Alerts and notifications

SlashPeak can tell you when something needs a look. Alerts go to email, Slack and an HTTPS webhook. All of them are on every plan, including the trial.

Set them up in Settings → Notifications:

• At the top, an owner sets up Slack and the Webhook.
• Below, each alert type has its own section. Each section has a switch for Email me, Slack and Webhook. A Slack or webhook switch stays off until that channel is set up.

Who can change whatCopy Anchor Link

• Each person picks their own email choices, owners and viewers alike.
• Owners set the account-wide parts: budget rule, anomaly rule, Slack, webhook, muted anomalies and which report parts each person gets.

What can alert youCopy Anchor Link

EmailCopy Anchor Link

Each person has these email choices. Each one is in the section of its alert type:

Account and security emails are always sent: sign-in, password, trial ending, payment failed and similar.

Report emailsCopy Anchor Link

The report email sums up the period and attaches the Excel report: the same file as the dashboard's Email report button. See Excel report.

• Who gets it: owners and viewers only. A member with no role gets no report.
• How often: each person picks in Settings → Notifications → Reports. An owner can also set it for each person in Report contents (How often). Every day is on Growth, Pro and Enterprise. The trial and Starter pick every week or every month. After a move to a lower plan, a daily choice sends weekly.
• When: at 08:00 in your account's time zone. Daily covers the day before. Weekly goes out on Mondays and covers the 7 days before. Monthly goes out on the 1st and covers last month.
• What is in it: an owner picks the parts each person gets in Settings → Notifications → Report contents: Executive summary, Top offenders, Operational efficiency, Anomalies and Findings. Every part is on by default. The email text and the Excel file both hold only the picked parts. Keep at least one part; to stop the email, the person picks Never.
• With more than one connection, the email attaches one file per connection.
• No report goes out until your first scan finishes, or after a trial ends.
• To get the report now, click Email report on the dashboard. It sends the file for the range and filters on the page, with only your parts. If your Reports setting is Never, the page tells you to turn it on first, or to ask an owner.

Budget alertsCopy Anchor Link

Budget alerts warn you when spend is on track to go over your spend commit, or over a cost center's monthly budget.

1. An owner sets a spend commit in Settings → Billing (an amount per month, or per year on a plan billed yearly, with a start date for a yearly commit), or a Monthly budget on a cost center in Settings → Cost centers. You can set both.
2. In Settings → Notifications → Budget alerts, turn on Budget alert rule and pick Alert at (% of commit or budget). Default: 80%. Allowed: 1% to 200%, up to 10 thresholds.
3. In the same section, each person turns Email me on or off. An owner turns Slack and Webhook on or off.

How it works:

• After each scan, SlashPeak forecasts the spend at the end of the period. For the commit, it is the same forecast as the dashboard's Commit used tile. For a cost center, it is the Budget used tile when the dashboard is filtered to that cost center.
• You get one alert for each threshold the forecast crosses. When several cross at once, one alert names the highest.
• Each threshold alerts once per period: per commit period for the commit, per calendar month for a cost center.
• In the first 3 days of a period the forecast is too noisy, so it does not alert, unless the spend has already passed a threshold.
• A cost center alert names the cost center and links to the dashboard filtered to it. Its webhook payload has a costCenter object (id, name); for the commit, costCenter is null.

Anomaly alertsCopy Anchor Link

Every anomaly is an alert. See Anomalies for how they are found.

• Alert when back to normal: an owner can turn this on to get a second message when the metric is back in its range.
• Muted anomalies: anomalies an owner marked "Not an anomaly". Each mute lasts 30 days. Click undo to remove one.
• A connection's first scan never sends anomaly alerts.

SlackCopy Anchor Link

1. In Slack, create an incoming webhook for the channel you want.
2. In Settings → Notifications → Slack, paste the URL (https://hooks.slack.com/services/…).
3. Click Send test alert.
4. Turn on Slack in each alert section you want: Anomaly alerts, Budget alerts, High-severity findings, Scan summaries, Scan failures.

The URL is encrypted and never shown again after you save. Paste a new one to replace it, or click Remove webhook.

WebhooksCopy Anchor Link

Use a webhook to send alerts to your own system, PagerDuty, Opsgenie, a ticket tool and so on.

1. In Settings → Notifications → Webhook, paste an HTTPS URL. Slack URLs belong in the Slack section.
2. Click Send test payload.
3. Turn on Webhook in each alert section you want: Anomaly alerts, Budget alerts, High-severity findings, Scan summaries, Scan failures.

The URL is encrypted and never shown again after you save. Keep it secret.

RequestCopy Anchor Link

• Method: POST, body JSON.
• Headers:
  • X-slashpeak-Event: the event name, for example scan.completed.
  • X-slashpeak-Timestamp: Unix seconds when it was sent.
  • User-Agent: slashpeak-Webhooks/1.0.
• Timeout: 10 seconds. Answer with any 2xx.

BodyCopy Anchor Link

Every event has the same envelope:

{
  "version": 1,
  "source": "SlashPeak",
  "event": "scan.completed",
  "sentAt": "2026-10-16T09:30:00.000Z",
  "accountId": 42,
  "data": { }
}

scan.completed data:

{
  "scanId": "…",
  "connectionName": "acme-prod",
  "gcpProjectId": "acme-analytics",
  "findingsCount": 37,
  "newFindingsSavingsUsd": 812.5,
  "highSeverityCount": 2,
  "totalEstimatedMonthlyWasteUsd": 6420.1,
  "findingsUrl": "https://…/findings",
  "topFindings": [
    { "type": "FULL_TABLE_SCAN", "title": "…", "estimatedMonthlySavingsUsd": 1200 }
  ]
}

scan.failed data: connectionName, gcpProjectId, errorMessage, dashboardUrl.

anomaly.detected and anomaly.recovered data hold a list of anomalies. Each one has: id, label, metricKey, unit, scope, region, blockHours, startedAt, endedAt (null while open), reason, direction, expected, actual, low, high, score, deltaCostUsd, cause (one sentence, or null), causeSoFar (true while open) and url (the Why page).

AI DBA events (Growth and up)Copy Anchor Link

See Cognis AI DBA.