PushWarden Team reporting
PushWarden keeps everything on the machine by default. A team lead or maintainer who wants to see what is happening across machines has two tools. One sends alerts to a URL you set; the other writes a file that a person sends by hand.
| Tool | What leaves the machine | How | Default |
|---|---|---|---|
| Webhook alerts | each alert: host name, platform, findings with paths, reasons | JSON POST per alert | off |
| Feedback bundle | the journal, log tail, latest report, settings and status, redacted | a zip file the person sends | nothing is sent |
pushwarden status shows whether the webhook is on.
Redaction
The bundle passes every text through a redactor:
- the home folder is written as
~ - the user name and the host name are removed
- anything shaped like a secret is masked: GitHub, AWS, Slack and API tokens, private keys, JSON Web Tokens, credentials inside URLs, and the values of
token,password,api_key,webhook_urland similar keys
Webhook alerts
pushwarden config --set webhook_url=https://hooks.slack.com/services/T000/B000/XXXX
Or at install time with PUSHWARDEN_WEBHOOK=URL.
Each alert at or above webhook_min_severity (default HIGH) is posted as JSON:
| Field | Content |
|---|---|
text |
a formatted message for Slack |
content |
the same for Discord |
host, platform |
the machine |
context |
what produced the alert: guard, real-time, scan |
findings |
the findings with severity, category, title, path, details, action |
reasons |
for each finding: the why and the response |
One URL therefore works for Slack, Discord, Teams and your own endpoint. Webhook alerts are not redacted: they are meant for your own channel and include the host name and paths.
Feedback bundle
pushwarden feedback [--days N] [--out FILE] [--no-redact]
Writes pushwarden-feedback-DATE.zip in the current folder. Nothing is sent anywhere; the command tells you what is in the file so you can look before you send it.
| File in the zip | Content |
|---|---|
README.txt |
the period, the number of events, whether it is redacted |
summary.txt |
version, system, guard, service, firewall and policy status |
journal.jsonl |
every event in the period (default: the last 14 days) |
guard.log |
the last 2000 lines of the guard log |
latest-report.json |
the most recent full scan report |
config.json |
the settings in effect, with URLs and keys masked |
| Option | Effect |
|---|---|
--days N |
how many days of activity to include (default 14) |
--out FILE |
where to write the bundle |
--no-redact |
keep paths, user and host names. Token-shaped strings are masked regardless |
Reporting a false positive
pushwarden feedback --false-positive PATH --note "what it really is"
Records that the finding on PATH was wrong, with an optional note. It does not change the file; pushwarden history --allow PATH does that. The note travels with the bundle.
Telling users
If you turn on the webhook for a team, tell the people whose machines report: webhook alerts are not redacted and include the host name and paths. pushwarden status shows whether a webhook is configured.