---
updatedAt: 2026-09-01T17:53:55.000Z
agentTools:
  projectIndex: https://docs.socket.dev/llms.txt
---

# Notifications

Route organization alerts and supply chain attack campaigns to email, Slack, and Microsoft Teams.

<Callout icon="📘" theme="info">
  Notifications are available on **Team**, **Business**, and **Enterprise** plans.
</Callout>

Use **Settings → Integrations → Notifications** to send Socket events to the inboxes and chat channels your team already watches. You create **channels** (where messages go) and **subscriptions** (which events to send, with optional filters).

This is separate from [Slack alerts](https://docs.socket.dev/docs/slack-alerts) (a single incoming webhook for pull request comments) and [Webhooks](https://docs.socket.dev/docs/webhooks) (HTTP callbacks for your own systems). Notifications is the dashboard workflow for filtered, multi-destination delivery of organization-wide alert activity.

### Key capabilities

* **Email, Slack&#x20;**(coming soon)**, and Microsoft Teams** — Send the same subscription to one or more destinations.
* **Filtered subscriptions** — Limit delivery by alert category, severity, priority, repository, or (for attack campaigns) ecosystem.
* **Digest delivery for alerts** — Organization alert notifications are grouped and sent as a digest so a burst of alerts does not flood the destination. Attack campaign notifications are sent immediately.
* **Email verification** — Email destinations stay inactive until the address is confirmed.

## Prerequisites

* Confirm your Socket account is on a **Team**, **Business**, or **Enterprise** plan.
* Hold an **Owner** or **Admin** role in your Socket organization (required to create and edit channels and subscriptions). **Members** can view notification settings but cannot change them.
* For Slack: permission to install apps in the Slack workspace you want to connect.
* For Microsoft Teams: permission to create a Workflows flow in the team and channel that should receive messages.

## Open the Notifications page

In the Socket dashboard, go to **Settings → Integrations → Notifications** for your organization.

The URL follows this pattern: `https://socket.dev/dashboard/org/{OrgName}/settings/integrations/notifications`

The page has two sections:

* **Channels** — Destinations Socket can deliver to (an email address, a Slack workspace, or a Microsoft Teams webhook).
* **Subscriptions** — Rules that bind an event and filter to one or more channel connections.

<Image src="https://files.readme.io/77f9367762ea857d8fbd7e21087ce9564c9c9250470790b2c2648e69a8374d28-image.png" align="center" width="600px" caption="Notifications settings page showing the Channels table above and the Subscriptions table below" />

## Channels

A **channel** is an integration Socket uses to deliver messages:

| Type                | What you configure                         | Delivery target (connection)                            |
| ------------------- | ------------------------------------------ | ------------------------------------------------------- |
| **Email**           | An email address                           | That address, after it is verified                      |
| **Slack**           | A connected Slack workspace                | Each Slack channel Socket can post to in that workspace |
| **Microsoft Teams** | A display name and a Workflows webhook URL | That Teams channel                                      |

Email and Microsoft Teams each have a single connection. A Slack channel (the Socket workspace integration) can have many connections — one per Slack channel.

<Callout icon="📘" theme="info">
  **Slack** is not yet available.
</Callout>

### Channel status

| Status                   | Meaning                                                                                                                                                                                   |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Verification pending** | An email channel is waiting for the recipient to confirm the address. It cannot be used in a subscription until it is **Active**.                                                         |
| **Active**               | The channel is ready to receive notifications.                                                                                                                                            |
| **Inactive**             | The channel is disabled (for example, a Slack workspace that is no longer connected).                                                                                                     |
| **Failing**              | The last several deliveries failed. Hover the badge to see the last error. Socket keeps retrying; fix the destination (inbox, Slack membership, or Teams webhook) or replace the channel. |

<Image src="https://files.readme.io/b217d3362ebb622d06e9c4f8a5a17f98f76d59bf7af8e9c43e76ee4e2da15d5c-image.png" align="center" width="600px" caption="Channels table with Type, Identifier, and Status columns, including an Active email channel and a Verification pending email channel" />

## Create an email channel

1. On the Notifications page, click **Create Channel**.
2. Select **Email**, then click **Next**.

<Image src="https://files.readme.io/c75262d0e1c7fa0b7f4560f95086f92b1f7ad151ed1b3778762220c577cef577-image.png" align="center" width="600px" caption="Create Channel dialog on the Select Channel Type step, with Email selected" />

3. Enter the **Email Address** that should receive notifications, then click **Create**.

Socket sends a verification email with the subject **Confirm your email for Socket notifications**. The channel appears with status **Verification pending**.

<Image src="https://files.readme.io/a47f0ad8b34140c8a97de64fa2fd6caa36680efcb474a235e3baf05399122c6a-image.png" align="center" width="480px" />

4. Open the verification email and click the confirmation link.
5. You must be **signed in to Socket as an Owner or Admin** of the organization for verification to succeed. The link expires after **24 hours**.

When verification succeeds, the Notifications page shows a success banner and the channel status becomes **Active**. You can now select it when creating a subscription.

If the link is invalid or expired, delete the pending channel and create it again. Socket sends a new verification email.

