# Appsec alert notifications

**URL:** <https://discourse.crowdsec.net/t/appsec-alert-notifications/2353>\
**Category:** crowdsec\
**Created:** [February 11, 2025, 2:07am UTC](https://discourse.crowdsec.net/t/appsec-alert-notifications/2353 "2025-02-11T02:07:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/joz/32/1136_2.png) [@Joz](https://discourse.crowdsec.net/u/Joz)\
**Post date:** [February 11, 2025, 2:07am UTC](https://discourse.crowdsec.net/t/appsec-alert-notifications/2353/1 "2025-02-11T02:07:05Z")

</div>

Hi all,

Pretty new to all things crowdsec, just set things up recently, so please excuse my ignorance.

Besides the basics I also managed to set up Appsec and it works well.  
However I would like to also get notifications for the alerts triggered by appsec, but I am unsure how to do so (the default configuration does not do so).

It might be related to part of the filter that comes with the default configuration, such as

Alert.Remediation == true && Alert.GetScope() == “Ip”

But I don’t really know what to change here, maybe the scope comparison needs to match something specific for appsec?

My current profiles.yaml looks like this

```auto
name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 24h
duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
  - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
on_success: break
---
name: default_range_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Range"
decisions:
 - type: ban
   duration: 24h
duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
  - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
on_success: break

```

Any tips would be awesome!  
Than in advance