InfraFenceInfraFence

Live Security Operations

Get Started

Alerts

Send InfraFence alerts to email, Slack, Discord, Telegram or a signed webhook - severity and category filters, batching, limits, the webhook payload and how to verify its signature.

Last updated:

Alert channels are under Settings › Alerts (owners and admins). Email is included in every plan; Slack, Discord, Telegram and webhooks are part of Basic and higher.

Add a channel

Add channel, then:

  • Channel: email, Slack, Discord, Telegram or webhook;
  • Name: for you, for example "Ops team";
  • Minimum severity: critical by default;
  • Categories: leave all unchecked to receive every category.
Channel What you enter
Email Email address
Slack Slack webhook URL (hooks.slack.com): Slack › Apps › Incoming Webhooks, add to a channel, copy the URL.
Discord Discord webhook URL: channel › Edit › Integrations › Webhooks › New webhook › Copy URL.
Telegram Telegram chat ID and Bot token: create a bot with @BotFather, add it to the chat, paste the chat ID and the token.
Webhook Webhook URL (https) and an optional Signing secret.

Send test checks the channel. Each channel shows when it last sent and its last error.

Webhooks must point to a public HTTPS address: private and local addresses are refused.

What is sent

New events at or above the channel's severity, in the chosen categories. Operational events (scans, updates, firewall self-repair) never alert. AutoMode approval requests also go to the channels.

Events are grouped: at most one message every 20 seconds per channel and server, listing up to 15 events. A channel sends at most 100 messages a day.

Webhook payload

A JSON POST:

json
{
  "source": "infrafence",
  "type": "alert",
  "org": "Acme",
  "server": { "id": 42, "name": "web-01" },
  "link": "https://infrafence.com/…",
  "title": "…",
  "events": [
    {
      "type": "brute_force",
      "severity": "critical",
      "source_ip": "203.0.113.7",
      "occurred_at": "2026-10-23T08:15:00Z",
      "details": {}
    }
  ]
}

Every request carries X-InfraFence-Timestamp (Unix seconds). With a signing secret it also carries X-InfraFence-Signature: sha256=<hex>, the HMAC-SHA256 of <timestamp>.<body> with your secret. Recompute it over the raw body, compare in constant time, and reject old timestamps to block replays:

bash
printf '%s.%s' "$TIMESTAMP" "$BODY" | openssl dgst -sha256 -hmac "$SECRET"

Weekly summary

Weekly summary by email: every Monday, owners and admins get a summary of the last 7 days, in the language they use the dashboard in.

Emails InfraFence sends

Besides the alerts, InfraFence emails:

  • Security alerts and approval requests to the email channels above;
  • the weekly summary (Mondays) and the monthly report (the 1st, paid plans) to owners and admins;
  • three protection notices to owners when the dashboard refuses the agents: 12 hours before they switch protection off, when they do, and when access is back (see When the dashboard is unreachable);
  • the free trial emails to owners: 7, 3 and 1 day before the end and when it has ended (see Billing and plans);
  • the account emails: confirm sign-up, reset password, sign-in link, invitation, and the confirmation of a new email address (to the new address and, as a check, to the current one).

They come in the language you use the dashboard in, with an HTML and a plain-text version. The links in them only open InfraFence (or, for support, an email to info@infrafence.com); an approval email only opens the request, it never approves anything.

When an address's mail server refuses it for good (no such mailbox, or a domain without a mail server), InfraFence stops emailing it for 7 days, then tries again. Meanwhile the dashboard shows We couldn't deliver email to … to the organization's owners (and to that admin), and an email alert channel with that address shows recipient_rejected, then recipient_undeliverable until the week is over. A Send test still tries the address. See Troubleshooting.