## Create a Microsoft Teams channel

Microsoft Teams uses a Workflows incoming webhook (the current Microsoft-supported replacement for Office Connector incoming webhooks).

1. In Microsoft Teams, create a Workflows flow with the **Post to a channel when a webhook request is received** template. Copy the HTTP POST URL. See [Microsoft’s instructions](https://support.microsoft.com/en-us/office/create-incoming-webhooks-with-workflows-for-microsoft-teams-8ae491c7-0394-4861-ba59-055e33f75498).
2. On the Notifications page, click **Create Channel**.
3. Select **Microsoft Teams**, then click **Next**.
4. Enter a **Channel Name** (a label in Socket, for example `Security Alerts`) and paste the **Webhook URL**.
5. Click **Create**.

Socket sends a test Adaptive Card to the Teams channel. If that delivery succeeds, the channel is **Active** and ready for subscriptions.

<Image src="https://files.readme.io/e22364d49e3675112acbf68eedda8faf967b4caa5a5e92a89f808c067dd823e1-image.png" align="center" width="600px" />

## Delete a channel

1. In the Channels table, open the ··· menu on the row and select **Delete**.
2. Confirm the channel type and identifier, then click **Delete**.

<Image src="https://files.readme.io/7038ce0c863535d9f821a5e06755809a10a75965fd46b06f989bdc258430b566-image.png" align="center" width="540px" caption="Delete Channel confirmation dialog" />

Deleting a channel cannot be undone. Socket removes its connections from every subscription. A subscription that has no remaining connections is deleted as well.

## Subscriptions

A **subscription** is: an event + a filter + one or more connections.

Create separate subscriptions when different teams should get different events or filters (for example, critical vulnerabilities to `#security`, license alerts to a legal mailing list).

<Image src="https://files.readme.io/cbc73cbc9ed08fafb5d7b8e2c6de8108b840f6f5b0bc7a170495795bf2edfcfa-image.png" align="center" width="600px" caption="Subscriptions table with Event, Filters, Connection(s), and Status columns" />

### Subscription status

| Status             | Meaning                                                                                           |
| ------------------ | ------------------------------------------------------------------------------------------------- |
| **Active**         | Every connected destination is active.                                                            |
| **Warning**        | Some connections are active and some are not (for example, one email still pending verification). |
| **Inactive**       | None of the connections can currently receive messages.                                           |
| **No connections** | The subscription has no destinations. Recreate it or add connections by editing it.               |

## Create a subscription

Click **Create Subscription** to start the wizard.

### 1. Select event

Choose the event that should trigger the subscription.

| Event                          | When it fires                                                                                                                                                        |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Organization alert created** | A new organization-wide alert appears.                                                                                                                               |
| **Organization alert changed** | An existing organization alert is updated.                                                                                                                           |
| **Organization alert cleared** | An organization alert is no longer present.                                                                                                                          |
| **Attack campaign detected**   | Socket publishes a supply chain attack campaign that impacts your organization. This option appears when campaign notifications are available for your organization. |

<Image src="https://files.readme.io/b3e1fcf61b8e149a93f1e7e8b3efc8d0c9674cad88b109ae6446635099661313-image.png" align="center" width="600px" caption="Create Subscription dialog on the Select Event step" />

### 2. Configure filter

Filters limit which events are delivered. Values in the **same** field match if **any** selected value matches. Values across **different** fields must **all** match. Leave a field unset to mean “any”.

#### Organization alert events

You must select at least one of the following:

* **Category** — Supply chain risk, Vulnerability, Quality, Maintenance, License, Other. See [Alert Categories](https://docs.socket.dev/docs/package-issues).
* **Severity** — Critical, High, Medium, Low.
* **Priority** — Critical, High, Medium, Low (Socket’s alert priority score).
* **Repositories** — Only alerts that appear in the selected repositories.

<Image src="https://files.readme.io/a032c52617cba7a6fead1e8bacee276eb1ce7791a0ff1d74e30e9c4bdf17a1b5-image.png" align="center" width="600px" caption="Create Subscription dialog on the Configure Filter step for an organization alert event" />

#### Attack campaign detected

Filters are optional. With no filter, every matching campaign is delivered.

* **Ecosystems** — Only campaigns that involve the selected package ecosystems.
* **Repositories** — Only when one of the selected repositories is impacted.

<Image src="https://files.readme.io/57da51b73771a407913ca3ea9eefb124b3ca25c0a665d85dc79646eaf6bb1372-image.png" align="center" width="600px" caption="Create Subscription dialog on the Configure Filter step for Attack campaign detected" />

### 3. Select connections

Choose where to send matching events. Only **Active** channels appear.

1. Select a **Channel** (the email address, Slack workspace, or Teams destination).
2. Select a **Connection** (for Slack, the specific Slack channel; for email and Teams this is usually filled in automatically).
3. Click **+** to add it. Repeat to send the same subscription to multiple destinations.
4. Click **Create**.

<Image src="https://files.readme.io/e113832363d7d48df8794d00b06bb59911173d67b7506e578c13bc7ad03ab1b8-image.png" align="center" width="600px" />

If you see **No connections found**, create and verify a channel first. Pending email channels do not appear until they are **Active**.

