Settings
The Settings area is where admins configure Herd — integrations, AI behavior, threat feeds, and system health, all organized into tabs.
Overview
Settings is the control center for your Herd organization. It's where you connect the tools your team already uses, tune how Herd behaves, manage who can do what, and keep an eye on the health of the platform.
To open it, click Settings in the left-hand sidebar.
Access to Settings is controlled by the Org Settings (org.settings) permission. Admins always have full access. Operators can reach Settings only if they belong to a group that grants the Org Settings permission. Members have no web app access. See Managing Roles, Groups, and Permissions.
The tabs
Settings is organized into a row of tabs across the top of the page:
Settings — the main tab, holding general preferences (theme, onboarding delay, business hours), account security, notification templates, and the Service accounts controls. See below and General & Security.
Integrations — a categorized gallery of every tool Herd connects to, each as a logo card with a live Connected badge. Click a card to open its setup. See below.
Context — your Organizational Context, the AI context that shapes how Herd writes and reasons about your organization. See General & Security.
Feeds — built-in and custom threat-intelligence feeds, plus channel delivery to Slack and Microsoft Teams. See Threat Intel Feeds.
Billing — your plan and billing details (shown when billing applies to your organization).
Monitoring — health and audit views: Logs, Training, Email, Slack, Teams, Jobs, and Queues. See Monitoring & Health.
Organizations — organization management. This tab only appears for Herd platform administrators.
Integrations have their own tab again. Connection tiles moved off the main Settings tab onto a dedicated Integrations tab — a card gallery grouped by category, with a Connected badge on everything that's live. Feature-specific settings (training approval, simulation template rotation, the default group for new users) still live with their features, behind a gear icon on those pages.
The Integrations tab
Settings → Integrations groups everything Herd connects to into categories. Click any card to open that integration's setup:
Messaging — Slack and Microsoft Teams, including a Custom Slack Bot option and Canvas Leaderboards.
Identity — Okta, Microsoft Entra ID, and Google Workspace for user and group sync. See Okta, Azure AD, and Google Workspace. For push-based provisioning from any IdP, see SCIM Provisioning.
Security & SIEM — Splunk (pull security events for risk-aware targeting), SIEM & DLP Webhooks (auto-assign trainings from SIEM and DLP alerts, and stream Herd events out), and Google SecOps (ingest SecOps alerts and push Herd events to Chronicle). See SIEM/DLP Webhooks.
HRIS & ERP — Workday, BambooHR, and Rippling for read-only employment signals, plus SAP for financial-entitlement sync. See HRIS Integrations and ERP Integration.
Knowledge & Policies — Notion and the SharePoint/OneDrive policy store. See Policies.
Email — Gmail & Outlook phishing-report detection, plus Security Alert Automations. See Email Providers.
Dev & Compliance — GitHub engineering-health signals, Drata evidence push, and LLM API keys. See GitHub Integration, Drata Integration, and LLM Providers.
The main Settings tab keeps the organization-level preferences that aren't connections: Business Settings (onboarding delay, business hours), Notification templates, API Access (API Keys), and Service accounts (see Users).
Notification templates
Herd lets you customize the wording of certain automated messages it sends to users. From the Notification templates tile on the Settings tab, click Edit notification templates to open the editor (currently in Beta). It covers the Track completion reminder message and lets you edit:
Subject — an optional header (Slack) or bold title (Teams), up to 200 characters.
Body — the message content, up to 4000 characters, using Slack-flavored markdown.
Variables — dynamic placeholders in
{{double curly braces}}that Herd fills in per recipient. Click an Insert variable button to add one to the body.
The editor has separate Slack and Microsoft Teams tabs, each with a live preview of how the message will render (the preview uses sample values). Use Save template to apply your changes, or Reset to default to revert to Herd's built-in wording at any time.
Event workflows (provider security alerts)
Herd can turn security alerts from your email providers into automatic action. The Provider security alerts feature (in Beta, found alongside Email Providers) pulls alerts from Gmail Alert Center and Microsoft 365 Defender and reacts to them based on rules you define.
Provider toggles — enable or disable alert polling per provider (Google Workspace, Microsoft 365). Each provider must be connected and have the required admin consent first.
Alert mappings — rules that match an alert type (and optional source) to an action: assign a training, notify an admin, do both, or ignore.
Failed actions — a panel listing alert-triggered actions that failed, with attempt history and a manual retry button.
Event audit feed — a recent history of provider events Herd has picked up, with status, user, and any error.
For SIEM/DLP tools outside email, use Security Webhooks instead.
Last updated