# Event Sinks

## Types of event sinks

Scanner supports various types of event sinks:

* Slack - send event alerts to a Slack channel.
* Torq Webhook - send event alerts to a Torq webhook.
* Webhook - send event alerts to a URL webhook.
* PagerDuty - send event alerts to a PagerDuty service.

## Creating an event sink

You can click **Create New Sink** to create a new event sink directly from a detection rule or by going to **Settings > Event Sinks**. Different sinks require different configuration values.

### Slack

First, you will need to connect your Slack workspace to Scanner. Go to **Settings** > **Integrations** to do this. You will be guided to authorize the Scanner app in your Slack workspace.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-b64f56b7c8c5e9e566352f6a77bd7b11d6a84562%2FScreenshot%202025-06-09%20at%2012.55.52%20PM.png?alt=media" alt="" width="563"><figcaption><p>Connect your Slack workspace</p></figcaption></figure>

After connecting your workspace, go to the Event Sinks to create a new event sink. Select **Slack** as the destination. Select the Slack workspace that your channel is in.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-a61dbc1cd27f7b7a7b09a86faf912d9aab65baab%2FScreenshot%202025-06-09%20at%2012.58.51%20PM.png?alt=media" alt="" width="375"><figcaption><p>Select a Slack workspace</p></figcaption></figure>

Next, you will be prompted to provide your channel ID.

For private Slack channels, you will need to invite the Scanner app to the channel before creating the event sink. To do this, right-click the channel, select **View channel details**, go to the **Integrations** tab, and add the Scanner app.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-d83126e4b1fbc18bff8b916968565570eca0940c%2FScreenshot%202025-06-09%20at%201.04.06%20PM.png?alt=media" alt="" width="375"><figcaption><p>Create Slack event sink</p></figcaption></figure>

### Torq Webhook

To create a Torq webhook event sink, select **Torq** **Webhook** and provide the URL for the webhook and any custom HTTP headers (e.g. authentication headers).

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-4681f8d041211628dd5f9c784a55c28ee07cd336%2FScreenshot%202025-06-09%20at%201.54.02%20PM.png?alt=media" alt="" width="375"><figcaption><p>Create Torq webhook</p></figcaption></figure>

### Webhook

To create a webhook event sink, select **Webhook** and provide the URL for the webhook (e.g. from [Tines](https://www.tines.com/docs/actions/types/webhook) or other applications) and any custom HTTP headers (optional).

When configuring webhooks on Tines or other applications, make sure they accept `POST` requests and JSON content.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-a3e819aa15847b7ad8ad2033fc3d458593ba2e24%2FScreenshot%202025-06-09%20at%201.07.39%20PM.png?alt=media" alt="" width="375"><figcaption><p>Create webhook event sink</p></figcaption></figure>

### PagerDuty

First, you will need to create an Events API V2 integration for your PagerDuty service. Go to **Services** -> **Service Directory** and select the service that you would like to create an event sink for. Go to the **Integrations** tab, click on **Add another integration**, and add the Events API V2 integration.

On Scanner, select the **PagerDuty** event sink and provide the Events API V2 integration key for your service.

To customize alerts sent to PagerDuty, see [customizing-pagerduty-alerts](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detections-and-alerting/detection-rules/detection-alert-formatting/customizing-pagerduty-alerts "mention").

Note: PagerDuty alerts from Scanner will need to be resolved manually.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-402fb86025361a0b23128f9ad4d2e76d19164f47%2FScreenshot%202025-06-09%20at%204.07.36%20PM.png?alt=media" alt="" width="375"><figcaption><p>Create PagerDuty event sink</p></figcaption></figure>

## Testing event sinks

After creating an event sink, you can send a test event to the event sink to confirm the event sink works.

Select the event sink and click on **Send Test Event** on the details panel.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-1551adf5844fa728e584f0b47d60779d727ee361%2FScreenshot%202025-06-09%20at%201.46.07%20PM.png?alt=media" alt="" width="375"><figcaption><p>Send a test event to an event sink</p></figcaption></figure>

## Sending alerts

Alerts are sent to event sinks from detection rules. To configure a detection rule to send an alert to an event sink, see [#configuring-a-detection-rule-to-push-to-an-event-sink](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/detection-rules#configuring-a-detection-rule-to-push-to-an-event-sink "mention").

## Viewing all event sinks

You can view all of your team's event sinks by navigating to the **Settings** tab and selecting **Event Sinks**. In this view, you can create a new event sink, or edit your existing event sinks.

<figure><img src="https://974571140-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxPzBslRzquS8OU1IlC6E%2Fuploads%2Fgit-blob-824c67b5e3e987328fdff02cdf5486fe8e9dabe0%2FScreenshot%202025-06-09%20at%201.13.38%20PM.png?alt=media" alt=""><figcaption><p>Event sink settings</p></figcaption></figure>
