Creating alert templates

View as Markdown

Community Platform

With the Rules Engine, you define rules that alert you on specific events, such as changes to scans, assets, and Explorers. Custom templates standardize and format the alert messages those rules send, and let you add more context and data to each alert.

A template can output raw HTML, a runZero HTML template, JSON, or text for use in emails, internal notifications, or webhooks.

Like rules and channels, a template can serve any number of organizations, and any user with User role access to all of those organizations can manage it. A user with Viewer role access to one or more organizations can view template details only, and can’t edit or create templates.

Template building basics

You write alert messages in the Mustache templating language. With a little Mustache syntax, you can build custom HTML and JSON templates that pull in runZero data.

  • For Slack notifications, build a rich JSON message with Slack’s Block Kit and the interactive Block Kit Builder, then use Mustache to insert the data.

  • For Microsoft Teams, build rich messages in the Adaptive Cards format and insert data the same way.

A template has two fields, subject and body, and both accept Mustache syntax.

Inserting data in a template

runZero passes a standard set of objects to the template engine; you name the fields you want to insert. Use the Mustache syntax {{variable}} to include alert values when a rule matches.

In HTML and JSON templates, values inserted with {{ }} are escaped according to the rules for that format. To insert a value unescaped, use triple curly braces: {{{task.name}}}.

In JSON templates, the special self variable {{.}} at the top level outputs all available variables and their values as JSON.

Special rules for JSON

JSON templates render single values and multiple values differently:

  • A string or number renders as its raw value. Embedded quotes in a string are escaped, but the string isn’t wrapped in quotes, so you can put several strings or numbers into one JSON string in your template.

  • An object or array renders as its full JSON representation, so you can dump arrays and objects to JSON without looping through values. But if you wrap an array value in quotes to put it inside a JSON string, the result is invalid JSON.

Take this template running on an asset with multiple IP addresses:

{
"addresses_1": {{addresses}}, 
"addresses_2": "{{#addresses}}{{.}} {{/addresses}}",
"addresses_3": "{{addresses}}"
}

The result:

{
"addresses_1": ["10.0.1.4","10.1.7.5"], 
"addresses_2": "10.0.1.4 10.1.7.5 ",
"addresses_3": "["10.0.1.4","10.1.7.5"]"
}

The addresses_1 substitution works as you’d expect: {{addresses}} is an array, so it becomes a proper JSON array of the addresses.

The second substitution also works. The template loops through each address in the array and puts the values into a single string. The values aren’t quoted, but any quotes inside them are escaped.

The third substitution fails: the addresses become a JSON array of strings, and the surrounding quotes make the result invalid JSON.

Using the runZero HTML template

The runZero HTML template option wraps your alert template body in an HTML template that runZero provides. It makes consistent rich-content notification emails easier to create, and includes a base set of CSS classes you can apply to your template’s contents.

Class name Description
padding-sm Applies a small amount of padding in each direction.
padding-md Applies a medium amount of padding in each direction.
color-yellow Applies a yellow text color to the target text
preamble Creates a “preamble” block intended to go below the header. p tags within this block have a slightly larger font size and line height.
card Creates a block that has a thin border, slightly rounded corners, and a slightly lighter background color than the main background color.
section Similar to the card block, but with a darker background and a small amount of bottom margin. section is intended to be used within card.
preserve-newlines Preserves newline characters in the contained text. preserve-newlines is intended to be paired with section, but can be used anywhere.
button Creates a button with styling similar to the standard button seen in the runZero console, with a light blue background, white text color, and slightly rounded corners. When paired with size-lg, the button is given a slightly larger font size and a minimum width.

These elements also have specific styles:

Tag name Description
h1 Bold font-weight, white text color, a moderate amount of bottom margin, considerably larger font size, and center-aligned text.
h2 Bold font-weight, white text color, a moderate amount of bottom margin, and a moderately larger font size.
h3 Normal font-weight, white text color, a small amount of bottom margin.
p 8 pixel bottom margin
hr Thin light blue top border, with a considerable amount of margin above and below.
a Light blue text color.

