Messaging & Notifications

VeraID sends real-time notifications to your team’s messaging platforms for critical security events, approval workflows, and operational alerts. Integrations support rich message formatting, interactive actions, and threaded conversations for follow-up.

Supported Platforms

Platform	Notifications	Interactive Actions	Thread Management
Slack	Yes	Yes	Yes
Microsoft Teams	Yes	Yes	Yes
Discord	Yes	No	Yes
PagerDuty	Yes (forwarding)	N/A	N/A
Jira Service Management	Yes (ticket creation)	N/A	N/A

---

Slack

Setup

1. Navigate to Settings > Integrations > Messaging > Slack.
2. Click Connect to Slack to initiate the OAuth flow.
3. Select the workspace and authorize VeraID.
4. Choose default channels for different notification categories.

Notification Use Cases

Credential Rotation Alerts

When a credential is rotated (automatically or manually), VeraID posts a notification with details about the affected identity, the rotation reason, and a link to the credential in the dashboard.

{
  "channel": "#security-ops",
  "event": "credential.rotated",
  "message": {
    "title": "Credential Rotated",
    "identity": "aws-deploy-prod",
    "credential": "Production AWS Access Key",
    "reason": "Scheduled rotation (90-day policy)",
    "rotatedBy": "SYSTEM",
    "gracePeriod": "24 hours",
    "actions": ["View Credential", "View Identity"]
  }
}

JIT Access Approval Requests

When an identity requests just-in-time access, VeraID sends an interactive approval request to the configured channel or direct message to the designated approver.

The message includes Approve and Deny buttons that trigger the approval workflow directly from Slack without requiring the approver to log in to the VeraID dashboard.

{
  "channel": "#access-approvals",
  "event": "jit.requested",
  "message": {
    "title": "JIT Access Request",
    "requester": "alice@company.com",
    "identity": "gcp-bigquery-analyst",
    "scopes": ["bigquery.datasets.read", "bigquery.jobs.create"],
    "duration": "4h",
    "justification": "Quarterly reporting analysis",
    "actions": ["Approve", "Deny", "View Details"]
  }
}

Security Alerts

High-severity security events are posted with prominent formatting to ensure immediate visibility.

{
  "channel": "#security-alerts",
  "event": "anomaly.detected",
  "message": {
    "title": "Anomalous Activity Detected",
    "severity": "HIGH",
    "identity": "ci-deploy-service",
    "description": "Identity accessed 47 secrets in 2 minutes (baseline: 3-5)",
    "riskScore": 89,
    "actions": ["Suspend Identity", "View Activity", "Dismiss"]
  }
}

Budget Warnings

AI agent budget thresholds trigger notifications when spending approaches configured limits.

{
  "channel": "#ai-ops",
  "event": "budget.warning",
  "message": {
    "title": "AI Agent Budget Warning",
    "identity": "customer-support-agent",
    "budgetUsed": "$847.32",
    "budgetLimit": "$1,000.00",
    "percentUsed": 84.7,
    "period": "monthly",
    "actions": ["Adjust Budget", "View Usage", "Suspend Agent"]
  }
}

Thread Management

VeraID uses Slack threads to group related notifications. For example:

• An initial credential expiry warning is posted as a new message.
• Follow-up reminders at 7 days, 3 days, and 1 day are posted as replies in the same thread.
• The final rotation confirmation is posted as a thread reply, closing the loop.

This keeps channels clean while maintaining full context for each event.

---

Microsoft Teams

Setup

1. Navigate to Settings > Integrations > Messaging > Microsoft Teams.
2. Click Connect to Teams to initiate the OAuth flow with your Azure AD tenant.
3. Select the teams and channels for notifications.

Adaptive Cards

VeraID uses Microsoft Adaptive Cards for rich, interactive notifications in Teams. Cards include structured data, action buttons, and status indicators.

Supported interactive actions:

• Approve / Deny — For JIT access requests and policy exception requests.
• Suspend Identity — Immediately suspend a flagged identity from the Teams notification.
• View in Dashboard — Deep link to the relevant page in the VeraID dashboard.
• Acknowledge Alert — Mark an alert as acknowledged without leaving Teams.

---

Discord

Setup

1. Create a webhook URL in your Discord server settings for the target channel.
2. In VeraID, navigate to Settings > Integrations > Messaging > Discord.
3. Add the webhook URL and configure notification filters.

