Channels
Where alerts are delivered. Slack, Google Chat, Teams, Telegram, a signed webhook, or email, with the exact URL each one requires.
Last update:
A channel is a destination for notifications. Create one before writing any rules, because rules cannot be created without a channel to point at.
Changing channels requires the website Manager role.
Add a channel
Alerts > Configuration > Add channel. Give it a name, pick a type, and supply the destination.
The type cannot be changed after creation. To switch a channel from Slack to Teams, create a new one and repoint your rules.
The type list in the Add channel dialog offers all six destinations:
The six types
Each channel type needs a different destination:
| Type | What it needs | Required URL shape |
|---|---|---|
| Slack | Incoming webhook URL | Host hooks.slack.com, path starting /services/ |
| Google Chat | Webhook URL | Host chat.googleapis.com, path starting /v1/spaces/ |
| Microsoft Teams | Power Automate workflow URL | A host under logic.azure.com or api.powerplatform.com |
| Telegram | Bot token and chat id | No URL |
| Webhook | Any https URL, plus a signing secret | Public host, https only |
| 1 to 10 addresses | No URL |
The URL shape is validated as you type, so a wrong-format URL is rejected before you save.
Teams legacy connectors are not supported
Microsoft retired Office 365 connectors. Only Power Automate Workflows URLs are accepted, which is why the host must be on logic.azure.com or api.powerplatform.com. If your existing Teams webhook is an office.com connector URL, create a Workflow first.
Internal and private addresses are rejected, including localhost, .local, .internal, hosts with no dot, and anything resolving to a private IP range. The host is re-checked on every send, so a channel cannot be pointed at internal infrastructure after the fact.
Email channel recipients
Every recipient address must belong to a workspace member. An outside address is rejected when you save.
Two consequences worth planning around. At delivery time the member's current address is used, so someone changing their email keeps receiving alerts. And a member who loses access to that website is silently dropped from the recipient list. If nobody is left, the delivery fails.
For a distribution list or an on-call alias, use a Webhook channel or your chat platform instead.
Webhook signatures
A webhook channel requires a signing secret of at least eight characters. Each request carries two headers:
x-centralcsp-timestamp: 1754640000000x-centralcsp-signature: sha256=<HEX_DIGEST>The signature is an HMAC-SHA256 over `${timestamp}.${body}` using your secret. Verify both the signature and the timestamp freshness on your side.
The JSON body contains the event type, the rule, the website, the findings and their count, the time window, and a dashboard link.
Secrets, URLs, and bot tokens are never returned by the API. Editing a channel shows a masked preview, and leaving the field empty keeps the existing value.
Test before you rely on it
Test sends a sample alert immediately, using a fake CSP violation event. It confirms the destination accepts messages, which is the failure you want to find now rather than during an incident.
Rate-limited to one test per channel every 15 seconds, and 20 tests per minute across the workspace.
A failed test means the destination refused the message. That is a real answer, not a transient error: check the URL, the token, and whether the receiving app is still installed.
Channels turn themselves off
After five consecutive failed deliveries a channel switches off automatically.
To recover, fix the destination, then flip the Enabled switch back on. Turning it back on clears the failure count. Any successful delivery also resets the counter, so an intermittent destination does not accumulate toward the limit.
This is worth knowing because a revoked Slack webhook fails silently from your point of view: alerts stop, and nothing in the report pages changes. Check the channels list if alerts go quiet.
Delete a channel
Deleting a channel stops any rule using it from delivering. Delivery history is kept, and rules that referenced it do not break.