diff --git a/docs/content/admin/notifications/configure_personal_notifs.md b/docs/content/admin/notifications/configure_personal_notifs.md index 225cf5d9e90..12f00e36d46 100644 --- a/docs/content/admin/notifications/configure_personal_notifs.md +++ b/docs/content/admin/notifications/configure_personal_notifs.md @@ -21,6 +21,10 @@ System notifications are set by a DefectDojo Superuser and cannot be opted out o Personal Notifications cannot be sent via Microsoft Teams, as Teams only allows for posting Global notifications in a single channel. +### Receive new Findings that match a set of filters (Pro) + +To be told about new Findings that match particular filters rather than every event of a kind, adopt the **Alert on new findings that match a set of filters** template in the Triage Engine: it sends an in-app alert about the matching new Findings. See [Starting a rule](/automation/triage_engine/building_rules/#starting-a-rule). + ### Receive Personal notifications for a specific Asset In addition to standard personal notifications, DefectDojo Users can also receive notifications for activity on a specific Asset. This is helpful when there are certain Assets which a user needs to monitor more closely. diff --git a/docs/content/automation/triage_engine/building_rules.md b/docs/content/automation/triage_engine/building_rules.md index 762811846ea..62eb39f4a78 100644 --- a/docs/content/automation/triage_engine/building_rules.md +++ b/docs/content/automation/triage_engine/building_rules.md @@ -33,6 +33,22 @@ Templates are starting points, not links. Editing an adopted rule does not affec adopting the same one twice is fine — you get two independent rules, which is how the same watchdog gets pointed at two different sets of Assets. The second one is named with a suffix. +The **Notifications** pack holds one template for being told about new Findings: **Alert on new +findings that match a set of filters**. It is an **On Finding Event** trigger on **Created** wired to +one in-app alert node. Pick the filters in the trigger's scope, the same ones the Findings list +offers, and the rule sends one alert for each batch of new Findings that match all of them, however +the Findings were added. An import usually sends one alert; a very large one sends one per batch of +500 Findings by default, and the count in each alert is that batch's. Every Finding an import +creates counts as new, including one that duplicates a Finding already reported. To leave those out, +add the **Duplicate** filter to the scope, set to **No**. + +The alert names the rule, so rename the adopted rule after what it watches. The alert node takes +usernames, or alerts the administrators when left empty. The title and description arrive +pre-filled with the rule's name and the number of matching Findings, and are edited on the node like +any other rule's. The alert goes only to DefectDojo users, and each recipient's own **Rules Engine +Match** notification setting decides whether it reaches them: a recipient who has turned off alerts +for it gets nothing, though the delivery still reads Sent. + **New Rule** starts from an empty canvas instead. Both need the same permission as authoring any rule, because both create one.