Webhook Destinations
A webhook destination is a saved Slack, Microsoft Teams or HTTPS endpoint that notification rules can deliver alerts to. Open Settings > Notifications and scroll to the Webhook Destinations card.
Sections
Permissions and prerequisites
- Modify Settings to add, edit, delete, enable or test destinations. With only View Notifications, the list is read-only.
- Manage Notifications to attach destinations to rules.
- An HTTPS endpoint the StratoLens container can reach. Plain
http://isn't accepted.
How Webhooks Work
You create a destination once, then tick it in any notification rule, alongside or instead of email recipients. One destination can serve many rules, and one rule can use many destinations. A rule that uses only webhooks works without any email setup.
A webhook carries the same alert items as that rule's email: same alert types, thresholds, filter, hidden-item exclusions and owner permissions.
Alerts only
Webhooks deliver notification alerts only. Report Subscriptions are sent by email.
Formats
Slack
Posts Block Kit messages to a channel through an incoming webhook. In Slack, go to Apps, Incoming Webhooks, Add to Slack, pick a channel, then copy the webhook URL (it starts with https://hooks.slack.com/services/).
Microsoft Teams
Posts Adaptive Cards to a channel through Power Automate. Create a flow from the Post to a channel when a webhook request is received template, choose the team and channel, save, then copy the flow's HTTP POST URL.
Generic (signed JSON)
Sends the raw alert payload as JSON by POST to your own HTTPS receiver, signed with HMAC-SHA256. See Webhook Receiver.
Legacy Office 365 connector webhooks for Teams are retired and not supported. Use a Power Automate flow.
Add a Destination
Click Add Destination, or the pencil on a row to edit one.
Fields
- Enabled
- On by default. Rules don't deliver to a disabled destination.
- Name
- Required. Must be unique, ignoring case.
- Format
- Required. Shows setup help for the chosen format. Can't be changed after saving; create a new destination to switch.
- Endpoint URL
- Required,
https://only. Slack URLs on a host other thanhooks.slack.comget a warning but can be saved. After saving, the table shows only the host name. To replace it, click Change URL when editing. - Detail level
- Summary (default) sends alert counts and summary lines only, so no item details leave StratoLens. Full adds item rows, up to 10 per alert type.
- Authentication
- Generic format only. A signing secret, generated on save and shown once with a Copy button, plus an optional custom request header. See verifying the signature.
Webhook URLs work like passwords
Anyone with a Slack or Teams webhook URL can post to the channel. StratoLens stores URLs encrypted and never displays them again.
Start on Summary
With Summary, only counts and summary lines leave your environment. Switch to Full where the channel audience should see resource names.
Then attach the destination in a rule's Delivery section.
Slack and Teams Messages
- The message is titled with the rule name, followed by one block per triggered alert type with its name and summary line.
- Full detail adds up to 5 item rows per alert type and a count of the rest.
- Slack shows a View in StratoLens button per alert type. Teams shows a View link per alert type and one button to open StratoLens.
- Very large messages are shortened to fit Slack and Teams size limits and end with the number of alert types left out.
- The product name in messages follows your branding settings.
Delivery and Auto-Disable
- Each attempt waits up to 10 seconds. Any 2xx response is success.
- A delivery is tried up to 3 times, retrying only after a network error, timeout or 5xx response. 4xx responses and redirects fail immediately, and redirects are never followed.
- Failed deliveries aren't queued or replayed. The next scan that triggers the rule delivers again.
- The Last Delivery column shows the result of the last delivery or test. Hover a failure for the reason.
After 10 consecutive failed deliveries, tests included, StratoLens turns the destination off and shows an Auto-disabledbadge with the last error. Any successful delivery resets the count, and so does switching the destination back on. Rules skip disabled destinations and record "Destination disabled" in their Last Send.
Send Test Message
The paper-plane icon posts a sample message to the real endpoint, even when the destination is disabled. The sample uses obviously fake data (a cost anomalies and an orphaned resources section), not data from your environment, and follows the destination's detail level. To test with real data, use Send test on a rule that uses the destination.
Tests count toward auto-disable
A failed test counts like a failed delivery. Ten failed tests in a row turn the destination off.
Delete a Destination
A destination used by any notification rule can't be deleted. The delete dialog lists those rules. Remove the destination from them first.
Troubleshooting
Last Delivery shows HTTP 404 or HTTP 403 from endpoint
Answer
The URL is wrong or the webhook was revoked: the Slack app was removed, or the Power Automate flow was deleted or turned off. Create a new webhook URL, then click Change URL on the destination.
Teams says the connector is retired
Answer
Office 365 connector URLs aren't supported. Create a Power Automate flow from the Post to a channel when a webhook request is received template and use its HTTP POST URL.
The destination says Auto-disabled
Answer
Ten deliveries in a row failed. Hover the badge for the last error, fix the endpoint, click Send test message, then switch the destination back on.
Last Delivery says the destination address is in a blocked range
Answer
The message reads "Destination address is in a blocked range". The URL resolves to an address StratoLens never delivers to, such as a loopback or link-local address. Use the receiver's routable address.
Last Delivery says the endpoint responded with a redirect
Answer
Redirects aren't followed. Use the final URL directly.
Last Delivery shows a timeout or network error
Answer
The message reads "Timeout after 10s" or "Network error". The endpoint didn't answer in time or isn't reachable from the StratoLens container. Check DNS, firewall rules and private endpoint routing.
Slack or Teams messages have counts but no item rows
Answer
The destination's Detail level is Summary. Edit it and choose Full.
I can't change a destination from Slack to Teams
Answer
Format is fixed once saved. Create a new destination and switch your rules to it.
The add and edit buttons are disabled
Answer
You need Modify Settings. Ask an admin to grant it on Settings > Users.