Self-hosted team chat. Incoming webhook to your own instance.
Where to get it
Your self-hosted Rocket.Chat instance + an incoming webhook URL.
Install / what you need
No install here — create an incoming webhook integration in Rocket.Chat.
How to connect
- 1 Create an incoming webhook integration in Rocket.Chat.
- 2 Dashboard → Notifications → Add destination → rocketchat, paste the webhook URL.
- 3 Send test.
When you'd use it
What Herald sends through this channel
2 setup fields
Herald hands every alert to the
RocketChatAdapter
as a DispatchPlan. The fields
below are what the dashboard form asks for; the sample is the plan the adapter receives.
The adapter renders it into the channel-native shape (Discord embeds, Teams MessageCards,
PagerDuty Events-API payloads, TwiML, JSON POST bodies) on the way out — that wire transcript varies per channel.
Setup form fields
| field | type | required | description / default |
|---|---|---|---|
| webhook_url | string | required | Rocket.Chat incoming webhook URL (Administration → Integrations → New → Incoming) |
| timeout_seconds | number | optional | no description · default: 10 |
Sample DispatchPlan (input to the adapter)
{
"decision_id": "tdc-2026-06-20-abc12",
"channel": "<channel-type>",
"recipient": {
"recipient_id": "soc-oncall",
"display_name": "SOC on-call",
"addresses": [
{
"channel": "<channel-type>",
"address": "<destination>",
"min_defcon": 5
}
]
},
"urgency": "high",
"retry_policy": {
"max_attempts": 3,
"initial_backoff_seconds": 5
},
"subject": "Suspicious login on CEO-LAPTOP",
"body": "Warden flagged a PowerShell child of WINWORD.EXE. The encoded command resolved to a base64-wrapped Invoke-WebRequest to a newly-registered domain. Trust ladder: L3.",
"approval_link": "https://app.cybercli.local/approve/abc12",
"incident_ref": "case-2026-0142",
"signal_id": "sig-2026-06-20-9f3"
} Sovereignty: byo_external · Min tier (BYO): free · Self-hosted team chat; Slack-shaped incoming webhook (Free+).
Delivery hits your Rocket.Chat server directly; no CyberCLI relay.
Herald — the Guild's voice role — routes alerts, daily digests, and AI verdicts here, on a per-CYCON-state matrix you control. CYCON 1/2 alerts repeat until an operator acks.
The Guild →