Skip to main content

​
Notifications (routes & channels)

CoPilot sends a message when something happens — a new alert lands, an AI investigation finishes, an analyst is assigned a case. You choose the trigger, the severity floor, the channel, and optionally the message template. Four channels ship today:

​
Where to configure it

Per-customer routes — Customers → (customer) → Notifications Things the customer should know about: an alert was raised, an investigation concluded. Internal routes — Notifications → Internal Routes (admin only) Things your SOC should know about: who picked up which alert. These belong to no customer, which is the point — assigning an ACME alert to an analyst notifies your team, never ACME. Message templates — Notifications → Message Templates (admin only) Reusable message bodies shared across routes. Seven built-ins ship as working starting points; duplicate one to get an editable copy.

​
The two things that catch people

An alert being created and its AI investigation finishing are different triggers, minutes apart. A route set to An alert is created will never fire when the investigation completes — and AI content only rides the second event. If you want the report, you need a route with the An AI investigation completes trigger. Nothing reports an error when no route matches; it just stays quiet. Assignment notifications are internal by design. They only reach internal routes. A customer route with an assignment trigger could never fire, so the interface doesn’t offer that combination. If you want the assignee emailed directly, use the Email (Resend) channel with Deliver to → Whoever it’s assigned to. It’s the only channel that can address a person; a webhook targets a URL and Teams targets a channel.

​
Sending one item on demand

Open any alert or case and choose Send to channel… to push it to a configured route immediately, bypassing the trigger and severity filters. Alerts can carry their AI investigation report. Customer-facing targets are admin-only.

​
Testing

Every saved route has a Send test button. It sends a real notification through the real path, so it consumes quota and appears in the dispatch log like any other. For Teams, look at the channel afterwards rather than trusting the result. A malformed payload returns 200 OK and displays nothing.

​
Read the full guide

  • Notifications (Admin/Operator): ../notifications.md — worked route examples, setup for each channel, quota management, message templates, and troubleshooting
  • Alerting → Shuffle (legacy notification workflows): ./alerting-shuffle.md
  • Connectors (verify the Resend connector): ./connectors.md
  • Customers: ./customers.md