Create an event notification in the UI

1. Go to https://app.stairwell.com and login
2. Select the gear icon on the bottom left
3. Select Event Notifications
4. Select Create Event Notification
5. On the Details screen...
   1. Type the desired notification name
   2. Select the desired object environment(s)
   3. Select Next

6. On the Conditions screen...
   1. YARA Rule Match will match any YARA rule in the environments selected on the conditions screen to any object in the environments selected on the details screen
      1. Recommendation: Pro Rules, Stairwell Research Rules, and user environments that have YARA rules
   2. Threat Report Indicator Match will match any Threat Report IOC in the environment selected on the conditions screen to any object in the environments selected on the detail screen
      1. Default: Threat Report Feeds (recommended to not change this unless custom feeds have been setup)
   3. High Confidence Mal-Eval Score will match any high confidence Mal-Eval score to any object in the environments selected on the detail screen.
   4. Objects Marked Malicious will match any malicious opinion to any object in the environments selected on the detail screen.
   5. Select Next

7. On the Destinations screen...
   1. Select the destination type: Webhook, API, or Email
   2. Type in the URI or Email Addresses depending on the type above
   3. Select Test
   4. Select Save

Delivering notifications to Slack

If you have a Slack webhook , you can send notifications to a channel by using the https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXXlink as your destination URL. The Slack JSON format is well suited to these messages, and will provide details about each match in your environment.