Manage Notification Channels

Alerts are triggered in Sysdig Monitor when event thresholds are crossed, while in Sysdig Secure, they can be linked to runtime policies and actions in Automations. You can configure alerts to send through various supported notification channels. This page explains how to configure and manage notification channels, and how to disable notifications when they are not needed, such as during scheduled downtime.

Supported Notification Channels

The tables below show which notification channel types are supported in Sysdig Secure and Sysdig Monitor, and for which use cases within each product.

Supported Channels in Sysdig Secure

Notification ChannelThreat Detection PoliciesVulnerability PoliciesAutomationsReports
Amazon SNSX
EmailXXXX
Microsoft TeamsXXX
OpsGenieX
PagerDutyXX
Prometheus AlertmanagerX
SlackXXXX
Sysdig Team EmailX
VictorOpsX
WebhookXXX

Supported Channels in Sysdig Monitor

Notification ChannelAlertsSilence Rule NotificationsCost Advisor Reports
Amazon SNSX
Custom WebhookX
EmailX
Google ChatX
IBM Cloud FunctionsX
IBM Event Notifications(IBM Only)
Microsoft TeamsX
OpsGenieX
PagerDutyX
Prometheus AlertmanagerX
SlackXXX
Sysdig Team EmailX
VictorOpsX
WebhookX

Control Access to Channels

Notification channel management can be fine-tuned by role-based access as follows:

  • Notification channels can be global or limited to a particular team.

  • Global channels can be managed by admins and can be viewed/used by other roles, while team-limited channels are available only to team members.

  • Team Manager , Advanced User, and Service Manager (Secure) roles can create/update/delete team-scoped notification channels. They can also read and use the global ones.

  • Standard and View Only roles can read team-limited and global notification channels.

  • Admins can create global notification channels and migrate channels from “global” to “team-limited”, and also from one team to another.

Add a Notification Channel

To add a new notification channel for alerting:

  1. Log in to Sysdig Monitor or Sysdig Secure as an Admin.

  2. Select Settings from the user menu in the bottom left corner.

    The Settings page appears.

  3. Select Notifications Channels under Outbound Integrations.

    The Notifications main page is displayed:

  4. Select Add Notification Channel.

  5. Follow the channel-specific steps to complete the configuration process.

Share a Notification Channel

When you configure a notification channel, you can choose whether the channel should be Shared With the Current Team you are logged in as, or with All Teams.

Notification channels created by one team cannot be shared with just with one other team. To use a channel created by another team, ensure the channel is Shared With All Teams in the channel configuration.

Edit a Notification Channel

To edit a notification channel:

  1. Log in to Sysdig Monitor or Sysdig Secure as administrator and select Settings.

  2. Select Notification Channels.

  3. Click the target channel.

  4. Make the edits and click Save.

Test a Notification Channel

To test a notification channel:

  1. Log in to Sysdig Monitor or Sysdig Secure as administrator and select Settings.

  2. Select Notification Channels.

  3. Select the three dots next to a created Notification Channel and click Test Channel.

If a notification is not received within 10 minutes, the notification channel is not working, and the configuration should be reviewed.

Report Unsuccessful Notification Attempts

When an unsuccessful notification has been attempted on a given notification channel, Sysdig Events are generated to warn you about it. At the fifth failed notification attempt, the notification channel will be disabled and a corresponding Sysdig Event will be generated. To view the list of Sysdig Events:

  1. Log in to Sysdig Monitor and select Events.

  2. On the Events page, select Sysdig from the All Types drop-down.

Disable a Notification Channel

Sometimes, a notification channel has outlived its use, or must be temporarily disabled due to noise while an underlying issue is investigated.

To temporarily disable a notification channel:

  1. Log in to Sysdig Monitor or Sysdig Secure as administrator.

  2. Select Settings > Notification Channels.

  3. Identify a channel, and toggle the Enabled slider off.

To re-enable the channel, toggle the slider on.

Delete a Notification Channel

  1. Log in to Sysdig Monitor or Sysdig Secure as administrator.

  2. Select Settings > Notification Channels.

  3. Select the three-dot menu icon on the right side of a channel listing.

  4. Select Delete Channel.

Configure an Alert Start-Up Delay (On-Premises Only)

In Sysdig Monitor, alert jobs begin immediately at start-up. However, in instances where Sysdig goes down unexpectedly, or without proper shutdown/startup procedures implemented, data can be missing, triggering alert notifications.

A start-up delay in alert jobs can be configured in on-premises environments, by setting the draios.alerts.startupDelay parameter. The parameter requires a duration value; the example below shows a duration of 10 minutes:

draios.alerts.startupDelay=10m

This parameter can be configured for Kubernetes environments:

  • For Kubernetes environments, add the parameter to the sysdigcloud.jvm.worker.options parameter in the configmap.

For more information on editing the configmap refer to the On-Premises Installation documentation.