhook URLs, routing keys, and credentials through protected fields. Select event categories, severity threshold, asset groups, and redaction. Use Test delivery with a synthetic event before enabling production routing.
Slack posts to the authorized channel; PagerDuty uses the configured routing key and stable correlation key. External acknowledgement or resolution cannot release endpoint isolation or close a finding. Review those effects through separate Guard workflows.
For Splunk or Elastic, choose webhook or the supported syslog receiver configuration. Use TLS with certificate verification for syslog. At Integration → Mapping, inspect event ID, type, occurrence time, ingestion time, organization ID, asset ID, incident ID, rule revision, and severity. Preserve original IDs when renaming fields in the receiver.
Delivery and retries
Open Integration → Deliveries to inspect queued, delivered, retrying, or failed records and the receiver response. Webhooks use at-least-once delivery; receivers deduplicate by event_id. Timeout after acceptance can cause a retry. Ordering is not guaranteed, so read the resource or compare its revision before applying downstream state.
Webhook deliveries include Guard-Event-Id, Guard-Timestamp, and Guard-Signature. Follow webhook verification for the signed-byte format, timestamp checks, retry window, and replay handling. Preserve the raw body until verification completes.
Rotate and recover
For a webhook signing-secret rotation, open Integration → Credentials → Rotate and install the new secret in the receiver. During the displayed overlap, accept either valid version. Send Test delivery, confirm verification with the new secret, and stop accepting the old version when the overlap ends. See signature rotation.
For a failed receiver, correct the error shown under Integration → Deliveries, then select the failed delivery and choose Retry. The new attempt keeps the original event ID. Deduplicate completed processing so replay does not repeat its side effects.
To retire a destination, disable its integration before removing the receiver credential. Previously delivered messages remain subject to the receiver's retention rules.
Self-hosted notifications and SIEM exports connect directly to their receivers; they do not use the DDoS Connector. Use the Integration API for automation and Organization → Audit to review configuration changes.