Skip to content

Send alerts to Slack

Alerts go to the channels an admin adds in Settings, Connectors: email, Slack, Microsoft Teams, Discord, Telegram, PagerDuty, Opsgenie or your own signed webhook. Nothing to install; removing a channel stops it at once.

How do I install it?

  1. Email, Slack or your own webhook

    In Settings, Connectors, add an email address, a Slack incoming webhook, or your https webhook (copy its signing secret, shown once). To approve fixes from Slack, add your workspace id, approvers and a bot token.

  2. Teams, Discord or Telegram

    Paste a Teams workflow address, a Discord webhook address, or a Telegram bot token from @BotFather and the chat id.

  3. PagerDuty or Opsgenie

    Paste a PagerDuty Events API v2 integration key or an Opsgenie API key, and pick US or EU. Their schedules decide who is woken.

How you know it worked. Press Send test on the channel in Settings, Connectors; it really sends.

Signed in? Open this guide with your own valuesNot signed in: sign in, then open Settings, Setup guides.

What do I need first?

  • Alert channels have no plan gate. Approving a fix from Slack needs a plan with approval-gated fixes (Growth and Scaled).
  • An admin role in MarshalCloud to add, test or remove a channel.
  • Nothing to open on your side: alerts are posted from our own servers. Only your own webhook must accept HTTPS from the internet.

What access does it grant?

What it installs

  • Nothing on your servers. A channel is a saved address or key; the list shows only a masked label, never the full address or key.

What it can do

  • Post alerts to the one channel, chat, pager or address you added.
  • In Slack, with your workspace id and approvers set: show Approve buttons that only those people can use. With a bot token, open a channel for an incident.
  • Sign every webhook post with X-Marshal-Timestamp and X-Marshal-Signature headers, so your code can prove it came from us and is fresh.

What it never does

  • Show the address or key back in full: the list shows only a masked label.
  • Put a webhook address, phone number or token into a message.
  • Post a webhook to a private or internal address: it must be public https, checked again on every send.
  • Ring a phone or send a text message: not in this version.

How do I check or remove it?

  1. Remove the channel

    In Settings, Connectors, press Remove on the channel. Sending to it stops at once.

  2. Remove it on the other side

    Delete the webhook, bot or key in Slack, Teams, Discord, Telegram, PagerDuty or Opsgenie as well. For Slack approvals, clear the bot token under Approve fixes from Slack first.

How do I check a post came from us?

Each post is JSON with schema, id, kind, severity, title, body, created_at, url and notice, signed with your secret. Refuse a post with a wrong signature or over five minutes old.

  1. Check the signature

    The signature is v1= and an HMAC-SHA256 of the timestamp, a dot and the raw body, before any JSON parsing.

    Python
    import hashlib
import hmac
import time

SIGNING_SECRET = "<your webhook signing secret>"
TOLERANCE_SECONDS = 300


def is_from_marshalcloud(body: bytes, timestamp: str, signature: str) -> bool:
    """body: the raw request body, before any JSON parsing.
    timestamp: the X-Marshal-Timestamp header. signature: the X-Marshal-Signature header."""
    try:
        sent_at = int(timestamp)
    except (TypeError, ValueError):
        return False
    if abs(time.time() - sent_at) > TOLERANCE_SECONDS:
        return False  # too old: someone may be replaying a post
    mac = hmac.new(SIGNING_SECRET.encode(), timestamp.encode() + b"." + body, hashlib.sha256)
    return hmac.compare_digest("v1=" + mac.hexdigest(), signature or "")