This example for the site-created event uses that template type and these classes:

<div class="preamble padding-md">
  <h1>Site created</h1>
  <p>A new site was created in an organization</p>
</div>

<div class="card padding-md">
  <h3>{{site.name}} attributes</h3>
  <div class="section padding-sm">
    <p>Created at: {{event.created_at}}</p>
    <p>ID: {{site.id}}</p>
    <p>Organization: {{organization.name}}</p>
    <p>Created by {{event.source_type}}: {{event.source_name}}</p>
  </div>
  <a class="button size-lg" href="{{console}}/sites/{{site.id}}/?_oid={{organization.id}}">View site</a>
</div>

We try to keep templates of this type backwards compatible, but the available classes and predefined styling may change without warning.

Inserting a value

To insert a value, put the variable name in double curly brackets: {{variablename}}.

This example inserts the console address:

The runZero Console is at {{console}}.

Inserting a value from an object

To insert a value from a specific object, join the object name and field name with a dot: {{object.fieldname}}.

This example inserts the organization name:

The organization name is {{organization.name}}.

Inserting multiple values from an object

To insert several values from one object, use a section. Open it with {{#objectname}} and close it with a matching {{/objectname}}.

This example inserts the results of a scan, including the total assets and the number of assets changed:

Here are the results:
{{#scan}}
Scan found {{assets_total}} assets and changed {{assets_changed}} of them.
{{/scan}}

Fields with multiple values

If a section refers to a field with multiple values, the template engine loops through them and renders the section once for each value.

This example loops through every asset in report.new and outputs each one’s names and addresses fields. If report.new is empty, the section between the tags isn’t rendered.

{{#report.new}}
{{names}} {{addresses}}
{{/report.new}}

Inside a loop, you can still refer to values from the outer object. If a named value isn’t found in the current loop object, the template engine checks the outer object. This can be useful for the {{console}} variable, which holds the root runZero console URL.

Using boolean values

Boolean values work with the {{#field}}{{/field}} tags. If the field is false, the section between the tags isn’t rendered.

For example:

{{#query.truncated}}
(Additional results were found but not included in this report)
{{/query.truncated}}

Objects and fields reference

Build your template from these objects and fields to include runZero data and details in your alerts.

globals

Field Contents Example
console The base URL of the runZero web console. https://console.runzero.com

event

The event object has these fields:

Field Contents Example
action The action which triggered the event task-completed
created_at When the event was created 2021-04-02 12:50:26 -0500
id The UUID of the event b4b871db-bdf1-4a42-b82d-18ae99972228
source_name Name of the thing which caused the event Weekly security scan
source_type Type of thing which caused the event task
success Whether the event succeeded true
target_name Name of the object targeted by the event Head Office
target_type The type of the object targeted by the event site

task

For events triggered by a task, the task object has these fields:

Field Contents Example
created_at When the task was created 2021-04-02 12:50:26 -0500
created_by The user who created the task user@example.com
description The description of the task Weekly scan of main network
error The text of any error message for the task explorer unavailable after 4h
id The UUID of the task b4b871db-bdf1-4a42-b82d-18ae99972228
name The name of the task Weekly Scan
start_time When the task started 2021-04-02 12:50:26 -0500
status The status of the task processed
type The type of task scan
updated_at When the task was last updated 2021-04-02 12:50:26 -0500
url A URL linking to the task details

organization

The organization object has these fields:

Field Contents Example
id The UUID of the organization 86f12ee1-f0f1-419a-8799-63fff555777a
name The name of the organization IT Dept.

site

The site object has these fields:

Field Contents Example
id The UUID of the site 49f9323a-fea1-4afc-b490-2414c3aaaeee
name The name of the site Head Office

rule

The rule object has these fields:

Field Contents Example
action The action the rule said to take notify
created_at When the rule was created 2021-03-08 12:43:59 -0600
created_by The user who created the rule user@example.com
event The event triggering the rule scan-completed
id The UUID of the rule b2269a2c-69a1-4652-bcdf-899938886c17
name The name of the Rule Alert on scan
updated_at When the rule was last updated 2021-04-01 17:09:40 -0500

channel

The channel object has these fields:

