Notifications and Jira
Notification destinations live in Workspace Settings > Notifications. Adding, editing or testing a destination is on the Team plan and up.
Channels
| Channel | What it does |
|---|---|
| Slack | Posts to a Slack channel through an incoming webhook. |
| Microsoft Teams | Posts an Adaptive Card to a Teams channel through a Workflows webhook. |
| Emails scan summaries and alerts to members or addresses you list, sent through your own SMTP server. | |
| Webhook | Sends signed JSON events to your own endpoint, or to an automation tool. |
| Jira | Opens one Jira ticket per issue, never a duplicate: later scans comment on it. |
| PagerDuty | Pages the on-call team for new Critical issues and Critical suspicious activity, one incident per issue. |
| Google Chat | Posts to a Google Chat space through an incoming webhook. |
| Discord | Posts to a Discord channel through a webhook. |
ServiceNow and SIEM destinations are not available yet.
Each destination picks the events it receives and a minimum severity.
Events
| Event | When |
|---|---|
| Scan Finished | After every scan: open, new, no longer reported and reopened issues. |
| Scan Failed | A scan failed, with the reason and what to do. |
| New Critical Issue | A scan finds a new Critical issue. |
| Issue Reopened | A fixed or closed issue is reported again. |
| Approval Requested | A suppression, accepted risk or rule change waits for an approver. |
| Issue Assigned | An issue was assigned to a member, by a person or by an auto-assign rule. |
| Issue Due Soon | An open issue reaches its fix deadline within a few days (3 by default). |
| Accepted Risk Expiring | An accepted risk reaches its expiry date within a few days (7 by default). |
| Weekly Digest | One summary a week of open, new and overdue issues. |
| Quality Gate Failed | A scan of a repository's default branch failed its quality gate. |
| New Vulnerability in a Dependency | The daily check found a newly published advisory that affects a package version a tracked branch uses, between scans. |
| Repository Stopped Working | The git host refused the repository's token or could not be reached. |
| Security Changes Found | Salesforce: the changes since the last scan that nobody accepted yet. |
| Daily Changes Digest | Salesforce: one summary each morning of the last day's changes. |
| Suspicious Activity Detected | Salesforce: threat detection from the org's event logs found activity to investigate. |
| Connection Expiring, Connection Stopped Working | Salesforce: an org connection is about to expire or no longer works. |
Jira and PagerDuty take a subset of these events.
Signed webhooks
Every webhook delivery is signed with HMAC-SHA256 over <timestamp>.<body>,
sent as X-Vulkro-Signature: t=<unix time>,v1=<hex>, with an
X-Vulkro-Event-Id header so your endpoint can drop a repeated delivery.
Check the signature and the timestamp before you trust the body.
Email through your own SMTP server
The Email destination sends through the SMTP server you configure on it. Scheduled reports and evidence packs (see Reports and evidence) use the mail server of the workspace's first enabled Email destination. With no Email destination, no scheduled email is sent.
Jira
Connect Jira
Add a Jira destination with your Jira Cloud site address, the project key, the issue type, the Atlassian account email and an API token. If you change the site or the account later, paste the token again.
Create tickets
- Create Jira Ticket on one issue, or Create Jira Tickets from the Issues list for up to 50 issues at once, with a preview first.
- An issue never gets a second ticket: later scans add a comment to the existing one.
Creating tickets needs the right to submit triage, and the Team plan and up.
Field mapping
In the Jira destination, Field Mapping sets:
- the Jira priority for each severity,
- labels and components,
- the assignee (none, the issue's assignee, or the issue's owner),
- custom fields, and
- the description, from a template with placeholders.
Status from Jira
Every 15 minutes, Vulkro Cloud reads the status of each ticket it opened. When a ticket is done, the issue moves to Ready to Close for a person to confirm. Vulkro Cloud never closes an issue just because its ticket closed: the next scan, or a person, does that.