Alerts

Create alerts from Prowler Cloud findings, deliver them to email recipients and Slack channels, and monitor relevant security changes after scans or in daily digests.

Alerts notify their destinations — email recipients, Slack channels, or both — when security findings match saved filter conditions. Use Alerts to track high-priority findings, monitor specific providers or services, and keep teams informed about scan results that match defined criteria.

Prerequisites

Before creating Alerts, ensure that:

• At least one scan has completed and produced findings.
• The user role includes the manage_alerts permission.
• To deliver Alerts to Slack channels, a Slack workspace is connected, at least one channel is authorized on it, and the integration’s connection check has confirmed that channel. See Slack Integration.

The manage_alerts permission is required to create, edit, test, enable, disable, and delete Alerts. See RBAC Administrative Permissions for details.

How Alerts Work

Alerts are created from Findings filters. When an Alert runs, Prowler Cloud evaluates the saved conditions against findings and notifies the Alert’s destinations when matching findings exist: an email digest to each recipient, a message to each Slack channel, or both. Destination kinds are independent — neither requires the other, and neither displaces the other.

Alerts evaluate findings with status FAIL only. Findings with status PASS or MANUAL, and muted findings, never trigger an Alert regardless of the saved filters.

Alerts run on one of three schedules:

Frequency	Description
After each scan	Evaluates the Alert after each completed scan.
Daily digest	Evaluates the Alert once per day and sends a digest when findings match.
After each scan and daily	Evaluates the Alert after every scan and in the daily digest.

Creating an Alert From Findings

To create an Alert:

1. Navigate to Findings in Prowler Cloud.

2. Apply at least one Alert-compatible filter to define the findings that should trigger the Alert.

3. Click Create Alert.

   

4. Configure the Alert settings:

   • Name: Add a short, descriptive name.
   • Description: Add optional context for the Alert.
   • Frequency: Select when Prowler Cloud should evaluate the Alert.
   • Recipients: Select the recipients who should receive the email digest.
   • Destination channels: Select the Slack channels that should receive the Alert. See Slack Channel Destinations.
   

5. Click Create.

After the Alert is created, Prowler Cloud evaluates it based on the selected frequency.

Alert-Compatible Filters

An Alert-compatible filter is a Findings-page filter that the Alert condition language can evaluate when the Alert runs. The Findings page exposes many filters, but only a specific subset can be saved into an Alert. Filters outside this subset, such as Status, free-text search, sort, or pagination, are ignored when seeding an Alert from the current Findings view.

When Create Alert is clicked on the Findings page, Prowler Cloud takes the active filters, keeps only the Alert-compatible ones, and uses them to build the Alert condition.

The following filters are Alert-compatible:

• Provider type
• Provider
• Severity
• Delta (new findings since the previous scan)
• Region
• Service
• Resource type
• Category
• Resource group

If only the Status filter is applied on the Findings page, Prowler Cloud substitutes all severities as the condition base so the Alert can still be created. Status itself never becomes part of the Alert condition.

Managing Alerts

Navigate to Alerts to review and manage existing Alerts.

The Destinations column summarizes where each Alert delivers, without the Alert being opened:

• Email recipients: The first address, plus a count of the rest, such as [e-mail] +2 more.
• Slack channels: The first channel, plus a count of the rest, such as #sec-alerts +1 more.

Each summary is omitted when that destination kind is empty, and the column reads No destinations when an Alert has neither.

Each Alert provides these actions:

Action	Description
Edit	Update name, description, recipients, Slack channels, frequency, or filters.
Enable/Disable	Start or stop Alert evaluation without deleting the Alert.
Delete	Permanently remove the Alert.

Testing Alert Filters

When editing an Alert, click Test to preview whether the current filters match existing findings.

The test result indicates whether the filters match findings and includes a summary of the matching results.

The Test result is a snapshot, not a guarantee of future Alert triggers.