Field Contents Example
id The UUID of the channel 7c9f0d5a-0f8e-4b3b-8a2e-1d9b5f1c2c3d
name The name of the channel Notify auditors
type The channel type email

scan

For events triggered by a scan task, a scan object adds these fields:

Field Contents Example
explorer_id The UUID of the runZero Explorer which carried out the scan 0fd44a62-d827-41c0-b26c-4837222d8888
assets_changed The number of assets changed as a result of the scan 9
assets_ignored The number of assets ignored by the scan 2
assets_new The number of new assets detected by the scan 2
assets_offline The number of assets which were previously online but now offline 1
assets_online The number of assets previously offline but now online again 2
assets_total The total number of assets for the site scanned (including offline) 11
assets_unchanged The number of assets unchanged by the scan 1
assets_updated The total number of assets up-to-date as a result of the scan (changed + unchanged) 15
duration Duration of the scan in seconds 26
end_time When the scan ended 2021-04-02 12:50:26 -0500
excludes Any IP addresses excluded from the scan 10.0.1.123
id The UUID of the scan task 894a112c-3fb9-4301-8da7-8ce7fffb4443
name The name of the scan task Weekly security scan
rate The scan rate 1000
recv_bytes How many bytes were received during the scan 45176
recv_error How many receive errors were detected 1
recv_packets How many data packets were received during the scan 555
scheduled_time When the scan was scheduled to run 2021-04-02 12:48:00 -0500
sent_bytes How many bytes were sent during the scan 44740
sent_error How many send errors were detected 0
sent_packets How many data packets were sent during the scan 577
start_time When the scan began running 2021-04-02 12:49:55 -0500
tags An array of tags associated with the scan task
targets The CIDR address ranges scanned 10.0.1.0/24
type The type of operation scan

explorer

For events triggered by a scan task, an explorer object adds these fields (runZero 2.1.8+):

Field Contents Example
id The UUID of the runZero Explorer which carried out the scan 0fd44a62-d827-41c0-b26c-4837222d8888
name The name of the Explorer which carried out the scan MM34B-2
internal_ip The internal IP address of the Explorer which carried out the scan 10.0.1.200

For events triggered by a search query rule, a search object adds these fields:

Field Contents Example
url A link to perform the same search https://console.runzero.com/inventory/?search=…
found The number of matches found 3
comparator The operation used to compare the number of matches >=
value The value the number of matches was compared against 1

report

For “scan completed” events, a report object holds these results from the scan:

Field Contents
truncated Whether the set of objects was truncated due to large numbers of assets
changed An array of changed assets (see below)
new An array of new assets (see below)
offline An array of assets now offline (see below)
online An array of assets now online (see below)

The template receives at most 25 objects for email notifications and 10 for Webhook notifications.

asset (from a scan report)

Each asset in a scan report has these fields:

Field Contents
addresses The IP address(es) of the asset 10.0.1.123
alive Whether the asset responded to probes true
created_at The timestamp when the asset record was created 2021-04-02 12:50:26 -0500
criticality_rank The criticality rank (0-5) 1
detected_by The method by which the asset was detected arp
domains Any domains the asset was found in WORKGROUP
first_seen The timestamp when the asset was first seen 2021-04-02 12:50:26 -0500
hw A summary of the asset hardware HP LaserJet Pro
id The UUID of the asset b38295fb-bef1-fa42-b82d-18ae99972228
last_seen The timestamp when the asset was most recently seen 2021-04-02 12:50:26 -0500
macs Any MAC addresses detected for the asset 00:56:55:00:91:04
modified_risk_rank The risk rank after applying user overrides 2
names Any names detected for the asset LP538N
os A summary of the asset’s operating system Linux
outlier_score The normalized outlier score (0-5) 2
risk_rank The normalized risk rank (0-4) 4
service_count How many services the asset is running 4
software_count How many software entries were identified on the asset 10
type The type of asset Router
updated_at The timestamp when the asset record was last updated 2021-04-02 12:50:26 -0500
vulnerability_count How many vulnerabilities were identified on the asset 4

query

For query events, the query variable provides this data:

Field Contents
count The number of rows matching the search query
assets If it was an asset search, the array of assets matching the query
services If it was a service search, the array of services matching the query
wlans If it was a wireless network search, the array of wireless networks matching the query
truncated Whether the set of assets was truncated due to the query returning a large number

