> ## Documentation Index > Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Notifications > Every way Pharus tells your team something: emails, the notification bell, the weekly digest, on-call pages, and alerts to Slack, Teams and webhooks. **Plans:** Every plan for emails, the bell and the weekly digest; Core and Plus, and the free trial, for paging and for Slack, Teams and webhooks. **Who:** every member sets their own choices; owners and admins manage Slack, Teams and webhook destinations. Pharus reaches people in five ways: emails, the notification bell in the app, the weekly digest, SMS pages to the person on call, and alerts posted to Slack, Microsoft Teams or your own webhook. Your own choices, and for owners and admins the destinations and delivery problems, are under **Settings → Notifications**. Times in every message are Oslo time. ## Emails Each email goes to the people below, in their own language (**Settings → Your profile**), or the company's default language. | Email | When | Who gets it | | - | - | - | | Exploited vulnerability | An SBOM component matches a vulnerability on CISA KEV or flagged as exploited in EUVD and an incident opens, or a name-only match needs confirming | Owners and admins with **Alert emails** on, and on Core and Plus the on-call primary if they have them on | | Deadline warning | 4 hours before an unfiled 24-hour or 72-hour report is due, 1 hour before DORA's initial notification, and 72 hours before a final report. Not while the workspace is read-only | The same people. If none of them has alert emails on, every owner | | Nobody acknowledged the page | A page's escalation ended without an acknowledgement | Owners and admins with alert emails on, else every owner | | Nobody on call could be paged | A page was due, but nobody on call has a verified mobile number | Owners and admins with alert emails on, else every owner | | New disclosure report | A report arrives in the [disclosure inbox](/disclosure/inbox) | Owners and admins with alert emails on | | Approval request | A determination needs your four-eyes approval | Each approver asked for, whatever their alert-email choice | | Approval outcome | An approver approves or declines | The member who recorded the determination | | Weekly digest | Mondays from 07:00 | Owners and admins by default; members who switch it on | | Support period reminder | A release line's security support ends within 90 days, and again when it has ended | Owners and admins | | Note from the partner | A partner consultant leaves a note on a request for [expert help](/incidents/expert-review) | The member who asked for the review, else owners and admins | | Trial and read-only notices | 3 days before the trial ends, and when the workspace becomes read-only | Owners | | Invoices | When an invoice is issued, and when a card payment goes through | The **Invoice email** under **Settings → Company** | | Workspace closed, deletion warnings | When an owner closes the workspace, and 30 and 7 days before its data is deleted | Owners | Invitations, password resets and email confirmations go to the person concerned. ## Your notification choices At the top of **Settings → Notifications**, each member chooses for themselves. Each switch saves on its own. * **Alert emails**: exploited vulnerabilities matched in your products, deadline warnings and pages nobody acknowledged. On unless you switch it off. Owners and admins get them; members get them while they are on call. * **Weekly digest**: on by default for owners and admins, off for members. Once you change it, **Use the default** sets it back. * **Page me on WhatsApp instead of SMS**: when you are on call, pages arrive on WhatsApp. If Pharus doesn't offer WhatsApp yet, the switch is off and says so. Some messages can't be switched off here: pages to the person on call (being on call is the opt-in; the WhatsApp switch only changes the channel), approval requests addressed to you by name, and the account and billing emails. Owners and admins also see **Who gets what**: every member's digest and alert-email choices, how they are paged (**SMS**, **WhatsApp** or **No verified number**) and their language. ## The notification bell The bell in the top bar opens a panel with what needs you now. It refreshes every minute. * **Open pages**: pages that are open, and pages that ended without an acknowledgement in the last 24 hours. Select **Acknowledge page** to stop the escalation. * **Awaiting your approval**: determinations waiting for your four-eyes approval, with a link to the decision. * **Reports to file**: final reports due within 72 hours or overdue, up to 10. Their warnings go by email only, so the bell is where you see them in the app. The badge counts open pages and approvals waiting for you. Reports to file don't count towards it. With nothing waiting, the panel says "Nothing needs you right now." ## The weekly digest Every Monday from 07:00 Oslo time, Pharus emails a digest of new KEV and EUVD matches across every product family, the deadlines that are running and what needs attention. **Settings → Notifications** shows a **Digest preview** of this week so far, and **Send me a test digest** emails it to you. See [Weekly digest](/monitoring/weekly-digest). ## Pages to the person on call On Core and Plus, an exploited match, an upcoming 24-hour or 72-hour deadline, or a member's **Page on-call** texts the person on call, and escalates to the backup after 15 minutes without an acknowledgement. See [Paging](/on-call/paging) and [On-call rota](/on-call/rota). ## Slack, Teams and webhooks