The alerts nobody sees
Most 3CX monitoring sends alerts somewhere your team isn't. Email is the classic offender: a critical-outage notice lands in an inbox nobody is watching at 9 p.m., buried under newsletters and ticket digests, and the first anyone hears of the problem is the customer calling in the morning. A dashboard you have to remember to open is no better — monitoring only works if the alert reaches a human in the place that human is actually looking.
And the place your team is actually looking is chat. Whether your MSP runs on Slack or on Microsoft Teams, that window is open all day on every engineer's screen. It is where the on-call banter happens, where the "anyone else seeing this?" gets asked, where work coordinates. An outage alert that shows up there — formatted, color-coded, impossible to miss — gets acted on in seconds. The same alert sitting in an unread inbox gets acted on when the damage is already done.
So the goal is simple: stop routing 3CX incidents to channels nobody watches, and start putting them where your team already works. Sikurd does that two ways — native rich messages for Slack and Teams, and a structured JSON feed to Zapier for everything else.
Slack & Teams: native rich alerts, not plain text
A plain-text "ALERT: instance down" line in a busy channel scrolls past unread. Sikurd doesn't send those. When an alert is routed to your chat channel, it builds a proper, native message in each platform's own format — the kind your eye actually catches.
Slack
Slack alerts arrive as a Block Kit message wrapped in a severity-colored attachment — the bar down the side is red for a critical alert, amber for a warning, green for info — so the urgency reads at a glance before you've parsed a single word. Inside, a header block leads with a status emoji and the human-readable alert type (Sikurd translates the raw alert code into a message-aware label, so a trunk alert about an SBC or bridge reads as "SBC Down," not a misleading "TRUNK DOWN"). Below that, a fields block lays out the essentials in a tidy grid: the instance name, its FQDN, the severity, and the timestamp. Finally, a "View in Sikurd" action button deep-links straight to that instance's dashboard — one click from the alert to the place you fix it.
Microsoft Teams
Teams alerts arrive as a MessageCard — the most broadly compatible format across Teams connectors and Power Automate flows — with a theme color matching the severity (red, orange, or blue). The card carries an activity title naming the alert, an instance subtitle, and a facts table listing the instance, FQDN, severity, the alert message, and the time. An "open in Sikurd" action button on the card deep-links to the same instance dashboard. Same information, same one-click jump, rendered the way Teams expects it.
The point of both formats is the same: someone glancing at the channel should know what broke, on which customer, and how serious it is, without opening anything — and be one tap away from the instance when they want detail.
Zapier: the "connect it to anything" channel
Slack and Teams cover where your team talks. But sometimes you want an alert to do something — log to a sheet, page a rota, open a record in a homegrown system, fire an SMS, kick off a runbook. That's what the Zapier integration is for.
Where Slack and Teams receive a message Sikurd has pre-formatted for chat, Zapier receives the alert as a structured JSON payload — fields like event, severity, message, source, and timestamp. Zapier accepts arbitrary JSON, so you map those fields into any Zap you can build and let Zapier's thousands of connected apps take it from there. It's the deliberate escape hatch: instead of Sikurd trying to integrate natively with every tool on earth, it hands you a clean payload and lets you wire it to whatever you already run.
The mental model is two-tier. Slack and Teams are the native, great-looking destinations for the humans who respond to incidents. Zapier is the programmable one — the structured feed you point at any downstream automation. Most MSPs use both: rich alerts in the channel the team watches, plus a JSON pipe into Zapier for the custom workflow that channel can't do.
You decide exactly what goes where
Putting alerts in chat only helps if the right alerts land there. Flood the channel with every minor warning and your team learns to mute it — the inbox problem reborn in Slack. Sikurd avoids that with a per-tenant routing matrix: one row per alert type, and each row independently toggles its channels — mobile/desktop push, PSA ticket, Slack/Teams webhook, and AI voice call — and sets a minimum severity floor.
That gives you precise control over the channel. Send critical service outages to Slack while keeping noisy WARNING-level flaps out of it; set a type's floor to CRITICAL and any warning-level firing of that type stays silent on every channel. The webhook channel covers both Slack and Teams, so the same routing decision governs your chat tooling regardless of which one you run. Configure it once per tenant and every future alert routes itself.
Two more guardrails keep the signal clean. Every integration has a "send test" — it posts a sample message to your endpoint in the right format and tells you whether the call succeeded, so you confirm the wiring before trusting it with a real incident. And alert dispatch respects maintenance windows: if an instance is inside a scheduled window when something fires, Sikurd skips dispatching to your integrations entirely, so planned reboots and trunk swaps never spam the channel. The noise you suppress is planned; the noise you keep is real.
Per-tenant, and locked down
Integrations are scoped per tenant. Each Sikurd tenant has its own enabled Slack, Teams, and Zapier endpoints, and when an alert fires Sikurd dispatches only to the integrations belonging to that instance's tenant — one customer's incidents never surface in another's channel. Because an outbound webhook is effectively an alert-routing control surface, creating, editing, and deleting integrations is restricted to owners and admins, and stored webhook URLs are masked when the list is read back so they're never exposed in plain text. Put the alerts where the team works, without handing the routing keys to everyone.
Adjacent reading
- Smart 3CX alerts with auto-resolve — dedupe, routing, and the matrix that decides which channel each alert hits.
- Closed-loop PSA tickets for 3CX — when an alert should open a ticket instead of (or alongside) a chat ping.
- AI voice alerts vs PagerDuty for 3CX MSPs — escalation for the incidents a chat message isn't loud enough for.