Notifications & Alerts

Purpose: decide where CMDash sends alerts, and what conditions trigger them.

Both of these are top-level pages now, not under Settings — there is no "Settings → Channels" or "Settings → Alert Rules" route.

Notification Channels — /channels

1. Go to Channels.
2. Add a channel of type Slack, Microsoft Teams, Custom Webhook, or Email.
3. For Slack/Teams/Webhook, supply the webhook URL; for Email, one or more recipient addresses (they don't need to be CMDash users).
4. Use Send Test Notification (or the page's equivalent test action) to confirm delivery before relying on a channel.

Who can do this: Owners and Admins.

Alert Rules — /alert-rules

There is no library of named, one-click "predefined templates" (Posture Drop, CVE Spike, MFA Coverage Drop, Compliance Drift, Integration Sync Failure) — that whole model does not match the current page. Instead, you build a rule directly from a fixed set of metrics:

with an operator — Less Than, Greater Than, Equals, or Change By — a numeric threshold, and one or more channels to notify.

Who can do this: Owners and Admins.

If your workflow depended on the named predefined templates, alert deduplication window, or an "Alert History" page described in the earlier version of this guide, verify directly against the live /alert-rules page — none of those specific mechanics could be confirmed in the current source and are not repeated here to avoid re-introducing unverified claims.

Personal notification preferences

Separately, Settings → Notifications is a personal per-user page — email/in-app toggles for your own notifications — not the org-wide channel routing described above. Don't confuse the two when troubleshooting "why didn't I get notified."

Chat apps

Settings → Chat Apps (/settings/chat-apps) is a different thing from the Slack and Teams channels above, and the difference matters when you are deciding which one you want:

• A channel is an outgoing webhook URL. CMDash pushes alerts to it. It cannot be asked anything.
• A chat app is CMDash installed into your workspace. It adds a /cmdash command your team can type, and it can post the daily brief into a channel you choose.

They coexist; installing the app does not disturb any channel you already have.

Connecting Slack

1. Go to Settings → Chat Apps and select Connect a Slack workspace.
2. Approve the permissions on Slack's screen. CMDash asks for the ability to post messages, to read the channel list, and to add a slash command — it does not ask for permission to read your messages.
3. You land back on this page with the workspace listed.

Only an Owner or Admin can connect or disconnect a workspace.

If the page says no Slack app is registered for this deployment, that is the operator's step, not yours: connecting needs a Slack app registration that the operator of your CMDash deployment creates once for everyone on it. The page names the environment variables that are still missing.

Asking CMDash something

• /cmdash posture — today's score, and how it moved since the last snapshot.
• /cmdash risks — the top open risks in the register.
• /cmdash on its own — the list of what it can answer.

Replies are only visible to the person who typed the command. A slash command can be typed in a channel with contractors or customers in it, so CMDash never broadcasts an answer to the channel.

A workspace that is not connected — or one you have disconnected — gets a short "not connected" reply and nothing else. CMDash never guesses which organization an unknown workspace belongs to.

The daily brief in a channel

Set a daily brief channel on a connected workspace and CMDash posts the same morning brief your team receives by email into that channel, once a day. Unlike a command reply, this one is visible to everyone in the channel — that is the point of choosing it, so choose deliberately. Clear the field to stop posting.

If the channel is deleted, or the CMDash bot is removed from it, the selection is cleared automatically and the page shows no channel again, rather than failing silently every morning.

Microsoft Teams

Teams apps are installed from a package your own Teams administrator uploads, so there is no one-click connect. Use Download Teams manifest, add it to a Teams app package, and upload it in the Teams admin centre. The same two questions work there.

Disconnecting

Disconnect stops the workspace answering commands, stops the daily brief posting there, and revokes the stored bot token. Removing the CMDash app from Slack's own side has the same effect — CMDash is told, and marks the connection revoked without you having to do anything here.

Related

• Integrations Management — the sync-failure events these channels can carry.
• API Keys & Webhooks — for delivering events to your own systems instead of Slack/Teams/Email.