Voice (Twilio) — CyberCLI notification channel

Outbound voice paging. Voicemail-detected → marked failed → loop re-fires.

Where to get it

Your Twilio account + a voice-capable number (or Hosted Relay).

Install / what you need

No install. Twilio SID + token + a voice-capable from-number.

How to connect

1 Enable voice on your Twilio number.
2 Open the dashboard's Notifications panel → Add destination → choose voice, fill in the credentials.
3 CYCON 1 places a call; voicemail detection re-fires the loop until a human answers.

When you'd use it

Unmissable CYCON 1 escalation.

After-hours "someone has to answer" paging.

Last rung of the escalation ladder.

What Herald sends through this channel

8 setup fields

Herald hands every alert to the TwilioVoiceAdapter as a DispatchPlan. The fields below are what the dashboard form asks for; the sample is the plan the adapter receives. The adapter renders it into the channel-native shape (Discord embeds, Teams MessageCards, PagerDuty Events-API payloads, TwiML, JSON POST bodies) on the way out — that wire transcript varies per channel.

Setup form fields

field	type	required	description / default
hosted_relay	boolean	optional	Route through cybercli.com Hosted Relay (Business+ only). When False (default), uses operator's BYO Twilio account. · default: false
account_sid	string	optional	no description
auth_token_secret_ref	string	optional	Vault secret reference; auth token resolved at adapter init
from_number	string	optional	Twilio-purchased number in E.164 (e.g., +14155551234)
relay_api_key_secret_ref	string	optional	cybercli.com Hosted Relay API key (vault ref)
relay_base_url	string	optional	Hosted Relay endpoint (override for staging) · default: "https://relay.cybercli.com"
timeout_seconds	number	optional	no description · default: 15
voice_twiml_url	string	optional	Override TwiML URL; default = inline Say-body TwiML hosted by us

Sample DispatchPlan (input to the adapter)

{
  "decision_id": "tdc-2026-06-20-abc12",
  "channel": "<channel-type>",
  "recipient": {
    "recipient_id": "soc-oncall",
    "display_name": "SOC on-call",
    "addresses": [
      {
        "channel": "<channel-type>",
        "address": "<destination>",
        "min_defcon": 5
      }
    ]
  },
  "urgency": "high",
  "retry_policy": {
    "max_attempts": 3,
    "initial_backoff_seconds": 5
  },
  "subject": "Suspicious login on CEO-LAPTOP",
  "body": "Warden flagged a PowerShell child of WINWORD.EXE. The encoded command resolved to a base64-wrapped Invoke-WebRequest to a newly-registered domain. Trust ladder: L3.",
  "approval_link": "https://app.cybercli.local/approve/abc12",
  "incident_ref": "case-2026-0142",
  "signal_id": "sig-2026-06-20-9f3"
}

Sovereignty: byo_external · Min tier (BYO): business · Hosted Relay: business · Twilio Voice call paging; Business+ only.

Sovereignty

Calls place through your own Twilio account. A self-hosted SIP/Asterisk path is on the roadmap for full sovereignty.

Who notifies through it

Herald — the Guild's voice role — routes alerts, daily digests, and AI verdicts here, on a per-CYCON-state matrix you control. CYCON 1/2 alerts repeat until an operator acks.

The Guild →

Other Paging channels

Go deeper