The Test evaluates the current filters against existing findings at the moment Test is clicked. It does not predict whether the Alert will trigger on its next evaluation. The Alert trigger depends on the state at evaluation time:

• After each scan: The Alert is evaluated against the findings produced by that scan only. If the next scan produces no findings that match the filters, the Alert will not trigger, even if a Test run earlier in the day showed matches.
• Daily digest: The Alert is evaluated against the findings present on the digest day. If no matching findings exist for that day, the Alert will not trigger, even if previous days had matches.

The reverse is also true: a Test showing no matches does not guarantee the Alert will stay silent. Future scans may produce matching findings.

Use Test to validate that the filters are well-formed and target the intended findings, not to forecast future Alert behavior.

Recipients

Alert recipients are selected from the email addresses available in the tenant. Recipients receive an email digest each time an Alert evaluates and matches findings.

By default, the organization owner receives a daily digest for critical findings. Adjust the recipient, frequency, or filters in the Alert configuration to change this behavior.

If a recipient unsubscribes from Alerts, that address stops receiving digests until it is reconfirmed.

An Alert does not require email recipients: an Alert that targets Slack channels only is accepted with those channels as its sole destinations. An Alert with no destinations at all stays valid and keeps evaluating its filters, but it delivers nothing.

Slack Channel Destinations

An Alert can post to Slack channels alongside its email recipients, or instead of them. The Destination channels field sits directly below Recipients in the Alert form, both when creating an Alert and when editing one. When the Alert matches findings, Prowler Cloud posts a message to each of its channels and sends the email digest to each of its recipients, independently of each other.

The channels offered are the confirmed channels of the connected Slack integration, never the whole Slack workspace. Widening the pool takes two steps on the integration: authorize the channel there, then run its connection check, which confirms the channel by posting a one-time confirmation message to it. Once confirmed, the channel is selectable on every Alert. See Slack Integration for connecting a workspace, authorizing its channels, and confirming them.

A channel that was authorized a moment ago but does not appear in the Alert form has not been confirmed yet. Run Test connection on the Slack integration, then reopen the Alert form.

Private channels are identified as Private both in the open channel list and on the selected channels once the list is closed, so a private destination is never mistaken for a public one.

When Slack Channels Cannot Be Selected

The field is always present, so channel delivery is never silently missing. It reports why it cannot be used:

State	What the Alert form shows
No Slack workspace connected	The field is visible but cannot be edited, explaining that posting Alerts to Slack channels needs a connected Slack workspace, with a link to the Slack integration.
Workspace connected, no confirmed channels	A notice that no channels are available yet and that they are authorized and confirmed on the Slack integration, with the same link.

In both states the rest of the Alert is unaffected: it can still be created or saved with its filters, frequency, and email recipients.

Slack destinations stay in step with the integration. Removing a channel from the integration’s authorized set — or disconnecting the Slack integration altogether — removes that channel from every Alert that targeted it, so an Alert never keeps a destination Prowler can no longer deliver to. The Alert keeps its filters, frequency, and email recipients, and future delivery to that channel stops: nothing is posted to announce the removal, and the notifications already delivered stay in the channel. Restoring delivery means authorizing and confirming the channel again on the integration, then selecting it again on the Alert.

Saving an Alert that names a channel which is not a confirmed channel of a connected Slack integration is refused, and the reason is reported on the Alert form. Authorize and confirm the channel on the Slack integration, or remove it from the Alert, and save again.

Email Notifications

When an Alert matches findings, Prowler Cloud sends a security alert email that summarizes the matching findings. The email includes:

• The scan name and evaluation time.
• The total number of matching findings.
• The number of Alert rules that triggered.
• A preview of the affected findings, grouped by severity, with resource details and the originating rule.
• A direct link to view all matching findings in Prowler Cloud.

Best Practices

• Start with focused filters: Create Alerts for specific high-priority scopes, such as critical findings, production providers, or important services.
• Use clear names: Choose names that explain the intent of the Alert.
• Review destinations regularly: Keep recipient lists and channel selections aligned with current ownership.
• Test before saving edits: Use Test after changing filters to confirm that the Alert matches the expected findings.
• Disable instead of deleting during tuning: Disable Alerts temporarily when adjusting filters or destinations.