tests fixes and some product advisories tunes ups

src/Notifier/StellaOps.Notifier/docs/attestation-rules.sample.json

@@ -51,6 +51,31 @@
           "template": "tmpl-attest-transparency-anomaly"
         }
       ]
+    },
+    {
+      "ruleId": "identity-watchlist-alert",
+      "name": "Identity watchlist match",
+      "enabled": true,
+      "tenantId": "<tenant-id>",
+      "match": {
+        "eventKinds": [
+          "attestor.identity.matched"
+        ]
+      },
+      "actions": [
+        {
+          "actionId": "slack-watchlist",
+          "enabled": true,
+          "channel": "slack-attestation-alerts",
+          "template": "identity-matched"
+        },
+        {
+          "actionId": "webhook-watchlist",
+          "enabled": true,
+          "channel": "webhook-siem",
+          "template": "identity-matched"
+        }
+      ]
     }
   ],
   "channels": [
@@ -81,6 +106,14 @@
       "name": "SIEM ingest",
       "endpoint": "https://siem.example.internal/hooks/notifier",
       "secretRef": "ref://notify/channels/webhook/siem"
+    },
+    {
+      "channelId": "slack-attestation-alerts",
+      "type": "slack",
+      "name": "Attestation alerts",
+      "endpoint": "https://hooks.slack.com/services/T000/B000/ATTESTATION",
+      "secretRef": "ref://notify/channels/slack/attestation-alerts",
+      "description": "Slack channel for identity watchlist alerts"
     }
   ]
 }