Webhook Notifiers: Slack, Discord, and Generic SIEM

When a sandbox run finishes with one or more deviations, the FANGS notifier dispatches a single webhook POST per configured target containing the full deviation summary for that run. Targets are stored in the database and survive orchestrator restarts; delivery attempts are logged in the notifications table for audit and post-mortem. If the orchestrator is restarted mid-retry, the in-flight attempt is lost — the audit log records the last known state.

Adding a Notifier

Use fangs notifier add with the flags below:

Flag	Required	Description
`-name`	✅	Unique identifier for this target
`-url`	✅	Webhook URL. Must be `https://` in production; `http://` only allowed for loopback hosts (`127.0.0.1`, `localhost`, `::1`)
`-template`		`slack` \| `discord` \| `generic` (default: `generic`)
`-secret-env`		Name of the env var holding the HMAC secret. Generic template only — ignored for Slack and Discord
`-min-severity`		Fire only when the run’s max deviation severity ≥ this value: `low` \| `medium` \| `high` \| `critical`
`-headers`		Extra request headers as a JSON string-map, e.g. `'{"X-API-Key":"$KEY"}'`
`-enabled`		`true` \| `false` (default: `true`)

fangs notifier add \
  -name soc-slack \
  -url https://hooks.slack.com/services/T000/B000/xxxx \
  -template slack

Templates

FANGS ships three built-in templates. Each produces a different JSON structure tuned for its target.

Slack
Discord
Generic (SIEM)

The Slack template produces an incoming-webhook payload using Block Kit. A top-level text field ensures deviations appear in mobile push previews.

{
  "text": "🚨 FANGS deviation: axios@1.8.2 — 3 findings (max: crit)",
  "blocks": [
    {
      "type": "header",
      "text": { "type": "plain_text", "text": "🚨 FANGS deviation: axios@1.8.2 — 3 findings (max: crit)", "emoji": true }
    },
    {
      "type": "section",
      "text": { "type": "mrkdwn", "text": "Run `18b1f8a3c2e1` · package `axios` · version `1.8.2`" }
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "• *crit* `1.2.3.4:31337` — net_new_destination\n• *warn* `/root/.ssh/id_rsa` — fs_new_path_read"
      }
    }
  ]
}

Up to 12 findings are shown inline; additional findings appear as a … and N more line. Slack and Discord use the URL as the secret — the -secret-env flag is ignored for these templates.

The Discord template produces a webhook embed payload. The embed color reflects the maximum deviation severity.

Severity	Color
`crit`	Red (`#E3635D`)
`warn`	Amber (`#D3A851`)
`info`	Blue (`#6DA3D8`)
other	Grey (`#808080`)

{
  "username": "FANGS",
  "embeds": [
    {
      "title": "FANGS deviation: axios@1.8.2",
      "description": "**3 findings** (max severity: **crit**)\nRun `18b1f8a3c2e1`",
      "color": 14902109,
      "fields": [
        { "name": "crit · net_new_destination", "value": "`1.2.3.4:31337`", "inline": false },
        { "name": "warn · fs_new_path_read", "value": "`/root/.ssh/id_rsa`", "inline": false }
      ]
    }
  ]
}

The generic template is FANGS-native — use it when piping into a SIEM, event bus, Lambda, or any custom consumer.

{
  "source": "fangs-orchestrator",
  "schema_version": "v1",
  "run_id": "18b1f8a3c2e1f09a3b4c5d6e7f8a9b0c",
  "package_name": "axios",
  "version": "1.8.2",
  "state": "done",
  "is_baseline": false,
  "max_severity": "crit",
  "deviation_count": 3,
  "deviations": [
    {
      "id": "a1b2c3d4e5f6",
      "category": "net_new_destination",
      "value": "1.2.3.4:443",
      "severity": "warn",
      "evidence_event_id": 42
    }
  ]
}

The deviations array contains every finding for the run — no truncation. Each item maps directly to a row in the deviations table and includes the evidence_event_id you can look up with fangs deviation show.

