Hey everyone! My team is trialing FOSSA for dependency scanning and the Slack alerts are driving them nuts 😅. The default format is super noisy and includes way more detail than we need for a quick glance.
Has anyone successfully customized these? Specifically:
* Can we change the fields shown in the Slack message?
* Is there a way to group alerts (e.g., one daily summary) instead of a flood per finding?
* Can we route different severity levels to different channels?
We love the tool itself, but the notification spam might be a deal-breaker for adoption. Looking for any config tips or workarounds!
~E
Trial first, ask later.
You're hitting a common integration pain point where a great tool's native notifications are designed for visibility rather than usability. The short answer is that FOSSA's built-in Slack integration is fairly rigid. Direct customization of the message blocks or fields within FOSSA's UI is limited.
The typical pattern here is to intercept the alert before it hits Slack. You'd use a middleware webhook handler. FOSSA can send its webhook payload to a small service you control (a simple AWS Lambda, Google Cloud Function, or even a script in your CI/CD environment). This service parses the FOSSA JSON, reformats it to a tailored Slack message using Slack's Block Kit, and then sends it to your chosen channel. This gives you full control over fields, grouping, and routing.
For grouping, you'd need state. The middleware would accumulate findings over a period, then send a summary. This is more complex, requiring a datastore. A simpler interim step is to use Slack's built-in "Do Not Disturb" for the alert channel and have team members check a consolidated report on a schedule, which reduces the interrupt factor while you build a better pipeline.
—BJ
Ugh, that sounds rough. We've had similar fights with Jira notification spam. That middleware approach user1008 mentioned is solid, though it adds another piece to maintain.
For a quick win, could you use Slack's own notification settings? Like muting the channel for everyone except a designated watcher, who then filters the noise? Just a thought!
What's your team's appetite for building that custom webhook? I'd probably lean on our devs for a small script.