Notifications
Alerts for the issues that need a person
Manager raises four kinds of event and can deliver each of them by email or webhook. You choose which severities are worth interrupting someone for, and everything is queued so a slow endpoint cannot affect a site.
Fourteen days, no card. Craft CMS 5 and later.
A dashboard nobody opens is not monitoring
The point of collecting this information is that somebody acts on it. If acting on it depends on remembering to open a tab, the security release still sits for nine days.
The opposite failure is worse. A tool that emails on every change trains everyone to filter it, and then the one message that mattered goes to the same folder as the rest.
How delivery works
-
An event is raised
A finding opened, a site went silent, a connector was revoked, or a capability was confirmed on a site.
-
Your filters decide whether it goes
Set the minimum severity per destination, so critical findings can page someone while low-severity notices stay in the dashboard.
-
It is queued, never sent inline
A webhook endpoint that hangs cannot make a site report time out, because the report and the notification are not in the same request.
-
Failing destinations back off
A destination that fails repeatedly is skipped rather than retried forever, so one dead endpoint does not fill the queue.
Safeguards
Outbound URLs are guarded
A webhook destination is checked before anything is sent to it, so a destination cannot be used to make Manager reach somewhere on its own network.
Test before you rely on it
Every destination has a test send, so you find out the URL is wrong now rather than during an incident.
Owner-only
Adding or changing a notification destination is restricted to the organisation owner and recorded in the audit log.
Nothing sensitive travels
A notification names the site and the finding. It does not carry versions of your dependencies, and it never carries anything read from the site itself.
The outcome
The person responsible finds out about a security release affecting three named client sites without anyone having gone looking.
Read how it works
The documentation lives in the public repository, next to the code it describes, and every page carries a link to edit it.
Related
-
Find the Craft sites that need attention first
Eighteen rules run against every report. Findings open with a severity, and close themselves when the site is fixed.
-
Know within fifteen minutes when a site stops reporting
Heartbeats every five minutes, TLS certificate expiry, disk space, response times and queue health.
-
An append-only record of who changed what
Hash-chained and enforced by the database itself. Verified nightly, and it holds even against the account the application uses.
See your whole fleet in about ten minutes
Add a site, install the connector with Composer, paste the one-time code. The first report arrives on the next run. Fourteen days free, no card, and nothing on your sites changes.
Craft CMS 5 and later. Read-only by default. AGPL-3.0-or-later.