Alert Notifications

The alert notification system (scripts/alert_notifier.sh) provides multi-channel alerting triggered by scan results. It supports email, Slack, and generic webhook delivery with configurable thresholds. Shipped in v2.8.

Channels

Email

Sends alert emails using the first available local backend (sendmail, mailx, msmtp, or mail). The recipient is configured via ALERT_EMAIL, falling back to REMINDER_EMAIL when unset.

Slack

Posts a formatted alert message to a Slack channel via an Incoming Webhook URL. Configure with ALERT_SLACK_WEBHOOK.

Generic Webhook

Sends a JSON payload via HTTP POST to any webhook endpoint (PagerDuty, Microsoft Teams, custom integrations, and so on). Configure with ALERT_WEBHOOK_URL.

Threshold Evaluation

Alerts are triggered by configurable conditions:

• Risk score threshold: alert when the session risk score meets or exceeds ALERT_RISK_THRESHOLD (0-100, default 60).
• New critical/high findings: alert when new Critical or High findings appear compared to the prior session. Controlled by ALERT_ON_NEW_CRITICAL (default true).
• Scan completion: notify on any scan completion regardless of results. Controlled by ALERT_ON_SCAN_COMPLETE (default false).

CLI Usage

alert_notifier.sh [options]

Options:
  -s, --session <json>    Session JSON file
  -c, --config <file>     Config file with ALERT_* settings
  --latest                Use the most recent session
  --test                  Send a test alert to all configured channels
  --dry-run               Show what would be sent without sending
  -h, --help              Show help

Provide either -s/--session <json> or --latest to select the session to evaluate.

Examples

# Send alerts for the latest session
./scripts/alert_notifier.sh --latest -c ~/netvuln-tool/configs/acme_corp.conf

# Test all configured channels
./scripts/alert_notifier.sh --test -c ~/netvuln-tool/configs/acme_corp.conf

# Preview without sending
./scripts/alert_notifier.sh --latest -c ~/netvuln-tool/configs/acme_corp.conf --dry-run

Configuration

Add these to your engagement config file. The full config reference is in Report Configuration.

Variable	Default	Description
ALERT_ENABLED	false	Enable threshold-based alerting after scans
ALERT_RISK_THRESHOLD	60	Risk score threshold to trigger an alert (0-100)
ALERT_ON_NEW_CRITICAL	true	Alert on new Critical/High findings vs the prior scan
ALERT_ON_SCAN_COMPLETE	false	Notify on any scan completion
ALERT_EMAIL		Email for alerts (falls back to REMINDER_EMAIL)
ALERT_SLACK_WEBHOOK		Slack Incoming Webhook URL
ALERT_WEBHOOK_URL		Generic webhook URL (PagerDuty, Teams, etc.)

Alert Data Capture

The nv_capture_alert_results() function persists alert data back into the session JSON after alerts are sent. The captured data includes which channels were notified, which thresholds triggered, the delivery timestamp, and per-channel delivery status.

The portal extracts this alert summary during upload and displays it as badges in the collect dashboard. The extraction contract is documented in API Contract.

Pipeline Integration

When ALERT_ENABLED="true" is set in the config file, the pipeline runs alert_notifier.sh automatically after report generation, as a post-report hook. Alerts are evaluated and sent as the final step before session upload.

Alerts can also be triggered independently for existing sessions using the CLI above, which pairs well with scheduled scans. See Scheduling and Session Management.

WARNING

The webhook payload schema is a cross-project interface shared with the portal and any downstream consumers. When changing it, update both alert_notifier.sh and the consumer handler, and check the payload table in API Contract.