A query passes at most 25 assets to the template for email notifications and 10 for Webhook notifications.

asset (from a query)

Assets returned from a query rule have these fields:

Field Contents
addresses The IP address(es) of the asset 10.0.1.123
alive Whether the asset responded to probes true
comments Any comments set in the asset record
created_at The timestamp when the asset record was created 2021-04-02 12:50:26 -0500
detected_by The method by which the asset was detected arp
domains Any domains the asset was found in WORKGROUP
first_seen The timestamp when the asset was first seen 2021-04-02 12:50:26 -0500
hw A summary of the asset hardware ThinkPad X1
id The UUID of the asset b38295fb-bef1-fa42-b82d-18ae99972228
last_seen The timestamp when the asset was most recently seen 2021-04-02 12:50:26 -0500
macs The list of MAC addresses associated with the asset [F4:F5:E8:89:92:31, 00:D0:2D:9F:47:77]
names Any names detected for the asset laptop.local
organization The organization the asset belongs to IT
os A summary of the asset’s operating system Windows 10
service_count How many services the asset is running 4
site The site the asset was detected at New York
tags An array of tags set on the asset
type The type of asset Thermostat
updated_at The timestamp when the asset record was last updated 2021-04-02 12:50:26 -0500

service (from a query)

Services returned from a query rule have these fields, some taken from the associated asset:

Field Contents Example
id The UUID of the service (not the asset) b38efadb-61f1-f332-b92d-18ae99972228
created_at When the service record was created 2021-04-02 12:50:26 -0500
summary A summary of the service ciscoSystems
port The TCP/UDP port the service is on 53
vhost The vhost of the service ftp.example.com
address The TCP/IP address of the service 192.168.33.44
transport The transport udp
protocol The name of the protocol, if known ssh
organization The name of the organization the service’s asset belongs to HR
site The name of the site the service’s asset belongs to Lab
alive Whether the asset offering the service was alive true
last_seen When the asset was last seen 2021-04-02 12:50:26 -0500
first_seen When the asset was first seen 2021-02-11 09:38:17 -0500
type The asset type offering the service Laptop
os The OS offering the service Linux
hw The hardware offering the service APC UPS
addresses A list of other IP addresses associated with the asset offering the service [192.168.0.2, 192.168.0.3]
macs The list of MAC addresses associated with the asset [F4:F5:E8:89:92:31, 00:D0:2D:9F:47:77]
names Any names associated with the asset [fw-3, fw-3a]
tags Tags set on the asset
domains Any domain associated with the asset LOCAL
service_count A count of how many services the asset offers 4
comments Any comments set on the asset

certificates (from a query)

Certificates returned from a query rule have these fields:

Field Contents Example
id The UUID of the certificate ff6a8817-828a-43a3-b2cb-596dff5f0bd5
type The type of certificate x509
self_signed Whether the certificate is self-signed true
names All names associated with the certificate [“example.com”, “www.example.com”]
serial The serial number of the certificate 0A014A1D4D0F861EC4C6EFD6E13A2F
validity_start When the certificate becomes valid 2025-11-06 15:58:04 -0500
validity_end When the certificate expires 2025-11-08 15:58:04 -0500
validity_period The total validity period in seconds 172800
public_key_algorithm The algorithm used for the public key rsaEncryption
public_key_bits The size of the public key in bits 2048
signature_algorithm The algorithm used for the signature sha256WithRSAEncryption
fp_bkhash The BKHash fingerprint of the certificate d2c7e8f9a1b2c3d4e5f6
fp_sha1 The SHA1 fingerprint of the certificate 3c482c71d874763e560c617129793dec76e91196
fp_sha256 The SHA256 fingerprint of the certificate 19vJPgdyh3BdGgTiSSavQsKx133lzFkJhu51n6fzG+k=
cn The common name from the certificate subject example.com
subject The subject distinguished name CN=example.com,O=Example Corp,C=US
issuer The issuer distinguished name CN=Example CA,O=Example Corp,C=US
is_ca Whether the certificate is a certificate authority false
key_usage The key usage extension values digitalSignature
ext_key_usage The extended key usage extension values serverAuthentication
san_dns_names Subject Alternative Name DNS entries [“example.com”, “www.example.com”]
san_ip_addresses Subject Alternative Name IP entries [“192.168.1.1”]
san_email_addresses Subject Alternative Name email entries [“admin@example.com”]
san_uris Subject Alternative Name URI entries [“spiffe://example.com/service”]
public_key_insecure Whether the public key is considered insecure false
signature_insecure Whether the signature algorithm is considered insecure false
public_key_parameters Parameters for the public key, if any map[rsa_exponent:65537 rsa_modulus:244…]
name_constraints Name constraints extension, if present map[]
comments Any comments set on the certificate “Issued for legacy system”
tags Tags applied to the certificate [“production”, “web”]
risk_rank The calculated risk rank (-1..5) 2
modified_risk_rank The modified risk rank if set 1
risk Either modified risk rank if set or risk_rank if unset as a name “info”
vulnerability_count Number of vulnerabilities associated 3
service_address The address of the associated service 192.168.1.10
service_port The port of the associated service 443
service_transport The transport protocol of the service tcp
asset_site_id The UUID of the associated site 49f9323a-fea1-4afc-b490-2414c3aaaeee
asset_site_name The name of the associated site “Head Office”
asset_id The UUID(s) of associated assets b38295fb-bef1-fa42-b82d-18ae99972228

