> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-set-notifications/exemption-notifications.md).

# Set up Notifications for Exemptions

The STO module is integrated with the [Harness Platform's notification system](/harness-ai/use-harness-platform/notifications-alerts-and-banners/notifications/notifications-overview.md) to keep you informed about key events in the lifecycle of an issue exemption. You can configure notification rules to send alerts to individuals or groups via various channels like **Email**, **Microsoft Teams**, **Slack**, **PagerDuty**, or **Webhook**. You can set up notifications for the following events:

* [Notify on Exemption Requested](#exemption-requested)
* [Notify on Exemption Status Changed](#exemption-status-changed)

{% embed url="<https://youtu.be/f5JyySFQG4E?si=5dx7B6IxwvuFNB6I>" %}

### How to Configure Notifications for Exemption Events <a href="#how-to-configure-notifications-for-exemption-events" id="how-to-configure-notifications-for-exemption-events"></a>

To start receiving notifications for STO exemptions, you need to configure [**Notification Channels**](#configure-notification-channels) and [**Notification Rules**](#configure-notification-rules). They can be set up at the **Project**, **Organization**, or **Account** level.

#### Configure Notification Channels <a href="#configure-notification-channels" id="configure-notification-channels"></a>

Channels are the delivery methods for your notifications. You can use existing channels or create new ones.

1. Navigate to the desired scope (**Project**, **Organization**, or **Account**) and select **Settings**.
2. Under **Notifications and alerts**, select **Notification Channels**.

For detailed instructions on setting up different channel types, go to the Harness Platform documentation on [Notification Settings](/harness-ai/use-harness-platform/notifications-alerts-and-banners/notifications/configure-notifications.md#configure-new-channels).

#### Configure Notification Rules <a href="#configure-notification-rules" id="configure-notification-rules"></a>

Once you have your channels, you can create rules to trigger notifications for specific STO events.

1. In **Settings**, under **Notifications and alerts**, select **Notification Rules**.
2. Click **+ New Notification**.
3. Enter a **Name** for your rule (e.g., "STO Pending Exemption Alerts").
4. Under **Select Resource Type**, choose **Security Test Exemptions** from the dropdown menu.
5. Depending on the scope you're in, you can select specific **Organizations** or **Projects**. You can also choose to apply the rule to all.

{% hint style="warning" %}
Users can be notified about exemption events even if they do not have direct access to the project where the event occurred. Ensure your notification channels are configured for the appropriate audience.
{% endhint %}

6. Under **Conditions**, select **Add Condition**.
7. Enter a **Condition Name** and select one or more events from the **Add Events** dropdown:
   * `Security Test Exemption Requested`: Triggers when a new exemption is requested. See the [Exemption Requested](#exemption-requested) section for details.
   * `Security Test Exemption Status Changed`: Triggers when an exemption is approved or rejected. See the [Exemption Status Changed](#exemption-status-changed) section for details.
8. Click **Apply** and then **Continue**.
9. In the **Notification Method** section, choose the channel(s) where you want to send the alerts.
10. Click **Submit**.

You have now successfully created a notification rule for STO exemptions.

### Supported Exemption Events <a href="#supported-exemption-events" id="supported-exemption-events"></a>

You can trigger notifications for the following STO exemption events. For details on how to set these up, see the [configuration section](#how-to-configure-notifications-for-exemption-events).

#### Exemption Requested <a href="#exemption-requested" id="exemption-requested"></a>

This notification is sent when an exemption is requested for a security issue. The event name in the notification rule is `Security Test Exemption Requested`. This event is triggered in the following scenarios:

* A user creates a new exemption request for an issue. The exemption request is in the `Pending` state.
* A user resubmits a previously `Rejected` or `Expired` exemption for re-approval. The exemption's status is reset to `Pending`.

This notification is useful for alerting security teams or designated approvers that a new exemption request requires their review.

<details>

<summary>Example: Exemption Requested Notification</summary>

Below is an example of a Slack notification for a new exemption request.

**Notification Fields Explained:**

* **Issue Title**: The title of the vulnerability for which the exemption is requested.
* **Severity**: The severity level of the issue (e.g., High, Critical).
* **Scan Tool**: The security scanner that detected the issue.
* **Org / Project**: The Harness organization and project where the issue was found.
* **Scope**: Requested scope for the exemption (e.g., Target, Pipeline, Project).
* **Requester**: The email address of the user who requested the exemption.
* **Expiration**: The requested duration for the exemption (e.g., 30 days).
* **Reason**: The justification provided by the requester for the exemption.

</details>

#### Exemption Status Changed <a href="#exemption-status-changed" id="exemption-status-changed"></a>

This notification is sent when the status of an exemption request changes. The event name in the notification rule is `Security Test Exemption Status Changed`. This event is triggered when an approver takes action on an exemption request:

* The exemption request is **Approved**.
* The exemption request is **Rejected**.
* The exemption request is **Expired**.

{% hint style="info" %}
To receive notifications when exemption requests are approved, you must configure the notification rule and channel at the **same scope** where the exemption is approved.

* **Project level approvals:** To receive notifications for exemption requests approved at the **Project** scope, the notification rule must be configured at the **Project level** under **Project Settings**.
* **Organization, Account level approvals:** To receive notifications for exemption requests approved at the **Organization** or **Account** scope, the notification rule must be configured at the corresponding **Organization Settings** or **Account Settings**.
  {% endhint %}

This notification helps keep the original requester and other stakeholders informed about the outcome of the review process. For example, a developer can be notified immediately when their exemption request has been approved, allowing them to proceed with their work.

<details>

<summary>Example: Exemption Status Changed Notification</summary>

Below is an example of a Slack notification for a change in an exemption's status.

**Notification Fields Explained:**

* **Issue Title**: The title of the vulnerability associated with the exemption.
* **Severity**: The severity level of the issue.
* **Scan Tool**: The security scanner that detected the issue.
* **New Status**: The updated status of the exemption (e.g., Approved, Rejected).
* **Org / Project**: The Harness organization and project where the issue was found.
* **Scope**: The scope at which the exemption request was approved.
* **Requester**: The email address of the user who originally requested the exemption.
* **Approver**: The email address of the user who approved or rejected the request.
* **Expiration**: The date and time when the exemption will expire.
* **Reason**: The original justification provided for the exemption.

</details>