> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/administration/admin-console/settings/notifications.md).

# Notifications

Tenant-level notification settings control how your tenant is alerted when StepSecurity threat intelligence flags a compromised component, and when Dev Machine Guard detects new or suspicious assets on your enrolled developer machines.

Notifications are organized into **notification profiles**. Each profile sends the events selected on it to its own destinations. Profiles configured here apply tenant-wide, across every organization connected to the tenant.

Dev Machine Guard events are configured here only. For notification settings scoped to a single organization, including Harden-Runner detections, GitHub Checks results, and workflow run policies, see Notifications under Organization Settings.

#### Accessing tenant notification settings

1. Open the StepSecurity dashboard and click **Back to Dashboard** if you are inside an organization view.
2. In the Admin console left menu, expand **Settings**.
3. Click **Notifications**.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FvDb9dCfV7cnz97kIBiqy%2FScreenshot%202026-10-12%20at%2012.02.50.png?alt=media&amp;token=6351d5c1-1c4c-4fe2-b2fa-5c66aabb1a76" alt=""><figcaption></figcaption></figure>

### Notification profiles

The **Notification Profiles** page lists every profile in your tenant. Each profile card shows its configured destinations and the events selected on it. Click a profile card to expand it and edit its settings.

{% hint style="info" %}
Azure DevOps and GitLab notifications use the default profile.
{% endhint %}

**Default profile**

Every tenant has a **Default profile**. The default profile can hold email, Slack, and Microsoft Teams destinations at the same time.

**Adding a profile**

{% hint style="info" %}
You can create up to 20 notification profiles.
{% endhint %}

1. Click **Add Notification Profile**.
2. Select the profile type: **Email**, **Slack**, or **Microsoft Teams**.
3. Expand the new profile. It shows **Not configured** and **No events selected** until you add a destination and select events.
4. Enter a **Name** for the profile. The name defaults to the profile type.
5. Enter the destination for the profile type. See Destinations.
6. Select the events this profile sends. See Notification Events.
7. Click **Save**.

**Deleting a profile**

To remove a profile you added, click the delete icon on its card.

### Destinations

| Field                 | Description                                                                                                                                                                                                                    |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Email**             | One or more email addresses, separated by commas, up to a maximum of 49 addresses.                                                                                                                                             |
| **Slack Webhook URL** | Slack incoming webhook, in the form `https://hooks.slack.com/services/...`. [Follow these instructions](https://docs.slack.dev/messaging/sending-messages-using-incoming-webhooks/) to create a Slack webhook.                 |
| **Teams Webhook URL** | Microsoft Teams incoming webhook. [Follow these instructions](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=newteams%2Cdotnet) to create a Teams webhook. |

The default profile shows all three fields. A profile you add shows the field for its type.

### Notification Events

Each profile has its own list of events. Select the events that send a notification to that profile's destinations. Events are grouped below by the product area that raises them.

{% hint style="info" %}
Dev Machine Guard notifications are sent per device. Each device that reports a matching detection raises its own notification, and detections are not aggregated into a single fleet-wide summary.
{% endhint %}

#### **Threat intelligence**

* Notify when StepSecurity threat intel flags a compromised component

Select this event to get notified about components flagged by StepSecurity threat intel.

Threat intel notifications cover the same incidents surfaced in the [Threat Center](/workspace/threat-center.md). Each incident identifies the compromised packages or Actions involved and the recommended remediation steps.

**Choosing threat intel notification granularity**

Once the event is enabled, open the **Threat intel notifications** dialog to choose when this tenant is notified:

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FjFe4iR8UkJ2THquCYYES%2FScreenshot%202026-08-05%20at%2000.36.52.png?alt=media&amp;token=972dfacc-7312-46a1-a032-d1c398f07a0f" alt=""><figcaption></figcaption></figure>

| Option                         | Behavior                                                                                            |
| ------------------------------ | --------------------------------------------------------------------------------------------------- |
| **All threat intel incidents** | Notify about every threat intel incident, whether or not this tenant is affected.                   |
| **Affected packages**          | Notify only when this tenant is affected by a compromised package, matched by name, at any version. |
| **Exact version only**         | Notify only when this tenant has the exact compromised version installed.                           |

Choose **All threat intel incidents** if your security team tracks ecosystem-wide threats regardless of exposure. Choose **Affected packages** or **Exact version only** to reduce alert volume to incidents that touch your own dependencies, with **Exact version only** producing the narrowest set of alerts.

Click **Done** to confirm your selection.

#### **Dev Machine Guard**

These events fire when Dev Machine Guard reports an asset on an enrolled developer machine that it has not previously recorded for that device, or when it flags a change to a package manager configuration on that device.

| Event                                                                                             | Raised when a device reports                                                                 |
| ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Notify when Dev Machine Guard detects a new IDE on your device fleet                              | An IDE that has not previously been recorded for that device                                 |
| Notify when Dev Machine Guard detects a new IDE extension on your device fleet                    | An IDE extension or plugin that has not previously been recorded for that device             |
| Notify when Dev Machine Guard detects a new AI agent on your device fleet                         | An AI coding tool, CLI agent, or local model runtime not previously recorded for that device |
| Notify when Dev Machine Guard detects a new MCP server on your device fleet                       | An MCP server configuration that has not previously been recorded for that device            |
| Notify when Dev Machine Guard detects a new agent skill on your device fleet                      | An agent skill that has not previously been recorded for that device                         |
| Notify when Dev Machine Guard detects a new agent plugin on your device fleet                     | An agent plugin newly recorded on that device after its initial baseline                     |
| Notify when Dev Machine Guard detects a suspicious file on your device fleet                      | A file matching a StepSecurity malicious-file detection rule                                 |
| Notify when Dev Machine Guard detects a package manager configuration change on your device fleet | A change to an audited package manager configuration file                                    |

{% hint style="info" %}
**Agent plugins:** The first observation establishes a baseline. Plugins already present at that point do not generate new-plugin notifications. Agent plugin inventory requires Dev Machine Guard agent v1.17.0 or later. See [Agent Plugins](/developer-machines/ide-and-ai-agents/agent-plugins.md).
{% endhint %}

**Where to investigate**

Each event has a corresponding inventory page in the Developer Machines section:

* IDE extensions: IDE Extensions
* AI agents: Coding Tools
* MCP servers: MCP Servers
* Agent skills: Agent Skills
* Agent plugins: Agent Plugins
* Suspicious files: Suspicious Files
* Package manager configuration: Package Configs

To see the full asset inventory for the machine that raised a notification, open it in Devices.

#### Saving your changes

Click **Save** to apply your channel and event configuration. Changes take effect for incidents raised after saving.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stepsecurity.io/administration/admin-console/settings/notifications.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.