Notification Administration¶

Overview¶

Administrators can configure system-wide notification settings, including global webhooks for external integrations, agent offline monitoring parameters, and view all user webhook configurations.

Access notification settings via Admin Settings > Notifications.

Global Webhook¶

The global webhook allows administrators to send all notification events to a central endpoint for monitoring, logging, or integration with external systems.

Configuration¶

Setting Up Global Webhook¶

1. Navigate to Admin Settings > Notifications
2. Expand the Global Webhook Settings section
3. Toggle Enable Global Webhook
4. Enter the webhook URL
5. (Optional) Set a signing secret for payload verification
6. (Optional) Add custom headers in JSON format:

   {
     "Authorization": "Bearer your-token",
     "X-Custom-Header": "value"
   }
   

7. Click Save

Testing Global Webhook¶

Before relying on the global webhook:

1. Click Test Global Webhook
2. A test payload is sent to the configured URL
3. Verify receipt in your monitoring system
4. Check for any error messages

Global Webhook Payload¶

The global webhook receives all notification events with additional context:

{
  "type": "job_completed",
  "title": "Job Completed",
  "message": "Job 'NTLM Attack' completed successfully",
  "user": {
    "id": "user-uuid",
    "username": "operator1",
    "email": "operator1@example.com"
  },
  "data": {
    "job_id": "job-uuid",
    "job_name": "NTLM Attack",
    "total_cracked": 150
  },
  "timestamp": "2024-01-15T10:30:00Z"
}

Use Cases¶

• Centralized Logging: Send all events to a SIEM or logging platform
• Team Notifications: Route critical alerts to a shared Slack/Discord channel
• Custom Integrations: Trigger external workflows on specific events
• Compliance: Maintain an external record of security events

Agent Offline Buffer¶

The agent offline buffer prevents notification spam when agents briefly disconnect due to network issues.

How It Works¶

1. When an agent disconnects, a buffer timer starts
2. If the agent reconnects within the buffer period, no notification is sent
3. If the buffer expires without reconnection, an "Agent Offline" notification is sent
4. Only the agent's owner receives the offline notification

Configuration¶

Setting Buffer Duration¶

1. Navigate to Admin Settings > Notifications
2. Expand Agent Offline Buffer Settings
3. Enter the desired buffer duration in minutes
4. Click Save

Recommendations¶

User Webhooks Overview¶

Administrators can view all user-configured webhooks for monitoring and troubleshooting.

Viewing User Webhooks¶

1. Navigate to Admin Settings > Notifications
2. Expand User Webhooks Overview
3. View the table of all user webhooks

Webhook Information Displayed¶

Administrative Notes¶

• Administrators can view but not edit user webhooks
• Users manage their own webhooks through Settings > Notifications
• Use this view to troubleshoot webhook delivery issues
• Monitor for webhooks with high failure counts

Notification Email Templates¶

KrakenHashes includes email templates for all notification types. Templates are managed in Admin Settings > Email > Templates.

Notification-Specific Templates¶

Template Variables¶

Templates support the following variables:

Customizing Templates¶

1. Navigate to Admin Settings > Email > Templates
2. Select the notification template to edit
3. Modify the HTML and/or plain text content
4. Use the preview feature to verify appearance
5. Save the template

System Settings Database¶

Notification settings are stored in the system_settings table:

Security Considerations¶

Webhook Security¶

1. Use HTTPS: Always configure webhook URLs with HTTPS
2. Set Secrets: Enable HMAC signing for payload verification
3. Validate Origins: Configure receiving systems to validate signatures
4. Limit Exposure: Use dedicated webhook endpoints, not general APIs

Audit Logging¶

All security notifications are automatically logged to the audit log:

• Suspicious login attempts
• MFA disabled events
• Password changes
• Webhook failures

See Audit Log for details on viewing and filtering security events.

Mandatory Security Notifications¶

The following notification types cannot be disabled by users:

• security_mfa_disabled
• security_password_changed

These always trigger both in-app and email notifications to ensure users are aware of critical account changes.

Troubleshooting¶

Global Webhook Not Receiving Events¶

1. Verify the webhook is enabled
2. Test the webhook using the Test button
3. Check the URL is accessible from the server
4. Review custom headers for syntax errors
5. Check server logs for delivery errors

Agent Offline Notifications Too Frequent¶

1. Increase the buffer duration
2. Check network stability to agents
3. Review agent heartbeat configuration
4. Consider agent placement relative to network boundaries

Email Notifications Not Sending¶

1. Verify email provider is configured (see Email Configuration)
2. Check email templates exist for notification types
3. Review email service logs for errors
4. Verify monthly email limit hasn't been reached

User Webhooks Failing¶

1. View webhook statistics in User Webhooks Overview
2. Contact the user to verify their endpoint
3. Check for rate limiting or firewall issues
4. Review the last error message for debugging