Notifications

Use Settings > Notifications to decide where Cotool sends important operational updates for your organization. This page controls shared notification defaults for alert escalations, log-ingest health, agent failures, and, when enabled in your workspace, detection tuning. Notification destinations are shared across your organization. A destination you create here can be reused in other notification settings and anywhere else Cotool asks for an output destination.

Open the page

Go to Settings > Notifications. The page is organized into tabs. Each tab lets you enable or disable a notification type and choose one or more destinations.

Manage destinations

Each tab uses the same destination picker:

1. Turn the notification type on.
2. Open Destinations.
3. Select one or more existing destinations.
4. Or choose New Destination to create one while staying on the page.
5. Save your changes.

Depending on which integrations are connected in your workspace, destinations can include Slack, Microsoft Teams, webhooks, PagerDuty, Linear, or Tines.

Alerts tab

The Alerts tab controls notifications for escalated alerts. When enabled, Cotool sends a notification each time an alert moves into Escalated status, whether that escalation came from a response agent or a person. You can also set a Minimum severity so lower-severity escalations do not notify. Use this tab when you want an on-call channel, incident system, or downstream workflow to hear about alerts that need higher-attention review. Related guide: Alert Routing

Log ingest tab

The Log ingest tab controls notifications for managed log-ingest health changes. You can choose which stream states notify:

• No access - the provider is refusing access and you need to fix the source-side configuration or credentials
• Degraded - logs are missing, late, or not catching up as expected
• Stalled - the stream is not making progress within its freshness window
• Failing - a run exhausted its retries and will not recover on its own

Backfilling, recovering, and waiting streams never notify because they are expected or self-healing states. AWS S3/SQS and GCP Pub/Sub sources report through the same states: quarantined records and an aging queue backlog read Degraded, a full quarantine reads Failing, and denied reads read No access. The stream’s status on the Log Ingest page links to the source’s Failures tab. Use this tab when you want the right team to know when a source stops delivering trustworthy data. Related guide: Monitor Log Ingestion

Agent failures tab

The Agent failures tab sets the default destinations for:

• terminal run failures
• failed acceptance criteria
• critical issues detected during evaluation
• runs whose evaluation score falls below the Minimum evaluation score

These are organization defaults. Individual agents can still override their own failure-notification settings, including the minimum evaluation score.

Minimum evaluation score

Every evaluated run gets a score from 0 to 100. Set Minimum evaluation score to notify when a run scores below that threshold, even if it met its acceptance criteria and reported no critical issue. A run that scores exactly the threshold does not notify. Choose Off to notify only on failures, failed criteria, and critical issues. This threshold is the organization default. An agent whose Failure notifications are set to Organization default uses it. To give one agent a different threshold, open the agent, set Failure notifications to Custom, and choose its own Minimum evaluation score. A custom agent uses only its own threshold, and Off turns score notifications off for that agent. A low score that comes with failed criteria or a critical issue is sent as one notification that includes the score. A run that already sent a terminal-failure notification to a destination does not send that destination a second notification for its score. Use this tab to make sure broken or off-track agent runs reach the people or systems that need to investigate them. Related guide: Acceptance Criteria

Detection tuning tab

If detection autotuning is enabled in your workspace, the Detection tuning tab controls notifications when Cotool automatically applies a tuning proposal and publishes a new detection version. This tab only covers auto-applied tuning changes. Review-only proposals still wait for a person to approve or reject them. Use this tab when detection owners want visibility into automatic noise-reduction changes without watching the detections workspace continuously. Related guide: Operate and Tune Detections

Best practices

• Send different notification types to different destinations when different teams own the response.
• Start with a small set of destinations to avoid duplicate noise across channels.
• For log-ingest health, notify only on the states your team actively responds to.
• Review shared destinations before deleting or repointing them, since other notification flows may reuse them.

Related documentation