HMAC Request Signing

Generic-template targets can optionally sign every POST body with HMAC-SHA256. Set -secret-env to the name of a process environment variable that holds the shared secret. At delivery time the orchestrator reads the value of that env var, computes HMAC-SHA256(secret, body), and adds:

X-FANGS-Signature: sha256=<hex>

Your receiver verifies by computing the same HMAC over the raw request body and doing a constant-time comparison.

-secret-env takes an env var name, not the secret value itself. The secret never appears in the database or in CLI output — only the env var name is stored.

# Set the secret in the orchestrator's environment
export FANGS_WEBHOOK_SECRET="my-shared-secret"

# Register the target, referencing the env var by name
fangs notifier add \
  -name siem \
  -url https://siem.example.com/fangs \
  -template generic \
  -secret-env FANGS_WEBHOOK_SECRET

HMAC signing is intentionally skipped for slack and discord templates — those services use the webhook URL itself as the authenticator.

Retry Policy

Each delivery attempt runs independently in a background goroutine. The retry logic is:

Outcome	Behavior
HTTP 2xx	Sent — no further attempts
HTTP 4xx (except 408, 429)	Permanent failure — no retry; bad request won’t improve
HTTP 408, 429	Transient — retry with backoff
HTTP 5xx	Transient — retry with backoff
Network / timeout error	Transient — retry with backoff

Backoff formula: delay = baseDelay × 2^(attempt-1) with ±25% jitter, so concurrent targets don’t thunderherd. Default baseDelay is 1 second; maximum 5 attempts per run per target.

The retry state is in-memory only. If the orchestrator restarts while a target is mid-retry, that delivery is lost. The notifications table records the last attempt status for post-mortem review.

Severity Filtering

Use -min-severity to prevent low-signal runs from flooding a high-priority channel. The notifier evaluates the maximum deviation severity across the whole run before deciding whether to fire.

# Only page the SOC channel on critical findings
fangs notifier add \
  -name soc-pager \
  -url https://hooks.slack.com/services/T000/B000/yyyy \
  -template slack \
  -min-severity critical

# Log everything high-and-above to the SIEM
fangs notifier add \
  -name siem-high \
  -url https://siem.example.com/fangs \
  -template generic \
  -min-severity high

Managing Notifiers

# List all configured targets
fangs notifier list

# Fire a synthetic test POST (not HMAC-signed)
fangs notifier test soc-slack

# Show delivery history for a specific run
fangs notifier history -run 18b1f8a3c2e1

# Remove a target
fangs notifier remove soc-slack

fangs notifier test fires the appropriate template-specific test payload immediately without touching the deviation database. The test POST is not HMAC-signed even on targets that have -secret-env configured — it is a connectivity check only.

Boot-Time Notifiers File

Instead of running fangs notifier add interactively, you can supply a JSON file at orchestrator startup with -notifiers-file. The orchestrator upserts each entry at boot. CLI-added entries coexist — the file is additive, not authoritative. The file accepts either a top-level JSON array or an object with a notifiers key:

[
  {
    "name": "soc-slack",
    "url": "https://hooks.slack.com/services/T000/B000/xxxx",
    "template": "slack"
  },
  {
    "name": "siem",
    "url": "https://siem.example.com/fangs",
    "template": "generic",
    "secret_env": "FANGS_WEBHOOK_SECRET",
    "min_severity": "high",
    "enabled": true
  }
]

Each entry requires name, url, and template. Optional fields are secret_env, headers (map), min_severity, and enabled (boolean, default true).

fangs-orchestrator -notifiers-file config/notifiers.json

Get Started

Architecture

Configuration

Operations

Security

Webhook Notifiers: Slack, Discord, and Generic SIEM

Adding a Notifier

Templates

HMAC Request Signing

Retry Policy

Severity Filtering

Managing Notifiers

Boot-Time Notifiers File

Build docs developers (and LLMs) love

Get Started

Architecture

Configuration

Operations

Security

Documentation Index

​Adding a Notifier

​Templates

​HMAC Request Signing

​Retry Policy

​Severity Filtering

​Managing Notifiers

​Boot-Time Notifiers File

Build docs developers (and LLMs) love

Adding a Notifier

Templates

HMAC Request Signing

Retry Policy

Severity Filtering

Managing Notifiers

Boot-Time Notifiers File