Integrations overview

Integrations send short, human-readable alerts from Gurdx to the tools your team already watches, and webhooks connect Gurdx to your own systems.

Two ways to be notified#

Both are driven by the same events. See Events and alerts for what raises an event and Webhooks for the JSON format.

How an integration is set up#

Each integration has:

• A type: slack, telegram or discord.
• A configuration: a webhook URL for Slack and Discord, or a bot token and chat ID for Telegram. It is stored encrypted.
• Subscribed event types, or all events.
• A minimum risk score from 0 to 100. Events below it are not sent.
• An enabled switch, so you can pause it without losing the setup.

Add integrations in the dashboard at https://gurdx.cretip.com/app under Settings. Team members need the Settings and integrations permission.

What a message looks like#

Every integration receives the same plain text:

🛡️ Gurdx — Suspicious IP (My Shop)
Risk: 78.5/100
Subject: 203.0.113.42
Country: NL
User: user_1042
Time: 2026-10-06 12:14:22

The IP line is omitted when it is identical to the subject, and any missing field is skipped. Time is shown in your account time zone.

Delivery behaviour#

Messages are queued after the API response. A failed send is retried up to 3 times, one minute apart. Integrations do not carry the signature headers used by webhooks, so keep the destination URLs and tokens private.

Choosing a channel#

1. Slack for team channels with an incoming webhook.
2. Telegram for instant mobile alerts to a person or group.
3. Discord for community or ops servers.
4. Automation tools such as Zapier, Make, n8n and IFTTT, through a webhook trigger, when you want to open a ticket, update a sheet or call another API.

Tip: Create two integrations on the same channel type: one with a minimum score of 50 for the full stream, and one at 80 pointed at an on-call channel.

Note: Alerts are signals for a person to look at, not automatic verdicts. Decide in your own code what to block.