Send InfraAudit Alerts to Slack

Create a Slack incoming webhook, add it to InfraAudit notification settings, and configure routing rules to send different alert types to different channels.

InfraAudit delivers alerts to Slack using incoming webhooks. When a drift finding, vulnerability, cost anomaly, or compliance failure is detected, InfraAudit posts a formatted message to the configured channel — including the severity, affected resource, and a link to the full alert in the InfraAudit UI.

Step 1: Create an incoming webhook in Slack

1. Open the Slack app directory

   Go to your workspace’s Slack app directory and create a new app, or select an existing one you manage.

2. Enable incoming webhooks

   In the app settings, go to Features → Incoming Webhooks and toggle the feature on.

3. Add a webhook to your workspace

   Click Add New Webhook to Workspace and pick the channel where alerts should appear (for example, #infraudit-alerts).

4. Copy the webhook URL

   Copy the webhook URL. It follows the format https://hooks.slack.com/services/T.../B.../.... You’ll enter this in InfraAudit next.

Step 2: Configure InfraAudit

SaaS

1. Open notification settings

   Go to Settings → Notifications → Slack.

2. Paste the webhook URL

   Paste the URL you copied from Slack and select a default channel.

3. Save

   Click Save. All alert types are sent to this channel by default.

Self-hosted

Add the webhook URL to your .env file:

SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../...
SLACK_CHANNEL=#infraudit-alerts

Restart the API after saving the file:

docker compose restart api

Test the integration

After saving, send a test message to verify the connection:

UI

Go to Settings → Notifications → Slack and click Send test message.

CLI

infraudit notification test --channel slack

Configure alert routing

By default, all alert types and severities are sent to the channel you configured. To route different alert types to different channels, set up routing rules under Settings → Notifications → Routing.

A typical routing setup:

Alert type	Channel
Critical security alerts	#security
Cost anomalies	#finops
Compliance failures	#compliance
All events	#infraudit-all

You can also configure routing via the API. Each rule specifies a channel, alert type, severity filter, and a webhook URL (which can be a different Slack app or channel):

curl -X POST http://localhost:8080/api/v1/notifications/preferences \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "channel": "slack",
    "alertType": "security",
    "severity": "critical",
    "webhookUrl": "https://hooks.slack.com/services/T.../B.../..."
  }'

What each Slack alert contains

Every message InfraAudit posts to Slack includes:

• Alert title and type (security, cost, compliance)
• Severity badge
• Resource name and provider
• A short description of what was detected
• A direct link to the full alert in the InfraAudit UI

Multiple Slack channels

InfraAudit supports multiple Slack webhook configurations. Each routing rule can point to a different webhook URL, which means you can route alerts to entirely separate Slack workspaces or apps if needed.