<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-security-notification-systems
description: >-
  Build security notification systems with multi-channel delivery (email, Slack,
  PagerDuty, SMS), severity-based routing, escalation chains, rate limiting,
  deduplication, and on-call schedule integration.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - notifications
  - alerting
  - escalation
  - pagerduty
  - on-call
  - routing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Security Notification Systems

## Overview

Security notification systems deliver the right alert to the right person at
the right time. This skill covers multi-channel routing based on severity,
escalation chains with timeout-based progression, deduplication to prevent
alert fatigue, rate limiting, and on-call schedule integration.

Mode: `[MODE: BLUE]` — Alert delivery and escalation.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests` | Required |
| Slack Bot token for channel notifications | Required |
| PagerDuty API key for on-call escalation | Required |
| SMTP access for email notifications | Required |

## Key Concepts

### Routing Rules

```python
ROUTING_RULES = {
    "critical": {"channels": ["pagerduty", "slack", "email"], "escalation_timeout": 300},
    "high": {"channels": ["slack", "email"], "escalation_timeout": 900},
    "medium": {"channels": ["slack"], "escalation_timeout": 3600},
    "low": {"channels": ["email"], "escalation_timeout": None},
}
```

### Deduplication

```python
import hashlib

def dedup_key(alert: dict) -> str:
    """Generate deduplication key from alert attributes."""
    raw = f"{alert.get('source', '')}{alert.get('rule_id', '')}{alert.get('hostname', '')}"
    return hashlib.sha256(raw.encode()).hexdigest()[:16]
```

## Workflow

### Step 1: Send Notification

```bash
node scripts/agent.js --action notify --severity critical --message "Ransomware detected on db-01"
```

### Step 2: Check Escalation Status

```bash
node scripts/agent.js --action escalation-status --alert-id ALT-001
```

### Step 3: Notification Report

```bash
node scripts/agent.js --action report --period 24h
```

## Verification

- [ ] Critical alerts trigger PagerDuty + Slack + email simultaneously
- [ ] Duplicate alerts are suppressed within dedup window
- [ ] Unacknowledged alerts escalate after timeout
- [ ] Rate limiting prevents notification storms

## References

- [PagerDuty Events API v2](https://developer.pagerduty.com/api-reference/YXBpOjI3NDgyNjU-pager-duty-v2-events-api)
- [Slack Incoming Webhooks](https://api.slack.com/messaging/webhooks)
- [OpsGenie Alert API](https://docs.opsgenie.com/docs/alert-api)