wlan (wireless LAN, from a query)

Wireless LANs (wlans) returned from a query rule have these fields:

Field Contents Example
id The UUID of the wireless LAN in runZero’s database f938934b-ae23-f112-b23d-18ae99972228
last_seen When the wlan was last seen 2021-04-02 12:50:26 -0500
essid The ESSID of the network Free WiFi
bssid The BSSID of the network c4:41:1e:99:88:77
type The type of wireless network infrastructure
authentication The authentication used to access the network WPA2-PSK
encryption The encryption used to protect data AES
signal The signal strength as a percentage 86
channels The channel of the network 11
organization The name of the organization the service’s asset belongs to HR
site The name of the site the service’s asset belongs to Lab

findings_with_instances

Field Contents Example
finding_category The category of the finding Open Access
finding_code The code of the finding rz-finding-open-access-default-credentials
finding_id The ID of the finding b1f8a2e7-3c4d-4e6a-9c2f-1a5e7d8b9c0a
finding_name The name of the finding Service Accessible With Default Credentials
finding_risk_rank The normalized risk rank of the finding (0-4) 3
finding_vulnerability_count How many vulnerabilities are associated with the finding; the same value as new_vulnerability_count 8
new_vulnerability_count How many vulnerabilities are associated with the finding after the task was run 8
old_vulnerability_count How many vulnerabilities were associated with the finding the last time the task was run 5
organization_id The ID of the organization e2d3c4b5-6a7b-8c9d-0e1f-2a3b4c5d6e7f
site_id The ID of the site f3e4d5c6-b7a8-9c0d-1e2f-3a4b5c6d7e8f
site_name The name of the site Primary
task_id The ID of the task a4b5c6d7-e8f9-0a1b-2c3d-4e5f6a7b8c9d
task_name The name of the task Metrics
task_start_time The start time of the task 2026-03-02 11:16:59 -0500
task_type The type of the task analysis

rapid_response_published

For rapid-response-published events, the rapid_response_published object contains new, removed and updated lists. Objects in those lists have these fields:

Field Contents Example
id The UUID of the new rapid response query f938934b-ae23-f112-b23d-18ae99972228
name The name of the query Rapid Response: Assets with multiple RCE exploits
description Plaintext description of the query Certain assets can be exploited
solution Plaintext description of how to resolve the issue exposed by this query Update the Chipland Exploitable NVR to v3.2 or newer
query The query contents hw:="Chipland Exploitable NVR"
effective_query Query contents that are used to match assets. Includes any system predicates, such as alive:t. alive:t AND (hw:="Chipland Exploitable NVR")
finding_code The finding code for the query, if assigned rz-finding-rapid-response-assets
exploitable Whether or not the rapid response is known exploitable true
cve Newline-separated list of CVEs that may apply to this query CVE-2025-12345\nCVE-2025-12346
console_inventory_path The path to the console inventory page for the query /inventory
attributes Miscellaneous attributes, such as reference URLs and runZero blog links. See example below table