On Core and Plus, Pharus also posts alerts to Slack channels, Microsoft Teams channels and your own HTTPS endpoints. Emails and SMS pages go out as before. Owners and admins manage the destinations in the **Slack, Teams and webhooks** card under **Settings → Notifications**; members don't see it. ### Events When you add a destination, you choose **What to send**. All four are ticked by default. | Event | Label in Pharus | Sent when | | - | - | - | | `incident.opened` | **New incidents from exploited matches** | An exact match against CISA KEV or EUVD opens an incident. A name-only match isn't sent until a person confirms it. | | `deadline.warning` | **Deadline warnings** | The deadline warnings above, final reports included: one alert per report. | | `approval.requested` | **Approval requests** | A determination is recorded that needs four-eyes approval. | | `report.received` | **New disclosure reports** | A vulnerability report arrives in the disclosure inbox. | ### Add a Slack channel In Slack, set up an incoming webhook for the channel (a Slack app with Incoming Webhooks turned on) and copy its URL. It starts with `https://hooks.slack.com/`. In Pharus, go to **Settings → Notifications** and select **Add destination** in the **Slack, Teams and webhooks** card. Choose **Slack** as the **Type**, give it a **Name** (for example #security-alerts), paste the **URL** and tick what to send under **What to send**. Select **Add destination**. Select **Send a test**. A message "Test alert from Pharus" should appear in the channel, and Pharus shows **Test delivered**. ### Add a Microsoft Teams channel Pharus posts to Teams through a Workflows webhook. The Office 365 connectors are retired, so connector URLs don't work. In Teams, add a workflow to the channel from the template "Post to a channel when a webhook request is received", and copy the URL it gives you. It is on `logic.azure.com` or `api.powerplatform.com`. In Pharus, select **Add destination**, choose **Microsoft Teams** as the **Type**, give it a **Name**, paste the **URL** and choose **What to send**. Select **Add destination**. Select **Send a test**. The test appears in the channel as a card with an **Open in Pharus** button. ### Add a webhook A webhook is a signed JSON POST to your own HTTPS endpoint, for a SIEM, a ticketing system or an internal tool. Select **Add destination**, choose **Webhook** as the **Type**, give it a **Name**, enter your endpoint's **URL** (starting with `https://`) and choose **What to send**. Select **Add destination**. Pharus shows the **Signing secret** once: "Copy it now: Pharus won't show it again." Store it with your endpoint, which uses it to check that each request comes from Pharus. Select **Send a test**. Your endpoint gets an event of the type `test`. The body, the headers and how to verify the signature are in the [webhook reference](/api-reference/webhooks). To replace the secret, select **New signing secret**. The current secret stops working at once, so put the new one in your endpoint straight away. ### What the messages contain Slack and Teams get a short title, one line and an **Open in Pharus** button that links to the incident or the report in the inbox. For example: * **New incidents from exploited matches**: "New incident INC-0042: CVE-2026-1234 in openssl 3.0.13", then the product family, the list it is on and when the CRA clocks started. * **Deadline warnings**: "CRA · Notification for INC-0042: due in 3 h 59 min", then the incident's title and the deadline. * **Approval requests**: "Approval requested on INC-0042", then the title and the determination. * **New disclosure reports**: "New disclosure report #12", then the product family and the date to acknowledge it by, as your policy promises. The messages are in the company's default language, set under **Settings → Company**. A webhook gets the same events as JSON. Alerts hold ids, titles, deadlines and links into Pharus, never reporter details or draft text. A reporter's name, email address and report stay in the inbox; who recorded a determination and the rationale stay on the incident. ### Change, turn off or remove a destination Each destination shows its type, name and host, the events it gets, and how its last delivery went: **Nothing sent yet**, **Last delivery** with the time, or **Last delivery failed** with the time and the reason. * **On** turns posting on or off without removing the destination. * **Edit** changes the name and **What to send**. Pharus stores the URL encrypted and doesn't show it again; to change it, remove the destination and add it again. * **Remove** stops all posting to it. Its failed deliveries stay listed under delivery problems. Adding, changing and removing destinations, and new signing secrets, are recorded in the [audit trail](/reports/audit-trail). After a move to Starter, Pharus stops posting. Owners and admins can still change, turn off and remove destinations; adding one, sending a test and making a new signing secret need Core or Plus again. ## Delivery problems Owners and admins see **Delivery problems** under **Settings → Notifications**: emails, texts, WhatsApp messages and posts to Slack, Teams and webhooks from the last 30 days that didn't reach their recipient, with the reason the provider or the destination gave. It lists the newest 20. Pharus doesn't retry a failed email, text or alert. A page text that fails moves the page on to the next person in the chain instead; see [Paging](/on-call/paging#how-escalation-works). ## Related This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.