> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Notifications (routes & channels)

> Send alerts, AI investigation results and assignment events to email, Teams, Shuffle or a webhook.

# Notifications (routes & channels)

CoPilot sends a message when something happens — a new alert lands, an AI investigation finishes, an analyst is assigned a case. You choose the **trigger**, the **severity floor**, the **channel**, and optionally the **message template**.

Four channels ship today:

| Channel             | Delivers to                                        |
| ------------------- | -------------------------------------------------- |
| **Email (Resend)**  | Fixed addresses, or whoever an item is assigned to |
| **Microsoft Teams** | A Teams channel, via a Workflows webhook           |
| **Shuffle**         | An app in the customer's Shuffle org               |
| **Webhook**         | Any HTTPS endpoint                                 |

## Where to configure it

**Per-customer routes** — *Customers → (customer) → Notifications*

Things the customer should know about: an alert was raised, an investigation concluded.

**Internal routes** — *Notifications → Internal Routes* (admin only)

Things your SOC should know about: who picked up which alert. These belong to no customer, which is the point — assigning an ACME alert to an analyst notifies your team, never ACME.

**Message templates** — *Notifications → Message Templates* (admin only)

Reusable message bodies shared across routes. Seven built-ins ship as working starting points; duplicate one to get an editable copy.

## The two things that catch people

**An alert being created and its AI investigation finishing are different triggers**, minutes apart. A route set to *An alert is created* will never fire when the investigation completes — and AI content only rides the second event. If you want the report, you need a route with the *An AI investigation completes* trigger. Nothing reports an error when no route matches; it just stays quiet.

**Assignment notifications are internal by design.** They only reach internal routes. A customer route with an assignment trigger could never fire, so the interface doesn't offer that combination.

If you want the assignee emailed directly, use the **Email (Resend)** channel with *Deliver to → Whoever it's assigned to*. It's the only channel that can address a person; a webhook targets a URL and Teams targets a channel.

## Sending one item on demand

Open any alert or case and choose **Send to channel…** to push it to a configured route immediately, bypassing the trigger and severity filters. Alerts can carry their AI investigation report. Customer-facing targets are admin-only.

## Testing

Every saved route has a **Send test** button. It sends a real notification through the real path, so it consumes quota and appears in the dispatch log like any other.

For Teams, look at the channel afterwards rather than trusting the result. A malformed payload returns `200 OK` and displays nothing.

## Read the full guide

* **Notifications (Admin/Operator)**: ../notifications.md — worked route examples, setup for each channel, quota management, message templates, and troubleshooting

## Related pages

* Alerting → Shuffle (legacy notification workflows): ./alerting-shuffle.md
* Connectors (verify the Resend connector): ./connectors.md
* Customers: ./customers.md