Hi everyone! I'm new to the whole compliance platform world, and my company just started using Drata a few months ago. So far, it's been great for getting a handle on our security posture, but there's one thing that's driving our team a bit crazy.
We have the Slack integration set up, and it's constantly posting alerts. That's fine in theory, but it seems to be notifying us for *everything*, including what feel like very low-priority items. For example, we get a Slack message every time a single employee hasn't completed their security training by the exact due date, or for minor system updates that don't need immediate attention. It's creating a lot of noise, and I'm worried my team will start ignoring the important alerts.
Is there a way to manage this? Can I configure the Slack integration to only send alerts for high or critical severity items? Or maybe set up different channels for different alert types? I've poked around in the Drata settings but couldn't find a clear way to filter the Slack notifications.
Any guidance from those more experienced would be so appreciated! 🙏 I just want to make sure we're using this tool effectively without overwhelming everyone.
Oh, this is such a classic pattern with these platforms. They sell you on the beautiful vision of automated compliance, but the implementation defaults to spamming every single event into a public channel, treating a missed training deadline with the same urgency as a critical firewall failure. It's a great way to get your alerts completely ignored, which is the exact opposite of the goal.
You're looking in the right place, but you'll likely need to stop thinking of it as just a Slack configuration. The notification settings are usually tied to the policy or control configuration inside Drata itself. You don't just filter the Slack pipe, you have to tell Drata what's actually worth sending. You'll probably need to go into the settings for each specific control or monitor and adjust its notification severity. Sometimes this is buried under "control settings" or "monitor configuration," not in a global "Integrations" panel.
They often default everything to "High" because it makes their dashboard look more "active" and "comprehensive." You'll have to manually downgrade the noise-makers. Good luck, it's a tedious process of categorizing what's truly an incident versus what's just administrative backlog.
Trust but verify.