Capabilities

Discord integration supports:

• Rich embed messages with color-coded severity indicators.
• Thread creation for grouped notifications (e.g., all events related to a single credential rotation).
• Mention roles for high-severity alerts (@security-team).

Note

Discord integration uses webhooks and does not support interactive buttons. For approval workflows, use the Slack or Microsoft Teams integration.

---

PagerDuty

Integration

VeraID forwards high-severity alerts to PagerDuty for incident management and on-call routing.

Setup

1. Create a new integration in your PagerDuty service using the Events API v2 integration type.
2. Copy the integration key.
3. In VeraID, navigate to Settings > Integrations > Messaging > PagerDuty.
4. Provide the integration key and configure severity mapping.

Severity Mapping

Map VeraID alert severities to PagerDuty incident severities:

VeraID Severity	PagerDuty Severity	Behavior
CRITICAL	critical	Triggers incident, pages on-call
HIGH	error	Triggers incident
MEDIUM	warning	Creates alert, no page
LOW	info	Creates alert, no page

Auto-Create Incidents

Configure VeraID to automatically create PagerDuty incidents for specific event types:

{
  "provider": "PAGERDUTY",
  "config": {
    "integrationKey": "abc123...",
    "autoCreateIncidents": true,
    "eventTypes": [
      "anomaly.detected",
      "policy.violated",
      "credential.compromised",
      "identity.suspicious_activity"
    ],
    "severityMapping": {
      "CRITICAL": "critical",
      "HIGH": "error",
      "MEDIUM": "warning",
      "LOW": "info"
    },
    "deduplicationKey": "veraid-{{alertId}}"
  }
}

Tip

Use the deduplicationKey field to prevent duplicate incidents when the same alert fires multiple times. VeraID includes the alert ID by default, ensuring each unique alert creates only one PagerDuty incident.

---

Jira Service Management

Integration

VeraID creates Jira Service Management tickets for security incidents and access requests that require tracking and resolution.

Setup

1. In VeraID, navigate to Settings > Integrations > Messaging > Jira Service Management.
2. Provide your Jira instance URL, project key, and API credentials.
3. Configure issue type mapping and field mapping.

Incident Creation

When VeraID detects a security event that requires investigation, it can automatically create a Jira ticket:

{
  "provider": "JIRA_SERVICE_MANAGEMENT",
  "config": {
    "instanceUrl": "https://yourcompany.atlassian.net",
    "projectKey": "SEC",
    "issueType": "Incident",
    "apiEmail": "veraid-integration@company.com",
    "apiToken": "...",
    "fieldMapping": {
      "summary": "{{alertTitle}}",
      "description": "{{alertDescription}}\n\nIdentity: {{identityName}}\nRisk Score: {{riskScore}}\nDashboard: {{dashboardUrl}}",
      "priority": "{{severity}}",
      "labels": ["veraid", "nhi-security", "{{eventType}}"]
    }
  }
}

Status Sync

VeraID syncs ticket status back from Jira. When a Jira ticket is resolved, the corresponding VeraID alert is automatically marked as resolved, maintaining a single source of truth.

Jira Status	VeraID Alert Status
Open	ACTIVE
In Progress	ACKNOWLEDGED
Resolved	RESOLVED
Closed	RESOLVED

---

Notification Configuration

Channel Routing

Route different event categories to different channels:

{
  "routing": [
    {
      "events": ["credential.rotated", "credential.expiring"],
      "channel": "#credential-ops"
    },
    {
      "events": ["anomaly.detected", "policy.violated"],
      "channel": "#security-alerts",
      "severity": ["HIGH", "CRITICAL"]
    },
    {
      "events": ["jit.requested", "jit.approved", "jit.denied"],
      "channel": "#access-approvals"
    },
    {
      "events": ["budget.warning", "budget.exceeded"],
      "channel": "#ai-ops"
    }
  ]
}

Quiet Hours

Configure quiet hours to suppress non-critical notifications during off-hours. Critical and high-severity alerts always deliver regardless of quiet hours settings.

{
  "quietHours": {
    "enabled": true,
    "timezone": "America/New_York",
    "schedule": {
      "weekdays": { "start": "22:00", "end": "07:00" },
      "weekends": { "allDay": true }
    },
    "bypassSeverities": ["CRITICAL", "HIGH"]
  }
}