Email & Webhooks¶

SentriKat sends alerts when new vulnerabilities match your product inventory. Configure email notifications, webhook integrations, and escalation policies to keep your team informed.

Email Alerts¶

SMTP Configuration (on-premises)¶

Configure SMTP via environment variables in your .env file:

SMTP_HOST=smtp.example.com
SMTP_PORT=587
[email protected]
SMTP_PASSWORD=your-app-password
SMTP_USE_TLS=true
[email protected]
SMTP_FROM_NAME=SentriKat

Apply the changes:

docker compose up -d

docker compose restart does not reread .env, so the new values would not apply.

See Configuration for the full list of SMTP variables.

Testing Email¶

Verify your SMTP setup:

docker compose exec sentrikat flask smtp test --to [email protected]

Or from the interface: Settings > Alert Management > Send Test Email.

Alert Types¶

Where alerts are configured¶

Alerts are set per organization, under Alerts. There is no separate rules page.

Each organization has:

• the email addresses that receive its alerts
• an outbound webhook, if you want the alerts in Slack, Teams, Discord or your own endpoint
• which alerts are on

The alert for a vulnerability confirmed as exploited is always on and cannot be switched off.

See Alerts.

Webhooks¶

SentriKat can send real-time notifications to external services via webhooks.

Creating a Webhook¶

Webhooks are set per organization (see Alerts):

1. Go to Management > Organizations
2. Open the organization for editing and select the Webhook tab
3. Choose the Type (Slack, Teams, Discord or custom) and enter the URL of the endpoint that receives the alerts
4. Test and save

Platform-Specific Setup¶

{
  "text": "New KEV Match: CVE-2024-1234",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*CVE-2024-1234* - Microsoft Windows Privilege Escalation\n*Priority*: Critical | *Due*: 2024-02-15 | *Ransomware*: Yes"
      }
    }
  ]
}

{
  "event": "vulnerability.matched",
  "timestamp": "2024-12-01T12:00:00Z",
  "data": {
    "cve_id": "CVE-2024-1234",
    "vendor": "Microsoft",
    "product": "Windows Server",
    "priority": "critical",
    "due_date": "2024-02-15",
    "ransomware": true,
    "organization": "ACME Corp"
  }
}

Webhook Events¶

Webhook Security¶

When a secret is configured, SentriKat signs each payload with HMAC-SHA256:

X-SentriKat-Signature: sha256=abc123...

Verify the signature on the receiving end:

import hmac, hashlib

def verify_signature(payload, signature, secret):
    expected = "sha256=" + hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Escalation Policies¶

Define escalation chains for unacknowledged critical vulnerabilities:

1. Go to Settings > Alert Management, where the escalation policies live on the same page
2. Click Add Policy
3. Define escalation tiers:
4. Tier 1 (immediate): Notify assigned team via email + Slack
5. Tier 2 (after 24h): Notify org admin
6. Tier 3 (after 72h): Notify super admin + all configured webhooks
7. Click Save

Troubleshooting¶

Emails Not Sending¶

# Check SMTP connectivity
docker compose exec sentrikat flask smtp test --to [email protected]

# View mail-related logs
docker compose logs sentrikat | grep -i smtp

Webhook Failures¶

1. Open the Alerts page, which lists what was sent, when, and whether it was delivered
2. Check the webhook URL in the organization's Webhook tab and use the test button
3. Make sure the receiving endpoint is reachable from the SentriKat server

Next Steps¶

• Configure organizations for per-org alert routing
• Set up LDAP/SSO so alert recipients match directory users
• API webhook configuration for programmatic management