Email Notifications
Email notifications deliver detection and investigation alerts directly to your team's inbox. In Batch mode, recipients receive a single digest covering all sources with updates. In Immediate mode, a separate email is sent for each source as soon as something new is found.
Setup
Navigate to Settings > Notifications
Toggle Email to enable email notifications
Add recipient email addresses in the Recipients field
Choose a Frequency mode — see
Frequency Modes
How Email Frequency Works
Batch (Default)
A single digest email is sent at the end of each batch window (default: 60 minutes). The digest covers all detections and investigations that have updates. Each entry shows its new event count, total count, and affected users.
If nothing has changed since the last digest, no email is sent.
Immediate
A separate email is sent for each detection or investigation as soon as new events are found or the investigation status changes. Use this when real-time email alerts matter more than inbox volume.
Threshold
An email is sent only when the event count exceeds a configured value. After the threshold is crossed, the count must increase again to trigger another email.
Per-Detection and Per-Investigation Overrides
Individual detections or investigations can override the global email settings. Open the source, go to the Notifications tab, toggle Use custom notification configuration, and adjust the email recipients and frequency independently.