Notifications

The notification settings in StepSecurity let you receive alerts about critical security events by email, Slack, or Microsoft Teams. These notifications keep you informed about potential security risks in your pipelines and in the tokens that hold access to your organization.

To reach this page: open the sidebar and go to Settings > Notifications.

Notification Channels

Enter your email address, or provide a Slack or Teams webhook URL, to receive alerts. Follow these instructions to create a Slack webhook or a Teams webhook.

Notification Events

Select the security events you want to be notified about. Events are grouped by the product area that raises them.

Only one notification is sent per pipeline. A repeated event on the same pipeline is not sent again.

Token events are sent once, when a token starts breaching a policy. They also require the matching control to be switched on under Control Evaluation. If the control is off, selecting the event here has no effect.

Harden Runner

These events fire when Harden-Runner observes something during a pipeline run. Each one corresponds to a detection type described in Detections.

• Notify when new endpoint is discovered: the job called an outbound endpoint that is not in its baseline
• Notify when file overwrites are detected: a source code file was overwritten during the run
• Notify when outbound connections are detected: outbound network connections were observed during the run

PAT Governance

These events fire when a Personal Access Token starts violating your PAT Governance policy, or is nearing expiration. Each one is tied to a control, and the thresholds that decide when it fires are set under Control Evaluation.

Event	Fires when	Control
Notify when a token is issued for longer than the allowed lifetime	A token is issued for longer than its limit, or is already older than it	Tokens Should Be Rotated Within Max Age
Notify when a token holds high privilege scopes	A token holds a scope Microsoft rates high privilege, or grants full access	Tokens Should Have Minimum Scopes
Notify when a token has not been used recently	A token sits idle past its limit	Tokens Should Be Actively Used
Notify when a token's owner is deactivated or removed	A token's owner is deactivated in the directory or removed from the organization	Tokens Should Belong To Active Users
Remind before a token expires, at 30, 7 and 1 days	A token is approaching its expiration date, at each configured reminder band	Tokens Should Be Rotated Within Max Age

The reminder bands shown on the last event reflect the Remind at value set under Control Evaluation. Change that value to change when reminders are sent.

Preview

The Preview panel shows the message your organization would receive, based on the events you have selected. It updates as you change the selection, and shows a prompt to select an event while none are selected.

StepSecurity sends one grouped message per organization per scan, to whichever channels are configured above. Only the events you have selected appear in it.

Saving Your Preferences

Once you have configured the notification settings, select Save to apply your changes.