Cyberlop chat notifications: set up a webhook for finished scans

Chat notifications in Cyberlop are a single incoming-webhook URL, saved once in Settings → Notifications. When a scan finishes, Cyberlop posts the target name, the finding counts and a link to the scan to that channel. It never posts the findings themselves. Paste the URL, click Save webhook, then click Send test message to confirm it works.

What are Cyberlop chat notifications?

With a chat notification, a finished scan shows up in a channel your team already reads. Nobody has to keep refreshing Recent Scans. It is set up for the whole organisation, not per person. One webhook serves every scan the organisation runs, and only your organisation's scans are sent to it.

The feature runs on an incoming webhook. Most chat tools offer one: the tool gives you a private HTTPS address, and any message sent to that address appears in the channel you chose. If the term is new, the Knowledge Hub entry on a webhook explains the idea in plain English.

What does the message contain?

The help text on the Notifications screen lists three things that go out when a scan finishes:

• the target name,
• the finding counts,
• a link to the scan in Cyberlop.

The screen is explicit that the findings themselves are never sent. Payloads, requests, responses and reproduction steps stay inside Cyberlop, behind your sign-in. The link opens the scan in Cyberlop, where the detail lives.

What is not posted?

The app does not show a per-event switch, a severity filter or a choice of channel on this screen. The captured screen has one field and two buttons. If you need a quieter feed, narrow it in the chat tool, for example by pointing the webhook at a channel built for it. The app does not say whether a failed or cancelled scan also posts, so test that before you rely on it.

How do you set up a chat webhook?

You create the webhook in your chat tool, paste it into Cyberlop and test it. The whole job takes a few minutes, and it needs someone who can change organisation settings. The API reference shows that saving settings requires the settings:update permission, so an administrator is usually the right person.

Steps to connect a channel

1. Pick the channel. Choose a channel that the people who act on scan results already read, such as a security or engineering channel. Avoid a channel with hundreds of members if the scans cover sensitive targets, because target names are visible to everyone there.
2. Create an incoming webhook in your chat tool. Use its integrations or apps area, choose incoming webhooks, select the channel and copy the HTTPS URL it gives you.
3. Open Settings → Notifications. The status pill reads "No webhook — notifications are off." until a webhook is saved.
4. Paste the URL into Webhook URL. The field hides what you type, like a password field.
5. Click Save webhook. Cyberlop stores the URL encrypted and never shows it again.
6. Click Send test message. The button stays disabled until a webhook is set. Check the channel for the test post.
7. Run a short scan to see the real message. Start one from Scan Profiles or a target page, as described in run a scan, and wait for it to finish.

Fields on the Notifications screen

The table lists every control on the screen and what it does.

How do you test the connection?

Use Send test message. It sends a test message to the saved webhook. The same check is available to scripts as POST /api/settings/verify-webhook, which sends a test message to the URL in the request body or to the stored one. Like saving, it needs the settings:update permission.

A passing test proves the address works. It does not prove the right people watch the channel, so ask a teammate who does not manage the integration to confirm they saw it.

If the test message does not arrive

Work through these in order. Most failures are a copy error or a deleted webhook, not a Cyberlop fault.

1. Re-copy the URL from your chat tool and paste it again. A trailing space or a cut-off address is the usual cause.
2. Confirm the address starts with https://. The screen asks for an HTTPS URL, and the HTTPS scheme exists so that requests are confidential and the server is authenticated, as RFC 9110 describes.
3. Open the webhook in your chat tool and check that it is still active and points at a channel that exists.
4. Check whether your network team limits outbound posts from the chat workspace, or limits who may add integrations.

If the test works but a finished scan posts nothing

Confirm that the scan belongs to the organisation whose settings you changed, and that it has actually reached the end. A scan that is still running has not finished yet. For the phases, see the scan detail page. If a scan ended in an error, failed or cancelled scans explains how to read it.

How do chat notifications differ from email notifications?

They are separate and you can use both. Chat is an organisation setting for a shared channel. Email is a personal setting on My Account, where two checkboxes control what is sent to your own address.

One split that works: the shared channel says a scan is done, and email tells whoever launched it that something critical or high turned up. See account and organisation settings for the full page.

How do you keep a webhook URL safe?

Treat the URL as a secret. Whoever has the address can post into that channel. A leaked one lets a stranger put believable messages in front of your team. Cyberlop hides the field, encrypts the stored value and does not show it again after saving. The rest of the care is yours.

Leaked credentials are common and slow to die, which is why this deserves five minutes. GitGuardian's State of Secrets Sprawl 2025 counted 23,770,171 new secrets in public code-host commits in 2024, a 25% rise, and found that 70% of secrets leaked in 2022 were still valid. The same report says 38% of incidents in collaboration tools are classed as highly critical or urgent, a higher share than in code repositories. Chat is exactly where urgent things, and secrets, get pasted.

Habits that keep the URL out of trouble

Store it like any other secret

Keep the original in your team's password manager or vault rather than in a ticket, a wiki page or a chat message. The OWASP Secrets Management Cheat Sheet advises rotating secrets regularly, so that "any stolen credentials will only work for a short time". See also secrets management and hardcoded secrets.

Replace it on a schedule and after any exposure

Create a new webhook in your chat tool, paste it into Webhook URL, click Save webhook and send a test message. Then delete the old webhook in the chat tool so the old address stops working. The same habit is called key rotation elsewhere.

Limit who can change it

Changing the webhook needs settings:update. Keep that permission with the few people who administer the workspace, following least privilege. The API tokens and permissions guide shows how permission keys work.

What about turning notifications off?

The captured screen offers Save webhook and Send test message and no separate remove button. To stop posts now, delete the webhook in your chat tool. In most tools that makes the address reject messages. Then ask your administrator about clearing the saved value. The status pill reports "No webhook — notifications are off." when none is stored.

What should the channel do with the message?

A notification is only useful if someone acts on it. The message gives you a target, counts and a link, so agree a small routine before the first post arrives.

Pair the channel with scheduled scans or the CI/CD job and the notification becomes a steady heartbeat: each run ends with a short post. The message carries counts only and arrives once per scan, so it adds little to alert fatigue. For the reading order inside the app, see the issues list.

What are the common mistakes?

• Pasting a link to a page instead of a webhook. The URL must be the incoming-webhook address from the chat tool, not a channel link.
• Using a public channel for sensitive targets. The message names the target, so choose a channel with the right audience.
• Expecting finding details in chat. They are not sent by design. Follow the link.
• Skipping the test. It takes one click and catches most typing errors.
• Leaving an old webhook alive after replacing it. Delete it in the chat tool.
• Scanning things you do not own. Notifications do not change the rule: only scan applications you own or are authorised to test.

Next step

With notifications on, the next piece of automation is a scan that runs inside your own network. Continue with self-hosted scan agents. You can also read how the audit trail records changes in the activity feed, or see the API reference for the settings endpoints.