Alert Notifications permissions ↗

Abstract

Configure Alert Notifications (under Configurations).

Controls access to configure notification rules, templates, and external integration forwarding.:

  • Configurations: Manage rules through Settings → Configuration → General → Notifications: Includes main notification rules and user notifications.

  • External forwarding: Configure through Settings → Configuration → Integrations → External Applications.

Caution

Configuring alert notifications requires underlying infrastructure. If forwarding notifications via Syslog, users need access to the Broker Service. For Slack or Email, users need access to the Integrations permissions.

Permission

Description

Roles Example

None

No access to notification configuration.

  • SOC Tier-1 or SOC Tier-2 Analyst: Typically don't need to configure notifications or check notification forwarding destinations.

  • Threat Hunter: Notification configuration is not typically part of threat hunting.

View

Read-only access to notification settings.

  • SOC Tier-3 Analyst: May review notification forwarding.

View/Edit

Full access to create, modify, and delete notification forwarding.

Security Engineer: Often responsible for configuring notification integrations.