> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/settings/settings.md).

# Settings

## Overview

**Settings** is the control center for your Herd organization. It's where you connect the tools your team already uses, tune how Herd behaves, manage who can do what, and keep an eye on the health of the platform.

To open it, click **Settings** at the bottom of the left-hand sidebar — it lives in the sidebar footer, just above your organization name and **Sign Out**.

{% hint style="info" %}
Access to Settings is controlled by the **Org Settings** (`org.settings`) permission. **Admins** always have full access. **Operators** can reach Settings only if they belong to a group that grants the Org Settings permission. **Members** have no web app access. See [Managing Roles, Groups, and Permissions](/herd-security-docs/how-to-documentation/managing-roles-groups-and-permissions.md).
{% endhint %}

***

## The tabs

Settings is organized into a row of tabs across the top of the page:

* **Settings** — the main tab, holding general preferences (theme, onboarding delay, business hours), the **AI Model** and **AI Narration Voice** defaults, account security, notification templates, **Custom variables**, the **Trust Badge**, **SCIM provisioning** tokens, and the **Service accounts** controls. See below and [General & Security](/herd-security-docs/settings/settings/general-and-approvals.md).
* **Integrations** — a categorized gallery of every tool Herd connects to, each as a logo card with a live **Connected** badge. Click a card to open its setup. See below.
* **Context** — your **Organizational Context**, the AI context that shapes how Herd writes and reasons about your organization. See [General & Security](/herd-security-docs/settings/settings/general-and-approvals.md#your-organizational-context).
* **Threat Feed** — opens the [Threat Feed](/herd-security-docs/settings/settings/threat-feed.md) page: industry threat events and phishing reported by your team, AI-ranked for your organization. Feed sources and digests are managed from there via **Manage feeds** — see [Threat Intel Feeds](/herd-security-docs/settings/settings/threat-intel-feeds.md).
* **Billing** — your plan and billing details (shown when billing applies to your organization).
* **Monitoring** — health and audit views: Logs, Training, Email, Slack, Teams, Jobs, and Queues. See [Monitoring & Health](/herd-security-docs/settings/settings/monitoring-and-health.md).
* **Network access** and **Organizations** — platform-administration tabs that only appear for Herd platform administrators.

{% hint style="info" %}
**Integrations have their own tab again.** Connection tiles moved off the main Settings tab onto a dedicated **Integrations** tab — a card gallery grouped by category, with a **Connected** badge on everything that's live. Feature-specific settings (training approval, simulation template rotation, the default group for new users) still live with their features, behind a **gear icon** on those pages.
{% endhint %}

***

## The Integrations tab

**Settings → Integrations** groups everything Herd connects to into categories. Click any card to open that integration's setup:

* **Messaging** — Slack and Microsoft Teams, including a **Custom Slack Bot** option and **Canvas Leaderboards**.
* **Identity** — Okta, Microsoft Entra ID, and Google Workspace for user and group sync. See [Okta](/herd-security-docs/okta/okta-single-sign-on.md), [Azure AD](/herd-security-docs/microsoft-entra-id-azure-ad/getting-started-with-azure-ad-integration.md), and [Google Workspace](/herd-security-docs/google-workspace/google-workspace.md). For push-based provisioning from any IdP, see [SCIM Provisioning](/herd-security-docs/settings/settings/scim-provisioning.md).
* **Security & SIEM** — **Splunk** (pull security events for risk-aware targeting), **Microsoft Fabric** (pull remediation targets from your Fabric data platform), **SIEM & DLP Webhooks** (auto-assign trainings from SIEM and DLP alerts, and stream Herd events out), and **Google SecOps** (ingest SecOps alerts and push Herd events to Chronicle). See [SIEM/DLP Webhooks](/herd-security-docs/settings/settings/siem-dlp-webhooks.md).
* **HRIS & ERP** — Workday, BambooHR, and Rippling for read-only employment signals, plus SAP for financial-entitlement sync. See [HRIS Integrations](/herd-security-docs/hris-and-erp/hris.md) and [ERP Integration](/herd-security-docs/hris-and-erp/erp.md).
* **Knowledge & Policies** — Notion and the SharePoint/OneDrive policy store. See [Policies](/herd-security-docs/policies/policies.md).
* **Email** — **Gmail** and **Microsoft Outlook** phishing-report detection (now separate tiles, each with its own connection status), plus **Security Alert Automations**. See [Email Providers](/herd-security-docs/email-providers/email-providers.md).
* **Dev & Compliance** — GitHub engineering-health signals, Drata evidence push, and LLM API keys. See [GitHub Integration](/herd-security-docs/settings/settings/github-integration.md), [Drata Integration](/herd-security-docs/compliance/drata-integration.md), and [LLM Providers](/herd-security-docs/settings/settings/llm-providers.md).

The main **Settings** tab keeps the organization-level preferences that aren't connections: **Business Settings** (onboarding delay, business hours, the [AI Model picker](/herd-security-docs/settings/settings/general-and-approvals.md#ai-model) and [AI Narration Voice](/herd-security-docs/settings/settings/general-and-approvals.md#ai-narration-voice)), **Notification templates**, **Custom variables** (directory-lookup variables for steps and nudges — see [General & Security](/herd-security-docs/settings/settings/general-and-approvals.md#custom-variables-directory-lookup-variables)), **API Access** ([API Keys](/herd-security-docs/settings/settings/api-keys.md)), **SCIM provisioning** tokens (see [SCIM Provisioning](/herd-security-docs/settings/settings/scim-provisioning.md)), the **Trust Badge** (see [General & Security](/herd-security-docs/settings/settings/general-and-approvals.md#trust-badge)), and **Service accounts** (see [Users](/herd-security-docs/users/users.md#service-accounts)).

***

## Notification templates

Herd lets you customize the wording of certain automated messages it sends to users. From the **Notification templates** tile on the Settings tab, click **Edit notification templates** to open the editor (currently in **Beta**). It covers the **Track completion reminder** message and lets you edit:

* **Subject** — an optional header (Slack) or bold title (Teams), up to 200 characters.
* **Body** — the message content, up to 4000 characters, using Slack-flavored markdown.
* **Variables** — dynamic placeholders in `{{double curly braces}}` that Herd fills in per recipient. Click an **Insert variable** button to add one to the body.

The editor has separate **Slack** and **Microsoft Teams** tabs, each with a live preview of how the message will render (the preview uses sample values). Use **Save template** to apply your changes, or **Reset to default** to revert to Herd's built-in wording at any time.

***

## Event workflows (provider security alerts)

Herd can turn security alerts from your email providers into automatic action. The **Provider security alerts** feature (in **Beta**, found alongside Email Providers) pulls alerts from **Gmail Alert Center** and **Microsoft 365 Defender** and reacts to them based on rules you define.

* **Provider toggles** — enable or disable alert polling per provider (Google Workspace, Microsoft 365). Each provider must be connected and have the required admin consent first.
* **Alert mappings** — rules that match an alert type (and optional source) to an action: assign a training, notify an admin, do both, or ignore.
* **Failed actions** — a panel listing alert-triggered actions that failed, with attempt history and a manual retry button.
* **Event audit feed** — a recent history of provider events Herd has picked up, with status, user, and any error.

For SIEM/DLP tools outside email, use [Security Webhooks](/herd-security-docs/settings/settings/siem-dlp-webhooks.md) instead.