Example attributes object:

{
  "links": {
    "rz_blog": [
      {
        "title": "How to find Chipland Exploitable NVR on your network",
        "url": "https://www.runzero.com/blog/"
      }
    ],
    "urls": [
      {
        "url": "https://example.local/1.html"
      },
      {
        "url": "https://example.local/2.html"
      }
    ]
  }
}

rapid_response_with_matches

For rapid-response-with-matches events, these fields are available:

Field Contents Example
id The UUID of the rapid response query f938934b-ae23-f112-b23d-18ae99972228
query Attributes of the query. See rapid_response_published for the fields available. See rapid_response_published fields
old_count How many resources matched last time this query was run. 0
new_count How many resources matched the most recent time this query was run. 2

Example: Alert when scan completes

Say you want an alert whenever a scan completes. A rule can email you the details, such as the number of new, online, offline, and modified assets. The steps below build those details into a template.

Step 1. Create a template

Create a template from the Alerts page.

  • Name the template something like Email the team when a scan completes.
  • For the template type, choose HTML, since this template is for emails.
  • For the subject line, enter something descriptive, like runZero scan {{scan.name}} completed at {{scan.end_time}}. The subject accepts Mustache syntax too.

Step 2. Create the body message

The email body reports how many new, online, offline, and modified assets there are, and lists details of the new assets discovered.

The body looks like this:

<h1>{{site.name}}</h1>

<h2>Scan Results</h2>
{{#scan}}
<ul>
<li>{{assets_new}} new assets</li>
<li>{{assets_online}} online assets</li>
<li>{{assets_offline}} offline assets</li>
<li>{{assets_changed}} modified assets</li>
</ul>
{{/scan}}

<h2>New assets</h2>
<ul>
{{#report.new}}
<li>{{names}} {{addresses}} {{os}}</li>
{{/report.new}}
{{^report.new}}
<li>No new assets were discovered.</li>
{{/report.new}}
</ul>

<p><a href="{{task.url}}">View the scan results</a></p>

The caret (^) marks an inverted section, which renders only when the list is empty or the value is empty or false.

Step 3. Save the template and create a rule

Once saved, the template is available to choose when you create a rule.

Sample JSON templates

A JSON array of new assets found by a scan

[
  {{#report.new}}
    {
      "addresses": "{{addresses}}",
      "alive": "{{alive}}",
      "detected_by": "{{detected_by}}",
      "domains": "{{domains}}",
      "first_seen": "{{first_seen}}",
      "hw": "{{hw}}",
      "names": "{{names}}",
      "os": "{{os}}",
      "type": "{{type}}"
    },
  {{/report.new}}
  null
]

The trailing null keeps the array valid JSON, because JSON doesn’t allow trailing commas.

All available attributes

Output all available variables and their attributes as a JSON object:

{{.}}

Or build your own JSON with all attributes:

{
  "event": {
    "action": "{{event.action}}",
    "created_at": "{{event.created_at}}",
    "id": "{{event.id}}",
    "source_name": "{{event.source_name}}",
    "source_type": "{{event.source_type}}",
    "success": "{{event.success}}",
    "target_name": "{{event.target_name}}",
    "target_type": "{{event.target_type}}"
  },
  "organization": {
    "name": "{{organization.name}}",
    "id": "{{organization.id}}"
  },
  "site": {
    "name": "{{site.name}}",
    "id": "{{site.id}}"
  },
  "report": {
    "truncated": "{{report.truncated}}",
    "changed": "{{report.changed}}",
    "new": "{{report.new}}",
    "offline": "{{report.offline}}",
    "online": "{{report.online}}"
  },
  "rule": {
    "action": "{{rule.action}}",
    "created_at": "{{rule.created_at}}",
    "created_by": "{{rule.created_by}}",
    "event": "{{rule.event}}",
    "id": "{{rule.id}}",
    "name": "{{rule.name}}",
    "updated_at": "{{rule.updated_at}}"
  },
  "scan": {
    "explorer_id": "{{scan.explorer_id}}",
    "assets_changed": "{{scan.assets_changed}}",
    "assets_ignored": "{{scan.assets_ignored}}",
    "assets_new": "{{scan.assets_new}}",
    "assets_offline": "{{assets_offline}}",
    "assets_online": "{{scan.assets_online}}",
    "assets_total": "{{scan.assets_total}}",
    "assets_unchanged": "{{scan.assets_unchanged}}",
    "assets_updated": "{{scan.assets_updated}}",
    "duration": "{{scan.duration}}",
    "end_time": "{{scan.end_time}}",
    "excludes": "{{scan.excludes}}",
    "id": "{{scan.id}}",
    "name": "{{scan.name}}",
    "rate": "{{scan.rate}}",
    "recv_bytes": "{{scan.recv_bytes}}",
    "recv_error": "{{scan.recv_error}}",
    "recv_packets": "{{scan.recv_packets}}",
    "scheduled_time": "{{scan.scheduled_time}}",
    "sent_bytes": "{{scan.sent_bytes}}",
    "sent_error": "{{scan.sent_error}}",
    "sent_packets": "{{scan.sent_packets}}",
    "start_time": "{{scan.start_time}}",
    "tags": "{{scan.tags}}",
    "targets": "{{scan.targets}}",
    "type": "{{scan.type}}"
  },
  "explorer": {
    "id": "{{explorer.id}}",
    "name": "{{explorer.name}}",
    "internal_ip": "{{explorer.internal_ip}}"
  },
  "search": {
    "url": "{{search.url}}",
    "found": "{{search.found}}",
    "comparator": "{{search.comparator}}",
    "value": "{{search.value}}"
  },
  "query": {
    "count": "{{query.count}}",
    "assets": "{{query.assets}}",
    "services": "{{query.services}}",
    "wlans": "{{query.wlans}}",
    "truncated": "{{query.truncated}}"
  }
}

Event attributes only

{
  "event": {{event}}
}

or

{
  "action": "{{event.action}}",
  "created_at": "{{event.created_at}}",
  "id": "{{event.id}}",
  "source_name": "{{sevent.ource_name}}",
  "source_type": "{{event.source_type}}",
  "success": "{{event.success}}",
  "target_name": "{{event.target_name}}",
  "target_type": "{{tevent.arget_type}}"
}

Organization attributes only

{
  "organization": {{organization}}
}

or

{
  "name": "{{organization.action}}",
  "id": "{{organization.id}}"
}

Site attributes only

{
  "site": {{site}}
}

or

{
  "name": "{{site.action}}",
  "id": "{{site.id}}"
}

Report attributes only

{
  "report": {{report}}
}

or

{
  "truncated": "{{report.truncated}}",
  "changed": "{{report.changed}}",
  "new": "{{report.new}}",
  "offline": "{{report.offline}}",
  "online": "{{report.online}}"
}

Rule attributes only

{
  "rule": {{rule}}
}

or

{
  "action": "{{rule.action}}",
  "created_at": "{{rule.created_at}}",
  "created_by": "{{rule.created_by}}",
  "event": "{{rule.event}}",
  "id": "{{rule.id}}",
  "name": "{{rule.name}}",
  "updated_at": "{{rule.updated_at}}"
}

Scan attributes only

{
  "scan": {{scan}}
}

or

{
  "explorer_id": "{{scan.explorer_id}}",
  "assets_changed": "{{scan.assets_changed}}",
  "assets_ignored": "{{scan.assets_ignored}}",
  "assets_new": "{{scan.assets_new}}",
  "assets_offline": "{{assets_offline}}",
  "assets_online": "{{scan.assets_online}}",
  "assets_total": "{{scan.assets_total}}",
  "assets_unchanged": "{{scan.assets_unchanged}}",
  "assets_updated": "{{scan.assets_updated}}",
  "duration": "{{scan.duration}}",
  "end_time": "{{scan.end_time}}",
  "excludes": "{{scan.excludes}}",
  "id": "{{scan.id}}",
  "name": "{{scan.name}}",
  "rate": "{{scan.rate}}",
  "recv_bytes": "{{scan.recv_bytes}}",
  "recv_error": "{{scan.recv_error}}",
  "recv_packets": "{{scan.recv_packets}}",
  "scheduled_time": "{{scan.scheduled_time}}",
  "sent_bytes": "{{scan.sent_bytes}}",
  "sent_error": "{{scan.sent_error}}",
  "sent_packets": "{{scan.sent_packets}}",
  "start_time": "{{scan.start_time}}",
  "tags": "{{scan.tags}}",
  "targets": "{{scan.targets}}",
  "type": "{{scan.type}}"
}

