> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/administration/admin-console/settings/notifications.md).
# Notifications
Tenant-level notification settings control how your tenant is alerted when StepSecurity threat intelligence flags a compromised component, and when Dev Machine Guard detects new or suspicious assets on your enrolled developer machines.
Channels configured here apply tenant-wide, across every organization connected to the tenant.
Dev Machine Guard events are configured here only. For notification settings scoped to a single organization, including Harden-Runner detections, GitHub Checks results, and workflow run policies, see [Notifications](/workspace/settings/notifications.md) under Organization Settings.
### Accessing tenant notification settings
1. Open the StepSecurity dashboard and click **Back to Dashboard** if you are inside an organization view.
2. In the Admin console left menu, expand **Settings**.
3. Click **Notifications**.
### Notification Channels
These are the tenant-wide channels used for every event listed under Notification Events. Configure one or more of the following:
| Field | Description |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Email** | Email address that receives threat intel notifications. |
| **Slack Webhook URL** | Slack incoming webhook, in the form `https://hooks.slack.com/services/...`. [Follow these instructions](https://docs.slack.dev/messaging/sending-messages-using-incoming-webhooks/) to create a Slack webhook. |
| **Teams Webhook URL** | Microsoft Teams incoming webhook. [Follow these instructions](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=newteams%2Cdotnet) to create a Teams webhook. |
### Notification Events
Under **Notification Events**, select the events that send a notification to the channels above. Events are grouped below by the product area that raises them.
{% hint style="info" %}
Dev Machine Guard notifications are sent per device. Each device that reports a matching detection raises its own notification, and detections are not aggregated into a single fleet-wide summary.
{% endhint %}
#### **Threat intelligence**
* Notify when StepSecurity threat intel flags a compromised component
Select this event to get notified about components flagged by StepSecurity threat intel.
Threat intel notifications cover the same incidents surfaced in the [Threat Center](/workspace/threat-center.md). Each incident identifies the compromised packages or Actions involved and the recommended remediation steps.
**Choosing threat intel notification granularity**
Once the event is enabled, open the **Threat intel notifications** dialog to choose when this tenant is notified:
| Option | Behavior |
| ------------------------------ | --------------------------------------------------------------------------------------------------- |
| **All threat intel incidents** | Notify about every threat intel incident, whether or not this tenant is affected. |
| **Affected packages** | Notify only when this tenant is affected by a compromised package, matched by name, at any version. |
| **Exact version only** | Notify only when this tenant has the exact compromised version installed. |
Choose **All threat intel incidents** if your security team tracks ecosystem-wide threats regardless of exposure. Choose **Affected packages** or **Exact version only** to reduce alert volume to incidents that touch your own dependencies, with **Exact version only** producing the narrowest set of alerts.
Click **Done** to confirm your selection.
#### **Dev Machine Guard**
These events fire when Dev Machine Guard reports an asset on an enrolled developer machine that it has not previously recorded for that device, or when it flags a change to a package manager configuration on that device.
| Event | Raised when a device reports |
| ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Notify when Dev Machine Guard detects a new IDE on your device fleet | An IDE that has not previously been recorded for that device |
| Notify when Dev Machine Guard detects a new IDE extension on your device fleet | An IDE extension or plugin that has not previously been recorded for that device |
| Notify when Dev Machine Guard detects a new AI agent on your device fleet | An AI coding tool, CLI agent, or local model runtime not previously recorded for that device |
| Notify when Dev Machine Guard detects a new MCP server on your device fleet | An MCP server configuration that has not previously been recorded for that device |
| Notify when Dev Machine Guard detects a new agent skill on your device fleet | An agent skill that has not previously been recorded for that device |
| Notify when Dev Machine Guard detects a suspicious file on your device fleet | A file matching a StepSecurity malicious-file detection rule |
| Notify when Dev Machine Guard detects a package manager configuration change on your device fleet | A change to an audited package manager configuration file |
**Where to investigate**
Each event has a corresponding inventory page in the Developer Machines section:
* IDE extensions: IDE Extensions
* AI agents: Coding Tools
* MCP servers: MCP Servers
* Agent skills: Agent Skills
* Suspicious files: Suspicious Files
* Package manager configuration: Package Configs
To see the full asset inventory for the machine that raised a notification, open it in Devices.
#### Saving your changes
Click **Save** to apply your channel and event configuration. Changes take effect for incidents raised after saving.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/administration/admin-console/settings/notifications.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
