> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scaliocloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Email and Webhook Notifications in Scalio Nexus

> Set up email and webhook notifications in Scalio Nexus to stay informed about new security findings, access review deadlines, and automation rule activity.

Nexus can notify your team when important events happen — new high-severity findings are detected, access reviews are about to expire, or automation rules take action. The sooner your team knows about a critical finding, the sooner they can investigate and remediate it. Configure all notification preferences in **Settings > Notifications**.

## Notification channels

Nexus supports two notification channels, which you can use independently or together:

<CardGroup cols={2}>
  <Card title="Email" icon="envelope">
    Nexus sends notifications directly to individual users or distribution lists. No additional integration setup is required — just enter the recipient addresses and toggle on the events you care about.
  </Card>

  <Card title="Webhooks" icon="webhook">
    Nexus POSTs a JSON payload to any URL you specify. Use webhooks to route alerts to Slack, Microsoft Teams, PagerDuty, or any custom endpoint in your environment.
  </Card>
</CardGroup>

## Email notifications

Email notifications keep individuals and distribution lists informed without requiring them to log in to Nexus. The following notification types are available:

| Notification Type             | When It's Sent                                                                                            |
| ----------------------------- | --------------------------------------------------------------------------------------------------------- |
| **New high-severity finding** | Immediately when a Critical or High severity finding is created in any connected tenant                   |
| **Access review reminders**   | Sent to assigned reviewers 7 days, 3 days, and 1 day before a review's expiration deadline                |
| **Access review summary**     | Sent to the review creator when a review closes, summarizing decisions made and items left unresolved     |
| **Automation rule actions**   | A daily digest listing every action taken by your automation rules in the past 24 hours                   |
| **Weekly posture summary**    | A weekly email showing your posture score trend, top open findings, and a comparison to the previous week |

**To configure email notifications:**

<Steps>
  <Step title="Open the Email notifications page">
    Go to **Settings > Notifications > Email**.
  </Step>

  <Step title="Enable the event types you need">
    Toggle on each event type you want to receive notifications for.
  </Step>

  <Step title="Add recipient addresses">
    Enter one or more email addresses in the field below each event type. You can use individual addresses or a distribution list address.
  </Step>

  <Step title="Save your changes">
    Click **Save** to apply your configuration.
  </Step>
</Steps>

Each event type supports its own recipient list, so you can send high-severity finding alerts to your security on-call list while routing weekly posture summaries to your leadership team.

## Webhook notifications

Webhooks let you push Nexus events into any system that can receive an HTTP POST request. This is the recommended approach for real-time alerting in tools like Slack or Microsoft Teams.

<Steps>
  <Step title="Open the Webhooks settings page">
    Go to **Settings > Notifications > Webhooks** and click **New Webhook**.
  </Step>

  <Step title="Enter the destination URL">
    Paste the full URL of the endpoint that should receive the webhook payloads. For Slack, this is your Incoming Webhook URL. For Microsoft Teams, use your Teams channel's workflow webhook URL. For custom endpoints, make sure the URL is publicly reachable over HTTPS.
  </Step>

  <Step title="Select trigger events">
    Choose which event types should trigger this webhook. You can select one event type or multiple — the same event types available for email notifications apply here. A single webhook URL can listen for as many event types as you need.
  </Step>

  <Step title="Add a signing secret (optional)">
    If your receiving endpoint supports payload verification, enter a secret string in the **Signing Secret** field. Nexus will sign every payload using **HMAC-SHA256** and include the signature in the `X-Nexus-Signature` request header. Your endpoint can use this to confirm the payload genuinely came from Nexus and hasn't been tampered with.
  </Step>

  <Step title="Save and verify the connection">
    Click **Save**. Nexus immediately sends a test ping to the destination URL to verify it's reachable. If the ping succeeds, the webhook status shows **Active**. If it fails, check that the URL is correct, publicly accessible, and returns a `2xx` HTTP response.
  </Step>
</Steps>

## Webhook payload format

Every webhook event Nexus sends follows the same JSON envelope structure. The `event` field identifies the type of event, and the remaining fields provide context specific to that event type. Below is an example payload for a new high-severity finding:

```json theme={null}
{
  "event": "finding.created",
  "timestamp": "2024-11-01T14:32:00Z",
  "tenant_id": "contoso.com",
  "finding": {
    "id": "find_abc123",
    "category": "Privileged Access",
    "severity": "High",
    "title": "Standing Global Administrator assignment detected",
    "affected_count": 3
  }
}
```

All timestamps are in **ISO 8601 format (UTC)**. The `tenant_id` field contains the primary domain of the Entra tenant where the event originated, which is useful when you have multiple tenants connected to Nexus and want to route alerts to tenant-specific channels. Refer to the [Nexus Settings documentation](/nexus/settings) for additional configuration options.

<Tip>
  Use webhooks to send Nexus alerts directly to your Microsoft Teams channel or Slack workspace for real-time visibility. Combine the **New high-severity finding** webhook with a dedicated `#security-alerts` channel so your team can triage findings without switching tools.
</Tip>