Exposure Alerts

How to choose which risk exposures and port categories notify you, from Settings → Notifications.

Exposure Alerts

Exposure Alerts notifies when selected exposures are detected. The card copy is: Get notified when exposures are detected.

Edit requires manage-settings. It opens Exposure Alert Settings. Configuration is stored as one exposure_settings object (not per-condition CRUD).

Summary on the card

Line	Meaning
Risk Exposures	Enabled risk types, or None. Count of types with notifications on.
Port Categories	Enabled category names (first three, then `+N more`).
Custom	Shown only when custom ports or protocols exist.
Severity Overrides	Shown only when `finding_severity_map.exposure_groups` has entries.

Risk exposures (opt-in)

Name	Meaning
Web Logins (SSO)	Login pages with an SSO provider (Okta, Azure AD, and similar).
Web Logins (Generic)	Login forms without SSO — admin panels, basic auth.
LLM Chatbots	Exposed AI/LLM endpoints (Ollama, OpenAI-compatible, and similar).
MCP Servers	Exposed Model Context Protocol servers.

Port categories

Category	Examples	Recommended
Remote Access Services	SSH, RDP, VNC, Telnet	Yes
Databases Exposed to Internet	MySQL, PostgreSQL, MongoDB, Redis, MSSQL, Oracle, Elasticsearch, Cassandra, CouchDB, Memcached	Yes
File Sharing & SMB Services	SMB, NetBIOS, FTP, NFS, TFTP	Yes
Management Interfaces	SSH, RDP, Telnet, SNMP, VNC, WinRM, IPMI	Yes
Telecom Protocols	RADIUS, SIP, GTP, Diameter, SIGTRAN, H.323	No

Port and protocol maps are backend-owned (pkg/lib/exposure/). The UI categories are labels on those maps.

Custom ports, protocols, and severity

The modal also has Custom Ports and Custom Protocols (tag input plus a notify toggle per item) and per-group severity overrides: Exposure, Info, Low, Medium, High, Critical (E / I / L / M / H / C).