I’m planning our Orca Security rollout and want to get alerts into Slack effectively. I’ve seen other tools where you can quickly get overwhelmed with notifications, turning a useful feed into noise.
What’s a practical way to set up Orca alert channels without getting spammed? I’m thinking about severity filtering, but are there specific alert types I should route separately? Also, how are you handling recurring alerts for the same issue—does Orca have deduplication in its Slack integration?
Good question. Noise is exactly what turns a helpful channel into something everyone mutes.
You're on the right track with severity filtering. We started by routing only Critical and High alerts to our main #security-alerts channel. Medium and Low go to a separate #security-alerts-low-priority channel that only a couple of us monitor. That cut down probably 70% of the volume right away.
For deduplication, Orca does group recurring alerts for the same asset and finding. You won't get a new Slack message for every single scan on an unresolved issue, which helps a lot. One caveat, though: if the alert details change meaningfully - say, a new affected resource is found - it will post again. So you still need a process to actually resolve the ticket on the Orca side to stop the notifications.
What's your team size for monitoring? That can change whether you need one channel or a few segmented ones for different alert types, like cloud misconfigurations vs. vulnerabilities.