Notification Settings Page

Important: When notification settings are configured on the Notification Settings page, they take priority over any notification settings configured from an individual user’s sidebar. This means user-level notification settings are overridden whenever an organization-level notification setting exists, even if the user-level settings are assigned to a different user.

The Notification Settings page, located in the Response Center, allows administrators to manage notification preferences from one centralized location. Instead of configuring notification settings individually from each user’s sidebar, admins can now create and manage notification settings from a single page.

From this page, you can choose:

• Which notification types admins receive
• Which organization, groups, or computers the notification setting applies to
• Which recipients receive the notifications
• Whether notifications are sent by email, SMS, push notification, the ThreatLocker Admin app, REST API, an integration, or a combination of these methods.
• Custom Email and SMS/Push Notification content

Accessing Notification Settings

1. Log in to the ThreatLocker Portal.
2. Navigate to the Response Center > Approvals page
3. Select the blue button in the top left corner 'Notification Settings'.

The window displays existing notification settings in a table. Each row shows the notification type, organization, delivery method, and recipients.

Creating a New Notification Setting

To create a new notification setting:

1. Click New Notification Setting.
2. In the Create Notification window, select the Notification Type.
3. If Detect or Cloud Detect Notification are selected, next you will need to choose the severity level of the alerts that will be sent. (Information level is not recommended as it can create a high volume of notifications.)
4. Select the 'Applies to' for the setting.  If 'Entire Organization' is selected, you can choose to apply the same settings to other organizations.
5. If you want to apply these settings to organizations other than the logged in organization, toggle on the 'Appy these settings to Child Organizations?' and choose which organization(s) the setting applies to. (This toggle only appears after choosing Entire Organization as the Applies To.)

6. Select the desired destination (Email, SMS, Push Notification, REST API, or Integration).

   Note: If Integration is selected, the supported destinations are Kaseya BMS, Datto, ServiceNow, ConnectWise, HaloPSA, SolarWinds, and Dynamics 365. Only integrations already configured for your account will appear in the dropdown.

   
7. Select 'Next'.
8. Select the recipients that should receive the notifications.
9. Customize the notification content if needed. Any of the text can be modified, and additional variables can be included if desired.
10.  Click the blue 'Create' button to save the settings.

Sending a Rest API Notification

Users can now send a Rest API notification through the Notification Settings page. This destination option is available for any notification type.

After selecting Rest API as your destination, select the 'Next' button to configure your settings.

In the URL field, enter the web address to which your HTTP request will be sent.

Please Note: You will not have to select the method for this setting as Notification Settings will always use POST.

Now in the Rest API section:

1. Content Type - By default, ThreatLocker sets this field to 'application/json', but it can be changed to match the request body format.
2. Headers - This field is optional. Here, insert any information that might be required by your receiving API.
3. Add Variable (Headers) - Depending on the selected Notification Type, the variables available in this dropdown may change. ThreatLocker provides variables related to the selected Notification Type, allowing you to create default messages that automatically update with information specific to each notification. To add a variable, select it from the dropdown, then select the '+' button to the right.
4. Body - This field is optional. Here, insert any information you want to send with your HTTP request. The body should be formatted according to the Content Type inserted earlier.
5. Add Variable (Body) - These variables will be the same as those provided in the Add Variable (Headers) section. Use the same method to select and add variables to the body of your Rest API notification.
6. Authorization Token Response - By default, this is set to 'None'. Selecting this dropdown will give you the option for OAuth 2.0. If this is selected, a new field will open to the right of this page called Token Response, where you will need to enter your Authorization Token information.
7. Test API - Select this button to send a test request using the settings you've entered.
8. Create - Select the 'Create' button when all settings have been correctly inserted. This will finalize your notification settings and start generating notifications based on your parameters.