Alerts & the weekly digest

How StackRadar’s notifications work: the critical and CISA-KEV alert to email and Slack on Pro and Business, what triggers it, how bursts are folded into one message, and the Monday digest every plan gets.

StackRadar keeps the dependency list (SBOM) of every image you run and re-matches it whenever the advisory database changes — so a CVE published tonight against a package you deployed in March shows up tomorrow morning without a redeploy. Notifications are how that reaches you without opening the dashboard. There are two: the critical & KEV alert on Pro and Business, and the weekly digest on every plan. Both are organization-wide settings under Organization Settings → Notifications, and only owners and admins can change them.

Critical & KEV alerts

An alert goes out when one of these happens to an image that is running in one of your clusters:

A re-match after an advisory database change adds a finding with critical severity, or one that is on the CISA Known Exploited Vulnerabilities (KEV) catalogue.
A finding that was already there is rescored into critical — an advisory that had no CVSS score yesterday and a critical one today.
CISA adds an advisory to KEV that is already a confirmed finding on something you run. Nothing changed in your cluster; the world learned that the vulnerability is being exploited.

Two things deliberately do not alert. A cluster's first scan is inventory, not change — the findings did not arrive that day, the image did. And a deploy that ships a critical is your own action; the activity feed shows it the same day. The alert exists for the advisory database changing under an image nobody is watching.

Choosing what to alert on

The defaults are critical findings plus anything on KEV, and both are yours to change on the Notifications tab. Lower the severity floor to high if you would rather hear about more, or drop the severity rule entirely and keep only known-exploited findings if you want the quietest useful setting. The KEV rule is independent of severity: a medium-severity advisory that CISA lists is still an alert unless you switch that rule off. The settings apply to both channels.

One message, not forty

An advisory against a base-image package reaches every image in the fleet within the hour, as one scan each. StackRadar waits until the burst has been quiet for ten minutes (an hour at most), then sends one message per channel grouped by advisory: the CVE, its severity and whether it is on KEV, the packages and the fixed version, and the running images it landed on with their clusters and workloads, busiest first. Every advisory links to its page in the dashboard.

Channels

Channel	Who receives it	Setup
Email	Every owner and admin of the organization	On by default on Pro and Business. A toggle switches it off for the organization, and so does the unsubscribe link at the bottom of every alert email (or your mail client's own unsubscribe button — the emails carry the one-click header).
Slack	The channel your incoming webhook posts to	Paste an incoming webhook URL (Slack → Apps → Incoming Webhooks). Mattermost and Discord Slack-compatible webhooks work too.

Send a test posts a test message on every channel that is on, so you can check the wiring before a real finding does. The page also lists recent deliveries with their status — including the webhook's own error if it refused a post.

The webhook URL is the credential. StackRadar stores it, shows it only masked afterwards, and only ever POSTs to it — through the same outbound checks that guard chart repository URLs, so it must be an https URL on a public host.

Which plans

Alerts are included in Pro and Business. Free organizations see the setting locked and get the weekly digest instead. A downgrade silences alerts by the next pass; an upgrade starts the email channel with nothing to configure — the first pass after upgrading starts the clock, so you are not sent the month of findings that predate it.

Weekly digest

Every Monday, owners and admins get one email: the Radar Score and where it moved over the week, the findings to fix first, new CISA KEV matches, what arrived and what was resolved, and any registry the scanner could not pull from. It is on for every plan and switched off for the whole organization from the Notifications tab or the link at the bottom of the email.