Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Nightfall sends alerts in real time to the channels or platforms you configure. You can configure the following alerts:
Supported.
Alert messages are sent each time an action is taken on a violation.
Alert channels can only be from within a workspace.
Cannot reuse alert channels across different integrations.
Cannot select existing channels for alerts.
Supported.
Individual emails are sent for each alert and for each action taken on a violation.
Can initiate remediation actions via email alerts.
Supported.
To configure alerts,
Click Edit in Settings.
Learn how to configure Nightfall for Github to receive alerts as Jira tickets.
Nightfall for Github is integrated with Jira, and it enables you to receive an alert as a Jira ticket. You can configure to receive alerts as Jira tickets, and assign them to project.
Note: You must have an active Jira instance for this feature to work.
To configure Jira tickets
Click Jira Ticket.
Select a Project and Issue Type. Enter any comments if required.
Click Save Changes.
You can use a alert notification message that is in line with your organization's policies.
Click Save Changes.
Nightfall sends alerts whenever a violation is detected.
Enter the Slack channel where you to want to receive the alert notification. To use Slack as an alert platform, you must first set up a Slack alert platform. You can refer to this document to learn more about how to do this.
Nightfall automatically creates a channel for Slack alerts in Confluence - #confluence-alerts.
Click Save to configure the Slack channel.
You can learn more about the metadata that is sent with alerts in slack channel here.
Nightfall sends alerts whenever a violation is captured. To send the alert notification to an email, enter the email address.
Click Save to configure the email for Confluence alerts over email.
If you are managing your security workflow in a tool other than Slack, you can configure to receive alerts there through a webhook integration. Webhook alerts enable you to funnel Nightfall alerts to a SIEM, which enables logging for compliance purposes.
To configure alerts to a webhook,
Click Change. A pop-up displays.
Enter the destination URL of your SIEM or HTTP even collector.
Click Save to configure the webhook to send alerts for violations in Confluence.
The table below describes the metadata that is captured in each alert:
Findings
Where
Ticket - Title and number
Fields - Field name
Project - Project name
Project type
When
Timestamp
Detection rules
Policies violated
Who
User name
Link to the violations dashboard in console
Event - Created, Edited
Finding snippets
Remediation actions
Findings
Where
Ticket - Title and number
Fields - Field name
Project - Project name
Project type
When
Timestamp
Detection rules
Policies violated
Who
User name
Event - Created, Edited
Finding snippets
No remediation actions
Detection rule link
Detection rule violated
Permalink
violation link
Violation time
Integration metadata
Findings
See
