Skip to main content

Slack and Teams Notifications

Findings are only useful if someone sees them. This guide wires Kostavo into Slack or Microsoft Teams: a digest for the routine flow and immediate alerts for the findings that cannot wait.

Get a Webhook URL​

Kostavo posts to an incoming webhook, so create one first:

Slack: create an incoming webhook for the target channel (Slack admin: Apps → Incoming Webhooks). You get a URL starting with https://hooks.slack.com/services/….

Teams: add an incoming webhook to the target channel (channel Connectors or a Workflows-based webhook). You get a URL on outlook.office.com or *.logic.azure.com.

Treat webhook URLs like secrets. Anyone holding one can post to your channel.

Create the Channel in Kostavo​

  1. Go to Organization → Notifications
  2. Click the new channel button
  3. Pick the type (Slack or Teams), name it after the real channel (e.g. #data-platform-alerts), and paste the webhook URL

The notification channel editor with delivery settings

Choose Delivery Modes​

Each channel has two independent modes, and most teams want both:

ModeBehaviorUse for
DigestOne consolidated summary per scan cycleThe routine flow: cost findings, low severity, trends
ImmediateA message the moment a finding meets the severity thresholdSecurity and production incidents

For immediate mode, set the severity threshold deliberately. high means high and critical findings alert instantly and everything else waits for the digest. Starting with critical and loosening later beats training the team to mute the channel.

Test It​

Save the channel, then use Test channel to send a test message. If nothing arrives:

  • Slack: the webhook URL was revoked or belongs to another channel
  • Teams: the connector was removed or the URL was truncated when pasting

A delivered test message proves the whole path; scan-triggered notifications use the same one.

The notification channels page with configured channels

Patterns That Work​

  • One digest channel per team, matched to the workspaces they own, plus one org-wide immediate channel at the critical threshold
  • A FinOps email digest alongside the chat channels: email channels take a recipient list instead of a webhook
  • Route by profile ownership: the team whose profile raised the finding is the team whose channel should hear about it