Create an event notification in the UI

1. Go to https://app.stairwell.com and login
2. Click on the settings icon on the left menu
3. Select the "Event notifications" tab under the "Integrations" section
4. Select "Create Event Notification"
5. On the "Details" screen:
   1. Type the desired notification name
   2. Select the desired object environment(s)
   3. Select "Next"

6. On the "Conditions" screen:
   1. YARA Rule Match will match any YARA rule in the environments selected on the conditions screen to any object in the environments selected on the details screen
      1. Recommendation: Pro Rules, Stairwell Research Rules, and user environments that have YARA rules
   2. Threat Report Indicator Match will match any Threat Report IOC in the environment selected on the conditions screen to any object in the environments selected on the detail screen
      1. Default: Threat Report Feeds (recommended to not change this unless custom feeds have been setup)
   3. High Confidence Mal-Eval Score will match any high confidence Mal-Eval score to any object in the environments selected on the detail screen.
   4. Objects Marked Malicious will match any malicious opinion to any object in the environments selected on the detail screen.
   5. Select "Next"

7. On the "Destinations" screen:
   1. Select the destination type: Webhook, API, or Email
   2. Type in the URI or Email Addresses depending on the type above
   3. Select "Test"
   4. Select "Save"

Delivering notifications to Slack

If you have a Slack webhook , you can send notifications to a channel by using the https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXXlink as your destination URL. The Slack JSON format is well suited to these messages, and will provide details about each match in your environment.