> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Send InfraAudit Alerts to Slack

> Create a Slack incoming webhook, add it to InfraAudit notification settings, and configure routing rules to send different alert types to different channels.

InfraAudit delivers alerts to Slack using incoming webhooks. When a drift finding, vulnerability, cost anomaly, or compliance failure is detected, InfraAudit posts a formatted message to the configured channel — including the severity, affected resource, and a link to the full alert in the InfraAudit UI.

## Step 1: Create an incoming webhook in Slack

<Steps>
  <Step title="Open the Slack app directory">
    Go to your workspace's [Slack app directory](https://api.slack.com/apps) and create a new app, or select an existing one you manage.
  </Step>

  <Step title="Enable incoming webhooks">
    In the app settings, go to **Features → Incoming Webhooks** and toggle the feature on.
  </Step>

  <Step title="Add a webhook to your workspace">
    Click **Add New Webhook to Workspace** and pick the channel where alerts should appear (for example, `#infraudit-alerts`).
  </Step>

  <Step title="Copy the webhook URL">
    Copy the webhook URL. It follows the format `https://hooks.slack.com/services/T.../B.../...`. You'll enter this in InfraAudit next.
  </Step>
</Steps>

## Step 2: Configure InfraAudit

<Tabs>
  <Tab title="SaaS">
    <Steps>
      <Step title="Open notification settings">
        Go to **Settings → Notifications → Slack**.
      </Step>

      <Step title="Paste the webhook URL">
        Paste the URL you copied from Slack and select a default channel.
      </Step>

      <Step title="Save">
        Click **Save**. All alert types are sent to this channel by default.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Self-hosted">
    Add the webhook URL to your `.env` file:

    ```env theme={null}
    SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../...
    SLACK_CHANNEL=#infraudit-alerts
    ```

    Restart the API after saving the file:

    ```bash theme={null}
    docker compose restart api
    ```
  </Tab>
</Tabs>

## Test the integration

After saving, send a test message to verify the connection:

<Tabs>
  <Tab title="UI">
    Go to **Settings → Notifications → Slack** and click **Send test message**.
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    infraudit notification test --channel slack
    ```
  </Tab>
</Tabs>

## Configure alert routing

By default, all alert types and severities are sent to the channel you configured. To route different alert types to different channels, set up routing rules under **Settings → Notifications → Routing**.

A typical routing setup:

| Alert type               | Channel          |
| ------------------------ | ---------------- |
| Critical security alerts | `#security`      |
| Cost anomalies           | `#finops`        |
| Compliance failures      | `#compliance`    |
| All events               | `#infraudit-all` |

You can also configure routing via the API. Each rule specifies a channel, alert type, severity filter, and a webhook URL (which can be a different Slack app or channel):

```bash theme={null}
curl -X POST http://localhost:8080/api/v1/notifications/preferences \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "slack",
    "alertType": "security",
    "severity": "critical",
    "webhookUrl": "https://hooks.slack.com/services/T.../B.../..."
  }'
```

## What each Slack alert contains

Every message InfraAudit posts to Slack includes:

* Alert title and type (security, cost, compliance)
* Severity badge
* Resource name and provider
* A short description of what was detected
* A direct link to the full alert in the InfraAudit UI

## Multiple Slack channels

InfraAudit supports multiple Slack webhook configurations. Each routing rule can point to a different webhook URL, which means you can route alerts to entirely separate Slack workspaces or apps if needed.