Notifications and alert rules
Get told about expirations, unusual password access, security changes and more, wherever you work.
Notification rules watch your workspace and alert the right people when something needs attention.
Your 🔔 inbox
The bell in the top bar shows how many unread alerts you have. Click it to see the latest, or choose See all for your full inbox, where you can show only unread alerts and Mark all read. Clicking an alert takes you to the item it's about.
Start with the recommended rules
Go to Admin → Notifications (you need Manage workspace settings). If you don't have any rules yet, choose Add recommended rules to get:
| Rule | Alerts when |
|---|---|
| Expiring soon | Something expires in 30, 7 or 1 days, or has expired |
| Unusual password access | One person reveals 10 or more passwords within 15 minutes |
| Security changes | Two-factor is turned off, someone is given admin rights, an API key is created or a user is added |
| Repeated failed sign-ins | 5 or more failed sign-ins for one account within 15 minutes |
Each one alerts admins in the 🔔 inbox. Change them however you like.
Create a rule
Choose + New rule and pick what to watch for:
| Trigger | Settings |
|---|---|
| Something is expiring | Days before to alert (e.g. 30, 7, 1), whether to alert when expired, and which kinds: domain registrations, SSL certificates, and warranties, licenses and other expiry dates |
| Lots of passwords revealed | At least N reveals within M minutes, by one person or by everyone together |
| Repeated failed sign-ins | At least N failures within M minutes, for one account or from one IP address |
| Security changes | Which changes to alert on |
| Domain or certificate changed | Every change the domain tracker finds |
| Lots of things deleted | At least N items deleted by one person within M minutes |
Then choose:
- Which organizations: all, or only some. Workspace-wide triggers, such as sign-ins, always cover the whole workspace.
- Who: roles, teams or individual people. They get the alert in their inbox and by email.
- Where: the 🔔 inbox, email, and any alert channels such as Slack, Teams or a PSA ticket.
How alerts behave
- No duplicates. Each thing is alerted once per threshold. For example, a certificate is alerted once at 30 days, once at 7 and once at 1.
- No floods. After a "lots of" rule fires for someone, it waits for its time window to pass before firing again for them.
- Privacy. People are only told about organizations and items they can see, including restricted items.
- Fresh start. A new security or domain-change rule starts watching from the moment you create it, not from old history.
Expirations are checked about once an hour. Everything else is checked every minute.
Test and review
- Test (on each rule) sends a sample alert through the rule's inbox, email and channels, so you can check where it lands.
- Pause turns a rule off without deleting it.
- History lists every alert, and whether each delivery worked.