Outcome
By the end of this lesson, you will be able to name the three remediation notifications and when each is sent, route the approval notice to a team channel, and follow remediation outcomes when no completion email arrives.
| Prerequisites | M2.3.L1 - L5 · T1.M1.6 (notifications) |
| Time | 9 minutes |
1. Concept
A remediation can tell you three things: that it needs an approval, that it finished, and that it failed.
By default only the first one is sent. The other two exist but are off by default for the whole ZopNight deployment, so you follow outcomes in the product rather than in your inbox.
THE THREE REMEDIATION NOTIFICATIONS:
APPROVAL REQUIRED always sent An editor started something an admin must approve
COMPLETED sent only when terminal emails are switched on (off by default)
FAILED sent only when terminal emails are switched on (off by default)That is the whole list. There is no “started”, “declined”, “expired” or “validation failed” notification.
What is sent, and to whom
EVENT EMAIL CHANNELS────────────────────────────────────────────────────────────────────Approval required Every org admin except Any channel subscribed the person who clicked. to "Remediation Approval Always on; no setup. Request"
Completed Only when terminal emails Any channel subscribed are on (off by default) to "Remediation Succeeded", same gate
Failed Only when terminal emails Any channel subscribed are on (off by default) to "Remediation Failed", same gateThe approval email has the subject “[ZopNight] Remediation approval needed” and links to the job. It is sent once per approval step: if the workflow is replayed, it is not sent again.
The terminal-notification switch
The completed and failed notifications sit behind one switch:
TERMINAL-NOTIFICATION SWITCH What it is: a ZopNight deployment setting Default: off Scope: every org on the deployment at once Who sets it: ZopNight, not your team Settings page: none
WHEN OFF (the default): Only the approval-required notice goes out Completed and failed runs send nothing, by email or to channels
WHEN ON: Completed and failed notices go to admins by email and to subscribed channelsIt is off by default, and only ZopDev sets it. Your team cannot switch it per org, so do not build a process that depends on receiving those emails.
Routing the approval notice to a channel
The approval email always reaches admins. If your admins live in a team channel rather than their inbox, add a channel:
Settings → Notifications → Channels & Alerts Add your Slack, Teams, Google Chat or webhook channel if it is not there yet Under the Remediation category, subscribe that channel to "Remediation Approval Request"
RESULT: The same notice lands in that channel It links to the job; it has no approve buttons The decision is still made in ZopNightRemediation notices use the same subscription mechanism as every other event (T1.M1.6.L4). There is no separate remediation routing, no per-rule suppression and no audit-log mirror to a SIEM.
Where to look instead of your inbox
QUESTION WHERE TO LOOK───────────────────────────────────────────────────────────────Is anything waiting for me? Recommendations page banner: "N remediations awaiting your approval" (admins only)
Did my remediation finish? Reopen the recommendation; the wizard shows the last job's step timeline with each step's status
Why did it fail? The failed step in that timeline: error class, fix hint, console link
Who started, approved or Audit Logs: "Started remediationrejected it? on recommendation ...", "Approved workflow step ...", "Rejected workflow step ..."The audit trail and the step timeline do not depend on notification settings. Every run is recorded whether or not anyone is told.
Notification anti-patterns
ANTI-PATTERN FIX──────────────────────────────────────────────────────────────────Waiting for a "completed" email It will not arrive by default. Check the job timeline.
Treating silence as success Silence means nothing was sent, not that it worked. Check the timeline.
Admins who never read email Subscribe a channel to Remediation Approval Request
Expecting to approve from Slack The notice links to ZopNight; approve there
One admin for the whole org Requests stall and hit the 48-hour cancel. Keep two.The discipline: route the one notice that needs a human, and read outcomes where they are recorded.
