Configure alerts & email digests
Get notified when cost behaviour changes — either as real-time webhooks to a chat channel, or as a periodic email summary.
Both live on the Alerts hub (it’s the single Notifications home — Email Digests is a tab there). Alerts is an explicit sidebar entry under Govern.
Webhook alerts (Teams / Slack / generic JSON)
Section titled “Webhook alerts (Teams / Slack / generic JSON)”Every new workspace starts with one enabled rule — a conservative Forecast increase watch on the whole organization (projection creep ≥ 3% week-over-week and ≥ $500, or a burn jump ≥ 8%). It fires only once a channel exists, so the only setup a new workspace needs is adding a webhook channel — the Alerts page shows an “Alerts are configured but have nowhere to go” banner until you do. A rule that binds no specific channels delivers to all active channels.
Newly detected cost anomalies (spikes and drops) are also delivered to your channels automatically — one notification per anomaly, carrying the scope, direction, severity, and the actual/expected/delta amounts. Every notification includes an Open in leancosts link back to the relevant page (Costs for spend alerts, the Savings Register for anomalies).
1. Add a channel
Section titled “1. Add a channel”Alerts → Channels → + Channel. Provide:
- a name and the destination URL (any HTTPS webhook works),
- a template:
teams_adaptive_card,slack_block_kit, orgeneric_json, - an optional HMAC secret — when set, deliveries are signed with
x-finops-signature: sha256=<hex>so the receiver can verify authenticity.
The form shows inline setup steps for the selected template — exactly how to obtain the webhook URL in the destination app:
- Microsoft Teams (
teams_adaptive_card): in Teams open the channel → ⋯ → Workflows → template “Post to a channel when a webhook request is received” → Add workflow → copy the generated POST URL. (The classic Office 365 “Incoming Webhook” connector has been retired; Workflows replaces it.) - Slack (
slack_block_kit): at api.slack.com/apps create/open an app → Incoming Webhooks → on → Add New Webhook to Workspace → copy thehooks.slack.com/services/…URL. - Generic JSON (
generic_json): any HTTPS endpoint. For Discord, use a channel webhook (Channel → Edit → Integrations → Webhooks → New Webhook → Copy URL).
Hit Test to fire a synthetic event and confirm the endpoint returns 2xx.
2. Add a rule
Section titled “2. Add a rule”Alerts → Rules → + Rule. Pick a metric and bind one or more channels:
| Metric | Fires when… |
|---|---|
Cost drift (daily_cost_drift) | the mean daily spend of the last 7 complete days rises ≥ driftPct% vs the prior 21-day baseline and the implied weekly excess spend is ≥ minDelta (needs at least 14 days of data) |
Forecast increase (forecast_increase) | the projected month-end creeps ≥ 3% week-over-week (+ ≥ $500) or the current-week burn jumps ≥ 8% vs the same week last month |
Volatile spend (volatile_spend) | the day-to-day variability (stddev ÷ mean) of the last 14 daily totals crosses the threshold % (needs at least 14 days of data) |
Budget forecast breach (budget_forecast_breach) | the projected month-end exceeds the monthly budget set on the Costs page — no threshold to configure on the rule; just enable it and pick channels. Never fires while no budget is set |
Defaults for drift/volatility are 25% / 200. Rules apply at the account/organization scope. All metrics are evaluated weekly; a known one-time spike (an open anomaly or a variance annotation) suppresses drift and forecast alerts so you are not paged twice for the same event.
Setting the monthly budget: on Costs → Monthly trend, use Set monthly budget (admins only). The trend then shows a dashed budget line and a “projected $X of $Y budget” stat — the same number the Budget forecast breach rule fires against.
3. Confirm delivery
Section titled “3. Confirm delivery”Alerts → Recent events lists fired events. Each entry shows the rule name (or
“Test event”), a plain-language summary of what fired, and a delivery-status badge
(delivered / failed / pending); the raw JSON payload is one click away behind a
View payload toggle. Failed deliveries retry up to 3 times with linear backoff.
Email digests
Section titled “Email digests”A unified savings digest delivers a weekly (or daily) summary with two sections: What you saved (realized measured savings + ROI) and New waste found (the top open findings from Opportunities).
There is also a Savings report digest (register_report): the Savings
Register report emailed with the board PDF and full CSV attached. Recipients
are admin-managed org members. Trigger it on-demand from Opportunities
(Email report) or set a recurring cadence (Schedule…). Alongside realized
impact, open claim, and closure rate, the summary (and the PDF) reports the money
left on the table — potential savings already foregone while open suggestions
sat un-executed, growing until they’re actioned — so leadership sees the cost of
delay, not just the backlog.
- Go to Alerts → Email Digests (or Settings → Email).
- Subscribe and choose your cadence. Subscriptions are user-owned.
- Preview renders the email against your data before you commit.
Unsubscribe is one click and works without an active session — the emails carry
standard List-Unsubscribe headers, so Gmail/Outlook show their native
unsubscribe button. Admins can force-send a digest for incident response.