Email & Webhooks¶

SentriKat sends alerts when new vulnerabilities match your product inventory. Configure email notifications, webhook integrations, and escalation policies to keep your team informed.

Email Alerts¶

SMTP Configuration¶

Configure SMTP via environment variables in your .env file:

SMTP_HOST=smtp.example.com
SMTP_PORT=587
[email protected]
SMTP_PASSWORD=your-app-password
SMTP_USE_TLS=true
[email protected]
SMTP_FROM_NAME=SentriKat

Restart after changes:

docker compose restart sentrikat

See Configuration for the full list of SMTP variables.

Testing Email¶

Verify your SMTP setup:

docker compose exec sentrikat flask smtp test --to [email protected]

Or from the interface: Settings > Alert Management > Send Test Email.

Alert Types¶

Where alerts are configured¶

Alerts are set per organization, under Alerts. There is no separate rules page.

Each organization has:

• the email addresses that receive its alerts
• an outbound webhook, if you want the alerts in Slack, Teams, Discord or your own endpoint
• which alerts are on

The alert for a vulnerability confirmed as exploited is always on and cannot be switched off.

See Alerts.

Webhooks¶

SentriKat can send real-time notifications to external services via webhooks.

Creating a Webhook¶

1. Go to Settings > Alert Management
2. Click Add Webhook
3. Configure:
4. Name: Descriptive label
5. URL: Endpoint to receive events
6. Events: Select which events trigger the webhook
7. Secret: Optional HMAC signing key for payload verification
8. Click Save

Platform-Specific Setup¶

{
  "text": "New KEV Match: CVE-2024-1234",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*CVE-2024-1234* - Microsoft Windows Privilege Escalation\n*Priority*: Critical | *Due*: 2024-02-15 | *Ransomware*: Yes"
      }
    }
  ]
}

{
  "event": "vulnerability.matched",
  "timestamp": "2024-12-01T12:00:00Z",
  "data": {
    "cve_id": "CVE-2024-1234",
    "vendor": "Microsoft",
    "product": "Windows Server",
    "priority": "critical",
    "due_date": "2024-02-15",
    "ransomware": true,
    "organization": "ACME Corp"
  }
}

Webhook Events¶

Webhook Security¶

When a secret is configured, SentriKat signs each payload with HMAC-SHA256:

X-SentriKat-Signature: sha256=abc123...

Verify the signature on the receiving end:

import hmac, hashlib

def verify_signature(payload, signature, secret):
    expected = "sha256=" + hmac.new(
        secret.encode(), payload, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Escalation Policies¶

Define escalation chains for unacknowledged critical vulnerabilities:

1. Go to Settings > Alert Management, where the escalation policies live on the same page
2. Click Add Policy
3. Define escalation tiers:
4. Tier 1 (immediate): Notify assigned team via email + Slack
5. Tier 2 (after 24h): Notify org admin
6. Tier 3 (after 72h): Notify super admin + all configured webhooks
7. Click Save

Troubleshooting¶

Emails Not Sending¶

# Check SMTP connectivity
docker compose exec sentrikat flask smtp test --to [email protected]

# View mail-related logs
docker compose logs sentrikat | grep -i smtp

Webhook Failures¶

1. Go to Settings > Alert Management
2. Click the webhook name
3. Check the Delivery Log for status codes and error messages
4. Use Redeliver to retry failed deliveries

Next Steps¶

• Configure organizations for per-org alert routing
• Set up LDAP/SSO so alert recipients match directory users
• API webhook configuration for programmatic management