2. Demo
A platform team’s first month with remediation, with terminal emails off:
WEEK 1: An editor starts an orphan snapshot delete (RC-021, guided) Two admins get "[ZopNight] Remediation approval needed" Neither checks email that afternoon The request sits for a day
FIX: the team adds a subscription Settings → Notifications → Channels & Alerts Channel: #platform-approvals (Slack) Event: Remediation Approval Request
WEEK 2: The next approval notice lands in #platform-approvals An admin opens the link, reviews the evidence in the drawer, and approves in ZopNight within 20 minutes
WEEK 3: An editor's resize fails overnight. No email arrives. Next morning the editor reopens the recommendation: Step timeline: precondition ✓, approval ✓, action ✗ Error class: user_action Fix hint: missing permission on the instance's role The editor grants the permission, then starts the remediation again; it completes
WEEK 4: The team lead reviews Audit Logs for the month: Started remediation: 14 Approved workflow step: 9 Rejected workflow step: 2 Two requests had been cancelled at 48 hours; both were from the week before the channel was addedOne subscription fixed the only notice that needs a human. Outcomes were read from the timeline and Audit Logs.
3. Hands-on (5 min)
Check your remediation visibility:
□ STEP 1: Settings → Notifications → Channels & Alerts Is any channel subscribed to "Remediation Approval Request"? □ Yes (channel: _______) □ No
□ STEP 2: Admin coverage Admins who receive the approval email: _____ Do they read it on working days? □ Yes □ No
□ STEP 3: Find a recent remediation Reopen the recommendation Last job status: □ completed □ failed □ cancelled Failed step (if any): __________
□ STEP 4: Audit Logs Started remediations this month: _____ Approved / rejected steps: _____ / _____
□ STEP 5: Process check Does anyone on the team expect a "completed" email? □ Yes (correct the expectation) □ NoA 15-minute check confirms that approvals reach a person and outcomes are read where they are recorded.
4. Knowledge check
Q1
Your team wants an email every time a remediation completes. What is true by default?
A. Turn it on per org in the notification settings for remediation outcomes
B. Subscribe a channel to “Remediation Succeeded” and it starts arriving at once
C. Ask each admin to opt in to completion emails from their own user profile
D. It is a deployment-wide switch that is off; read the job’s step timeline
Show answer
Correct: D. Completed and failed notifications are gated by a ZopNight deployment setting that is off by default and that only ZopDev sets. A channel subscription to “Remediation Succeeded” receives nothing while the switch is off. Follow outcomes in the job’s step timeline and Audit Logs.
Q2
The audit log captures remediation events. If notifications are disabled, the audit log:
A. Stops recording
B. Continues to record everything regardless of notification settings
C. Recorded selectively
D. Records only the failures, and never any of the successful outcomes
Show answer
Correct: B. Audit log is the source of truth; notifications are a delivery mechanism. You can disable notifications without losing audit evidence.
Q3
An editor’s remediation failed overnight and nobody was notified. Where do they find out why?
A. Reopen the recommendation and read the failed step in the job timeline
B. Wait for the failure email, which is sent once the nightly batch completes
C. Check the Slack approval channel, where failures are mirrored automatically
D. Open a support ticket, since failure details are only visible to ZopNight
Show answer
Correct: A. The failed step carries the error class, fix hint and console link. No failure notice is sent while terminal emails are off, and remediation failures are not mirrored into the approval channel.
5. Apply
By default only the approval-required notice is sent: by email to admins, and to any channel subscribed to “Remediation Approval Request” in Settings → Notifications. Completed and failed notices wait on a ZopNight deployment switch. Read outcomes in the job’s step timeline and in Audit Logs.
For your team: subscribe one channel your admins watch to Remediation Approval Request, and tell the team not to wait for completion emails.
Module quiz
You have now completed L6 of M2.3. L7, the Recommendation Safety Gate, comes next, then the module quiz.
Related lessons
- L1: 3-step workflow
- L2: Allowlisted, guided, advisory
- L3: Approval gate
- L4: Error classes
- L5: Database denylist
- T1.M1.6.L4: Severity routing