Alerts & notifications¶
CertIntel can push certificate and security events to a webhook destination as they happen, instead of relying on someone checking the dashboard. Configure destinations on the Alerts page, per organization or tenant-wide.
Destination kinds¶
| Kind | Payload shape |
|---|---|
| Generic webhook | A plain JSON POST in CertIntel's own schema - the default choice for custom automation. |
| Slack | Slack's native incoming-webhook message format. |
| Discord | Discord's native incoming-webhook message format. |
| Microsoft Teams | An Adaptive Card, for Teams' incoming webhook connector. |
| A plain email to the addresses you configure. | |
| Pushover | Pushover's push-notification API. |
| ntfy | A topic on ntfy or a self-hosted instance. |
A generic webhook destination can still request one of the platform-specific payload formats (Slack, Discord, Teams) independent of its own kind - useful for feeding a custom automation that expects one of those shapes without registering as that platform's own channel kind.
Events¶
Each destination subscribes to one or more event types (up to five):
| Event | Fires on |
|---|---|
certificate.expiry |
A certificate crossing an expiry warning threshold |
monitor.failure |
A public endpoint monitor failing its check |
renewal.success |
A successful ACME renewal |
renewal.failure |
A failed ACME renewal |
auth.warning |
Failed sign-ins and other security warnings - the same events that populate the platform's "rejected requests" tracking |
Rate limiting a noisy destination¶
Each destination has an optional minimum interval (5 minutes to 30 days) between deliveries, so a flapping monitor or a burst of renewal failures doesn't turn into a flood of notifications. The most recent event within the window still gets recorded in the activity log even when delivery itself is throttled.
Delivery status¶
A destination's row shows its last attempt, last success, and last failure (with a failure class) so you can tell a genuinely broken webhook URL from a destination that simply hasn't fired yet. Use Send test to verify a new destination end to end before relying on it.
Security note¶
A webhook URL is a secret in its own right - anyone who has it can potentially see that your certificates are about to expire, or (for some destination kinds) receive messages formatted to look like they came from your CertIntel deployment. Treat a destination URL with the same care as an API key.