## Edit or delete a subscription

* **Edit** — Click the subscription row, or open the ⋮ menu and select **Edit**. You can change the event, filter, and connections.
* **Delete** — Open the ··· menu, select **Delete**, and confirm.

<Image src="https://files.readme.io/96f8753437c114418b2f3ac81c5837312483e7cfdd2a891f9553ce690817a0cb-image.png" align="center" width="540px" />

## How delivery works

* **Organization alert created / changed / cleared** — Socket groups matching alerts and sends a **digest** after a short wait (about **20 minutes** from the first matching alert in the window). This applies to email, Slack, and Microsoft Teams so a scan that opens many alerts does not post dozens of separate messages.
* **Attack campaign detected** — Sent as soon as the campaign is published for your organization.
* **Email** — HTML message with a link to the relevant alerts in the dashboard, plus an unsubscribe link. Unsubscribing removes that email connection from the subscription; it does not delete the channel.
* **Slack** — A formatted message in each subscribed Slack channel.
* **Microsoft Teams** — An Adaptive Card in the channel that owns the Workflows webhook.

## Unsubscribe from email notifications

Every notification email includes an unsubscribe link. Opening it and confirming stops that address from receiving that subscription. Admins can add the connection back by editing the subscription.

Unsubscribing from one subscription does not remove the email channel or other subscriptions that use the same address.

## Permissions

| Role        | Capabilities                                                               |
| ----------- | -------------------------------------------------------------------------- |
| Owner       | Create, edit, and delete channels and subscriptions; verify email channels |
| Admin       | Create, edit, and delete channels and subscriptions; verify email channels |
| Member      | View channels and subscriptions                                            |
| Contributor | Cannot access notification settings                                        |

## Troubleshooting

<Accordion title="I don’t see Notifications in Settings">
  Confirm the organization is on a Team, Business, or Enterprise plan, and that your role is Owner, Admin, or Member. Contributors cannot open this page.
</Accordion>

<Accordion title="Slack or Microsoft Teams is marked Coming Soon">
  That destination is not enabled for your organization yet. You can still use email. Contact [support](https://docs.socket.dev/docs/contact-support) if you expected it to be available.
</Accordion>

<Accordion title="Email channel stays on Verification pending">
  1. Check the inbox (and spam) for **Confirm your email for Socket notifications**.
  2. Open the link while signed in as an **Owner** or **Admin** of the organization.
  3. If the link is older than 24 hours, delete the channel and create it again.
  4. The address you enter must be one an Owner or Admin can use to complete verification in the dashboard.
</Accordion>

<Accordion title="The verification link shows an error">
  The link is invalid or expired, or the signed-in user cannot manage notification settings. Sign in as an Owner or Admin and try again, or recreate the email channel.
</Accordion>

<Accordion title="No connections found when creating a subscription">
  Create at least one **Active** channel first. Email channels must be verified. For Slack, connect a workspace and confirm Socket can see the Slack channels you want (invite the app to private channels).
</Accordion>

<Accordion title="Slack messages are not arriving">
  1. Confirm the subscription status is **Active** and the Slack connection is listed.
  2. For private channels, invite the Socket Slack app to the channel.
  3. Check **Settings → Integrations → Slack** that the workspace is still connected.
  4. If the channel row shows **Failing**, hover the badge for the last error. Reconnect the workspace or recreate the Slack notification channel if the app was uninstalled.
</Accordion>

<Accordion title="Microsoft Teams messages are not arriving">
  1. Confirm you used a Workflows webhook URL, not a retired Office Connector incoming webhook.
  2. Open the Workflows flow in Teams and confirm it is still enabled.
  3. Recreate the Teams channel in Socket if you regenerated the webhook URL. Socket sends a test card on create — if that card never appeared, the URL is not valid.
</Accordion>

<Accordion title="We received a digest instead of one message per alert">
  Organization alert notifications are batched. Socket waits up to about 20 minutes and sends a single digest for matching alerts. Attack campaign notifications are not batched.
</Accordion>

<Accordion title="I cannot create or edit notifications">
  Only Owners and Admins can change notification settings. Members have a read-only view.
</Accordion>

<Accordion title="Need more help?">
  If you encounter problems not covered here, [contact support](https://docs.socket.dev/docs/contact-support).
</Accordion>

## Next steps

* [Organization Alerts](https://docs.socket.dev/docs/organization-alerts) — Review and manage alerts across all repositories.
* [Alert Categories](https://docs.socket.dev/docs/package-issues) — How Socket classifies package issues used in notification filters.
* [Webhooks](https://docs.socket.dev/docs/webhooks) — Receive the same kinds of events as HTTP callbacks for your own automation.
* [Slack alerts](https://docs.socket.dev/docs/slack-alerts) — Post pull request scan notifications to a single Slack incoming webhook.
* [Linear Integration](https://docs.socket.dev/docs/linear-integration) / [Jira Integration](https://docs.socket.dev/docs/jira-integration) — Create tickets from alerts instead of (or in addition to) chat and email.