Integrations and alert workflows

Integrations (/dashboard/integrations) is where a workspace connects the tools it already uses and decides which alerts reach them. Owners and administrators make changes; other roles with activity access see the page read-only. Every change is checked on the server and audit-logged.

Connect a tool

Chat URLs must belong to the tool you picked, so a Slack integration can't point anywhere else. URLs and keys are stored encrypted and are never sent back to the browser or to devices. Email only reaches people who are still members of the workspace when the alert is sent. Send test on any integration delivers a sample alert and shows what the destination answered.

Findings contain text written by attackers. Chat messages go out with link previews and mentions turned off, and evidence is never turned into links. Treat evidence as untrusted input in anything that reads the webhook.

Build a workflow

A workflow reads When → If → Then:

• When: an App monitoring finding, or a device alert (Beam was tampered with, stopped or removed on a teammate's machine).
• If: a minimum severity and, for App monitoring, the apps, categories (requests, AI, compromise, credentials, recon, dependencies) and sources (app logs, HTTP traffic, dependency checks) it cares about. An empty group matches everything.
• Then: one or more integrations, and how often it may alert: every match, or at most once per 5, 15 or 60 minutes, 4 hours or a day. Matches inside the wait stay on the dashboard; they just don't alert again.

Start from a template (page on-call for criticals, a security channel, leaked credentials, device tampering) or from scratch. Workflows can be edited, paused, resumed and removed, and Send test pushes a sample alert through every destination without starting the cooldown.

Workspace rules and LLM review apply first: an ignored or quieted finding, or one a model judged benign, never reaches a workflow, except that critical findings always do.

Delivery log

Recent deliveries lists every attempt for 14 days: the workflow, the destination, whether it was delivered, failed or held by a cooldown, and what the destination answered. Each integration also shows its last result, so a revoked Slack webhook is visible before anyone misses an alert.

Verify webhook requests

Every HTTP request carries X-Beam-Timestamp and X-Beam-Signature, an HMAC-SHA256 of ${timestamp}.${body} with the integration's signing secret (shown under the webhook, with Rotate secret):

import { createHmac, timingSafeEqual } from "node:crypto";

const expected = `sha256=${createHmac("sha256", signingSecret).update(`${req.headers["x-beam-timestamp"]}.${rawBody}`).digest("hex")}`;
const signature = String(req.headers["x-beam-signature"] ?? "");
const valid = signature.length === expected.length && timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

The JSON type is beam.monitor.findings for App monitoring and beam.device.alert for device alerts.

Webhooks made before Integrations

App monitoring webhooks added in its settings before Integrations existed are moved over automatically the first time they're needed: each becomes an integration with the same URL and signing secret, plus a workflow with the same severity and app filters. Receivers keep verifying with the secret they already have.