--- title: "CSP violation alerts in Slack, Teams & more" description: "CSP alerts in Slack, Teams, Google Chat, Telegram, email or a webhook the moment a new origin, changed script or violation spike lands. Not a nightly sweep." url: "https://next.centralcsp.com/en/platform/alerting/" lang: "en" --- Alerts # Your site changed. Your team already knows. Add a rule once. When a real visitor's browser reports the change, the message is already in the channel that owns that page. [Start free trial](https://app.next.centralcsp.com) [See what we monitor](https://next.centralcsp.com/en/platform/monitoring/) - Fires on ingest Not a nightly sweep - Six destinations Chat, email or webhook - Routed per site And per team - No agent One response header Triggers ## What's worth interrupting someone for. Six things a rule can watch for, on any page you point it at. - ### A new origin appears A script loaded from a host you have never seen. Most client-side attacks open exactly here. - ### A script changed A file you execute no longer matches yesterday's hash. Your build did it, or somebody else did. - ### Something touched a payment page Card-data pages get their own rules, because PCI DSS 11.6.1 asks you to alert on changes to them. - ### A known CVE turns up A library you load has a published advisory. You hear it with the version and the CVE id. - ### Reports spike Violations jumped after the 4pm deploy. Something broke at scale, and the browsers said so first. - ### A silent signal wakes up A directive that reported nothing all quarter started talking. Worth a look before it is worth an incident. Channels ## This is what an alert looks like. The same rule, reaching three teams where they already work. Every rule picks its own destination, so a checkout incident and a marketing-site warning never land in the same thread. - - - Every destination a rule can reach - Slack - Microsoft Teams - Google Chat - Telegram - Email - Webhooks FAQ ## Frequently asked questions Channels, speed, noise and compliance, answered. ### Can I get CSP violation alerts in Slack? Yes, and in Microsoft Teams, Google Chat, Telegram, email or any webhook you host. Connect the channel once, then point rules at it. A rule can post to more than one channel, and two rules on the same site can reach different teams. ### Why alert instead of just blocking the script? Blocking is the Content Security Policy's job, and you should have one. What a policy cannot do is tell a good change from a bad one inside a vendor you already approved, which is how British Airways was breached. The policy closes the doors; alerts tell you when something moved in a room you already let someone into. ### How fast does an alert arrive? Rules are evaluated as reports arrive, and browsers send reports shortly after a page loads. In practice you hear about a new script on the next page view that loads it, not on a nightly sweep. For comparison, Cloudflare Page Shield batches its new-resource alerts daily and its code-change alerts up to every 24 hours. ### Won't I drown in CSP noise? That is the usual failure mode, and it comes from alerting on raw reports. Yours arrive deduped, grouped by directive and origin, and with browser-extension false positives already flagged. You can also scope any rule to the pages that matter, so the checkout and the blog never share the same rule. ### Does this satisfy PCI DSS 11.6.1? It is the detection and alerting half of it. Requirement 11.6.1 asks for a change- and tamper-detection mechanism that alerts personnel to unauthorized modification of payment pages and their HTTP headers, as received by the consumer browser, at least once every seven days. CentralCSP's reports come from the consumer browser and its rules fire on arrival. Pair it with the script inventory for 6.4.3 and export both as evidence. ### Do I need an agent or a script on the page? No. Alerting rides the same response header as monitoring. Browsers generate the reports themselves, so there is nothing to install, nothing to keep updated, and no third-party script added to the pages you are trying to protect. ### Can I create alert rules over the API? Yes. Rules are a REST resource with scoped tokens, and the same operations are available over the built-in MCP server, so onboarding a hundred sites is a loop rather than an afternoon. ## Set one rule today. Forget about it until it matters. Add the header, connect a channel, pick the change worth a message. 14-day free trial, no agent to deploy. [Start free trial](https://app.next.centralcsp.com) [Check your reporting setup](https://next.centralcsp.com/en/tools/reporting-api/) --- Available in: [en](https://next.centralcsp.com/en/platform/alerting/), [fr](https://next.centralcsp.com/fr/platform/alerting/)