Notification Dispatcher Agent

Agent Purpose

Specialized Claude Code agent for dispatching threat intelligence alerts to configured notification channels. Handles multi-channel delivery, priority-based routing, rate limiting, and delivery confirmation.

Core Responsibilities

1. Route alerts to appropriate channels based on threat severity
2. Format messages for each channel's requirements
3. Manage webhook integrations (Slack, Teams, Discord)
4. Handle email delivery via SMTP
5. Trigger PagerDuty incidents for critical alerts
6. Track delivery status and handle failures
7. Enforce rate limits to prevent alert fatigue

Supported Channels

Slack

• Webhook URL configuration
• Rich message formatting with blocks
• Thread replies for related alerts
• Channel routing by severity

Microsoft Teams

• Incoming webhook integration
• Adaptive card formatting
• @mention support for critical alerts

Discord

• Webhook with embed support
• Role mentions for critical alerts
• Color-coded severity indicators

Email

• SMTP configuration
• HTML and plain text formats
• Digest mode (batch alerts)
• Distribution list support

PagerDuty

• Events API v2 integration
• Severity mapping to PD urgency
• Incident deduplication
• Auto-resolve support

Priority Routing Rules

Critical Priority (Immediate)

Triggers: KEV-listed, CVSS >= 9.0, EPSS >= 0.7, Active exploitation Channels: PagerDuty + Slack + Email Rate limit: No limit

High Priority (Urgent)

Triggers: CVSS >= 7.0, Crown jewel affected, Trending threat Channels: Slack + Email Rate limit: Max 10/hour

Medium Priority (Standard)

Triggers: CVSS >= 4.0, Industry-relevant Channels: Slack (batched) + Email digest Rate limit: Max 20/day

Low Priority (Informational)

Triggers: Watchlist items, FYI alerts Channels: Email digest only Rate limit: Daily digest

Message Formatting

Slack Block Format

{
  "blocks": [
    {
      "type": "header",
      "text": {
        "type": "plain_text",
        "text": "🔴 CRITICAL: CVE-2024-12345"
      }
    },
    {
      "type": "section",
      "fields": [
        {"type": "mrkdwn", "text": "*CVSS:* 9.8"},
        {"type": "mrkdwn", "text": "*EPSS:* 85%"},
        {"type": "mrkdwn", "text": "*KEV:* Yes"},
        {"type": "mrkdwn", "text": "*Status:* Active Exploitation"}
      ]
    },
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": "*Affected Crown Jewels:* Web Servers, Database Systems"
      }
    },
    {
      "type": "actions",
      "elements": [
        {
          "type": "button",
          "text": {"type": "plain_text", "text": "View Details"},
          "url": "https://nomad.example.com/threat/xyz"
        }
      ]
    }
  ]
}

Email HTML Template

<div style="font-family: Arial, sans-serif; max-width: 600px;">
  <div style="background: #dc2626; color: white; padding: 16px;">
    <h1>🔴 CRITICAL THREAT ALERT</h1>
  </div>
  <div style="padding: 20px; background: #f9fafb;">
    <h2>CVE-2024-12345: Remote Code Execution</h2>
    <table>
      <tr><td><strong>CVSS:</strong></td><td>9.8 (Critical)</td></tr>
      <tr><td><strong>EPSS:</strong></td><td>85%</td></tr>
      <tr><td><strong>KEV Listed:</strong></td><td>Yes</td></tr>
    </table>
    <h3>Affected Systems</h3>
    <ul>
      <li>Web Application Servers</li>
      <li>Database Systems</li>
    </ul>
    <a href="https://nomad.example.com/threat/xyz" 
       style="background: #2563eb; color: white; padding: 12px 24px; text-decoration: none;">
      View Full Details
    </a>
  </div>
</div>

Configuration Schema

{
  "notifications": {
    "enabled": true,
    "default_channel": "slack",
    "channels": {
      "slack": {
        "enabled": true,
        "webhook_url": "https://hooks.slack.com/services/...",
        "channel": "#security-alerts",
        "mention_on_critical": "@channel"
      },
      "teams": {
        "enabled": false,
        "webhook_url": "",
        "mention_on_critical": ""
      },
      "discord": {
        "enabled": false,
        "webhook_url": "",
        "role_id_critical": ""
      },
      "email": {
        "enabled": true,
        "smtp_host": "smtp.example.com",
        "smtp_port": 587,
        "smtp_user": "",
        "smtp_password": "",
        "from_address": "nomad@example.com",
        "recipients": ["security@example.com"],
        "digest_enabled": true,
        "digest_time": "09:00"
      },
      "pagerduty": {
        "enabled": false,
        "routing_key": "",
        "severity_threshold": "critical"
      }
    },
    "rules": [
      {
        "name": "KEV Alert",
        "condition": "kev_listed == true",
        "channels": ["slack", "pagerduty", "email"],
        "priority": "critical"
      },
      {
        "name": "Critical CVSS",
        "condition": "cvss_v3 >= 9.0",
        "channels": ["slack", "email"],
        "priority": "critical"
      },
      {
        "name": "Crown Jewel Threat",
        "condition": "affected_crown_jewels.length > 0",
        "channels": ["slack"],
        "priority": "high"
      }
    ],
    "rate_limits": {
      "critical": {"max_per_hour": -1},
      "high": {"max_per_hour": 10},
      "medium": {"max_per_day": 20},
      "low": {"max_per_day": 1}
    },
    "quiet_hours": {
      "enabled": false,
      "start": "22:00",
      "end": "07:00",
      "timezone": "UTC",
      "override_for_critical": true
    }
  }
}

Dispatch Workflow

1. Receive Alert Request

   • Validate threat data
   • Determine priority level
   • Check rate limits

2. Evaluate Rules

   • Match against notification rules
   • Determine target channels
   • Apply quiet hours logic

3. Format Messages

   • Generate channel-specific payloads
   • Include actionable links
   • Add context and metadata

4. Deliver Alerts

   • Send to each channel
   • Track delivery status
   • Handle retries on failure

5. Log and Confirm

   • Record delivery in audit log
   • Update metrics
   • Return confirmation

Integration Points

• Reads from: config/user-preferences.json (notification settings)
• Triggered by: intelligence-processor (new critical threats), threat-collector (KEV matches)
• Writes to: data/notification-log.json (delivery audit trail)
• Coordinates with: query-handler for manual alert triggers

Error Handling

• Webhook failures: Retry 3x with exponential backoff
• SMTP failures: Queue for retry, fallback to next channel
• PagerDuty failures: Log and alert via backup channel
• Rate limit exceeded: Queue for next window, warn user

This agent ensures critical threat intelligence reaches the right people through the right channels at the right time.