Explorer attributes only

{
  "explorer": {{explorer}}
}

or

{
  "id": "{{explorer.id}}",
  "name": "{{explorer.name}}",
  "internal_ip": "{{explorer.internal_ip}}"
}

Search attributes only

{
  "search": {{search}}
}

or

{
  "url": "{{search.url}}",
  "found": "{{search.found}}",
  "comparator": "{{search.comparator}}",
  "value": "{{search.value}}"
}

Query attributes only

{
  "query": {{query}}
}

or

{
  "count": "{{query.count}}",
  "assets": "{{query.assets}}",
  "services": "{{query.services}}",
  "wlans": "{{query.wlans}}",
  "truncated": "{{query.truncated}}"
}

Asset, service, or wireless query alert to SIEM or SOAR

{
  "organization": {
    "name": "{{organization.name}}",
    "id": "{{organization.id}}"
  },
  "site": {
    "name": "{{site.name}}",
    "id": "{{site.id}}"
  },
  "rule": {
    "action": "{{rule.action}}",
    "created_at": "{{rule.created_at}}",
    "created_by": "{{rule.created_by}}",
    "event": "{{rule.event}}",
    "id": "{{rule.id}}",
    "name": "{{rule.name}}",
    "updated_at": "{{rule.updated_at}}"
  },
  "search": {
    "url": "{{search.url}}",
    "found": "{{search.found}}",
    "comparator": "{{search.comparator}}",
    "value": "{{search.value}}"
  }
}

Asset, service, or wireless query alert to Slack

{
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": ":red_circle: *runZero Alert* - {{rule.name}}"
      }
    },
    {
      "type": "divider"
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Rule information*\n\n_Name_: {{rule.name}}\n_Type_: {{rule.event}}\n_Link_: https://console.runzero.com/alerts/rules/{{rule.id}}"
      }
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Match information*\n\n_Organization_: {{organization.name}}\n_Site_: {{site.name}}\n_Match count_: {{search.found}}\n_Search_: {{search.value}}\n_Link_: {{search.url}}"
      }
    }
  ]
}

Asset, service, or wireless query alert to Microsoft Teams

{
  "type": "message",
  "attachments": [
    {
      "contentType": "application/vnd.microsoft.card.adaptive",
      "contentUrl": null,
      "content": {
        "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
        "type": "AdaptiveCard",
        "version": "1.5",
        "body": [
          {
            "type": "TextBlock",
            "text": "runZero Alert - {{rule.name}}"
          },
          {
            "type": "TextBlock",
            "text": "**Rule information**\n\n_Name_: {{rule.name}}\n\n_Type_: {{rule.event}}\n\n_Link_: [Rule](https://console.runzero.com/alerts/rules/{{rule.id}})",
            "wrap": true
          },
          {
            "type": "TextBlock",
            "text": "**Match information**\n\n_Organization_: {{organization.name}}\n\n_Site_: {{site.name}}\n\n_Match count_: {{search.found}}\n\n_Search_: {{search.value}}\n\n_Link_: [Search]({{search.url}})",
            "wrap": true,
            "spacing": "Medium"
          }
        ]
      }
    }
  ]
}

Data type accepted by each channel

When you create a rule, the channel you select must accept the template’s data type. For example, a Slack notification needs a plain text or JSON template.

Each channel accepts these data types:

Channel Data type
Email Plain text, HTML, JSON
Webhook Plain text, JSON
Internal notification Plain text

Managing templates

Go to Alerts > Templates to create, edit, and delete templates. Before deleting a template, make sure no rule is using it. If you delete a template that a rule still uses, the rule reverts to the default template. To put a template to work, follow the Alerting on asset and service changes playbook.

Updated