Skip to main content
Plans: Every plan for emails, the bell and the weekly digest; Core and Plus, and the free trial, for paging and for Slack, Teams and webhooks. Who: every member sets their own choices; owners and admins manage Slack, Teams and webhook destinations.
Pharus reaches people in five ways: emails, the notification bell in the app, the weekly digest, SMS pages to the person on call, and alerts posted to Slack, Microsoft Teams or your own webhook. Your own choices, and for owners and admins the destinations and delivery problems, are under Settings → Notifications. Times in every message are Oslo time.

​
Emails

Each email goes to the people below, in their own language (Settings → Your profile), or the company’s default language. Invitations, password resets and email confirmations go to the person concerned.

​
Your notification choices

At the top of Settings → Notifications, each member chooses for themselves. Each switch saves on its own.
  • Alert emails: exploited vulnerabilities matched in your products, deadline warnings and pages nobody acknowledged. On unless you switch it off. Owners and admins get them; members get them while they are on call.
  • Weekly digest: on by default for owners and admins, off for members. Once you change it, Use the default sets it back.
  • Page me on WhatsApp instead of SMS: when you are on call, pages arrive on WhatsApp. If Pharus doesn’t offer WhatsApp yet, the switch is off and says so.
Some messages can’t be switched off here: pages to the person on call (being on call is the opt-in; the WhatsApp switch only changes the channel), approval requests addressed to you by name, and the account and billing emails. Owners and admins also see Who gets what: every member’s digest and alert-email choices, how they are paged (SMS, WhatsApp or No verified number) and their language.

​
The notification bell

The bell in the top bar opens a panel with what needs you now. It refreshes every minute.
  • Open pages: pages that are open, and pages that ended without an acknowledgement in the last 24 hours. Select Acknowledge page to stop the escalation.
  • Awaiting your approval: determinations waiting for your four-eyes approval, with a link to the decision.
  • Reports to file: final reports due within 72 hours or overdue, up to 10. Their warnings go by email only, so the bell is where you see them in the app.
The badge counts open pages and approvals waiting for you. Reports to file don’t count towards it. With nothing waiting, the panel says “Nothing needs you right now.”

​
The weekly digest

Every Monday from 07:00 Oslo time, Pharus emails a digest of new KEV and EUVD matches across every product family, the deadlines that are running and what needs attention. Settings → Notifications shows a Digest preview of this week so far, and Send me a test digest emails it to you. See Weekly digest.

​
Pages to the person on call

On Core and Plus, an exploited match, an upcoming 24-hour or 72-hour deadline, or a member’s Page on-call texts the person on call, and escalates to the backup after 15 minutes without an acknowledgement. See Paging and On-call rota.

​
Slack, Teams and webhooks

On Core and Plus, Pharus also posts alerts to Slack channels, Microsoft Teams channels and your own HTTPS endpoints. Emails and SMS pages go out as before. Owners and admins manage the destinations in the Slack, Teams and webhooks card under Settings → Notifications; members don’t see it.

​
Events

When you add a destination, you choose What to send. All four are ticked by default.

​
Add a Slack channel

1

Get an incoming webhook URL in Slack

In Slack, set up an incoming webhook for the channel (a Slack app with Incoming Webhooks turned on) and copy its URL. It starts with https://hooks.slack.com/.
2

Add the destination

In Pharus, go to Settings → Notifications and select Add destination in the Slack, Teams and webhooks card. Choose Slack as the Type, give it a Name (for example #security-alerts), paste the URL and tick what to send under What to send. Select Add destination.
3

Test it

Select Send a test. A message “Test alert from Pharus” should appear in the channel, and Pharus shows Test delivered.

​
Add a Microsoft Teams channel

Pharus posts to Teams through a Workflows webhook. The Office 365 connectors are retired, so connector URLs don’t work.
1

Create the workflow in Teams

In Teams, add a workflow to the channel from the template “Post to a channel when a webhook request is received”, and copy the URL it gives you. It is on logic.azure.com or api.powerplatform.com.
2

Add the destination

In Pharus, select Add destination, choose Microsoft Teams as the Type, give it a Name, paste the URL and choose What to send. Select Add destination.
3

Test it

Select Send a test. The test appears in the channel as a card with an Open in Pharus button.

​
Add a webhook

A webhook is a signed JSON POST to your own HTTPS endpoint, for a SIEM, a ticketing system or an internal tool.
1

Add the destination

Select Add destination, choose Webhook as the Type, give it a Name, enter your endpoint’s URL (starting with https://) and choose What to send. Select Add destination.
2

Copy the signing secret

Pharus shows the Signing secret once: “Copy it now: Pharus won’t show it again.” Store it with your endpoint, which uses it to check that each request comes from Pharus.
3

Test it

Select Send a test. Your endpoint gets an event of the type test.
The body, the headers and how to verify the signature are in the webhook reference. To replace the secret, select New signing secret. The current secret stops working at once, so put the new one in your endpoint straight away.

​
What the messages contain

Slack and Teams get a short title, one line and an Open in Pharus button that links to the incident or the report in the inbox. For example:
  • New incidents from exploited matches: “New incident INC-0042: CVE-2026-1234 in openssl 3.0.13”, then the product family, the list it is on and when the CRA clocks started.
  • Deadline warnings: “CRA · Notification for INC-0042: due in 3 h 59 min”, then the incident’s title and the deadline.
  • Approval requests: “Approval requested on INC-0042”, then the title and the determination.
  • New disclosure reports: “New disclosure report #12”, then the product family and the date to acknowledge it by, as your policy promises.
The messages are in the company’s default language, set under Settings → Company. A webhook gets the same events as JSON. Alerts hold ids, titles, deadlines and links into Pharus, never reporter details or draft text. A reporter’s name, email address and report stay in the inbox; who recorded a determination and the rationale stay on the incident.

​
Change, turn off or remove a destination

Each destination shows its type, name and host, the events it gets, and how its last delivery went: Nothing sent yet, Last delivery with the time, or Last delivery failed with the time and the reason.
  • On turns posting on or off without removing the destination.
  • Edit changes the name and What to send. Pharus stores the URL encrypted and doesn’t show it again; to change it, remove the destination and add it again.
  • Remove stops all posting to it. Its failed deliveries stay listed under delivery problems.
Adding, changing and removing destinations, and new signing secrets, are recorded in the audit trail. After a move to Starter, Pharus stops posting. Owners and admins can still change, turn off and remove destinations; adding one, sending a test and making a new signing secret need Core or Plus again.

​
Delivery problems

Owners and admins see Delivery problems under Settings → Notifications: emails, texts, WhatsApp messages and posts to Slack, Teams and webhooks from the last 30 days that didn’t reach their recipient, with the reason the provider or the destination gave. It lists the newest 20. Pharus doesn’t retry a failed email, text or alert. A page text that fails moves the page on to the next person in the chain instead; see Paging.

Paging

Weekly digest

Outgoing webhooks

Members and roles