Alert and Incident Notifications
UTMStack can email your team when a new alert is raised or an incident is created, and it posts system messages, such as rule flood guard warnings, to the notification bell. This page explains who gets what and how to set it up.
What is sent, and when
| Event | Notification bell | |
|---|---|---|
| A new top-level alert is raised | Yes, to Alert recipients | No |
| A repeat is filed as an echo, or dropped as a duplicate | No | No |
| An incident is created | Yes, to Incident recipients | No |
| Alerts are added to an incident, or an incident is assigned or changes status | No | No |
| The rule flood guard switches a rule off | No | Yes, a Warning |
Automated response flows can also send emails and bell notifications. See Automated Response Overview.
Set up email recipients
Email needs a working mail server on Configure > Settings > Email Configuration (see Email Configuration). You need the Administrator role.
- 1
Open Email Configuration
Go to Configure > Settings > Email Configuration.
- 2
Add alert recipients
Under Alert recipients, add the addresses that should receive new alerts to To, and any copies to CC. Type an address and click Add. The page explains: "Addresses notified when new alerts are raised. Leave empty and alerts are not emailed." Without a To address, no alert email is sent.
- 3
Add incident recipients
Under Incident recipients, add addresses to To and CC in the same way. "Addresses notified when an incident is created. Leave empty and incidents are not emailed." CC alone is not enough: without a To address, no incident email is sent.
- 4
Set the organization name and Base URL
Under Sender, the Organization name is shown at the start of the subject of alert emails. The Base URL is used for the Open in UTMStack link in alert emails.
- 5
Save
Click Save changes.
On a multi-tenant licence each tenant has its own email settings. Every tenant administrator should set the Alert recipients and Incident recipients of their own tenant. See Email Configuration.
What the emails contain
Alert email
Subject: the first 8 characters of the alert ID in brackets, then the alert name:
[<first 8 characters of the alert ID>] <alert name>. If an organization name is set, it comes first.Body: the alert name and description, then Severity, Category, Technique, Data source, Data type, When, and the adversary and target host names when the alert has them.
An Open in UTMStack link to the alert, when a Base URL is set.
Only top-level alerts are emailed. A rule that groups its alerts sends one email for the first alert, not one for each echo, and a duplicate that a rule drops sends none. To get fewer alert emails, add groupBy or deduplicateBy to noisy rules (see How Alerts Are Created).
Alerts that a tagging rule closes as False positive are still emailed, like any other new top-level alert.
Incident email
Subject:
New incident: <incident name>.Body: the incident name, its severity, status and description.
The notification bell
The bell in the top bar shows unread notifications for your tenant, for example a rule flood guard warning that a rule was switched off. From the bell you can mark notifications as read or unread, delete them, use Mark all read, or click View all to open Configure > Settings > Notifications.
| What you want to do | Permission | Built-in roles |
|---|---|---|
| See notifications | notifications.read | Administrator, Analyst, Viewer |
| Mark as read or unread, delete | notifications.write | Administrator, Analyst |
Read notifications are deleted after 30 days, and all notifications after 365 days. See Notifications for details.