Tackle insider threats in real-time. Learn how to set up and customize alerts and get notified when your employees access unauthorized apps or visit specific websites.
Alerts are accessible to Admins and Managers. Admins always have access to Alerts. For Managers, the ability to create or view alerts and related analytics is controlled by Admins, and it is disabled by default in new organizations until an Admin enables it.
Security Alerts is a component of the Workspace Security (WS) Add-on, which can be managed and activated alongside other additional features in the Billing page in Settings.
How to Set up Security Alerts
Identify and eliminate risks as soon as they arise. To create a new alert, go to Alerts in the left-side menu and click on the New Alert button.
1. Select Alert Type
After clicking the New Alert button, you will be prompted to customize your alert. Start by selecting the type of alert you wish to receive real-time insights about.
Under Security Alerts, choose from:
Detected App - Select applications that have been used within your organization or choose ones that haven't been used but you'd like to be notified if any employees start using them.
Detected Site - Specify websites that may violate your policies and receive alerts if employees access them. Alternatively, you can track unproductive websites that have been flagged within your company to uncover usage patterns.
Detected Keyword - Triggered upon detecting certain keywords in URL or app title. Multiple keywords can be added within one alert (1000 is a limit), but an alert will be sent for each of the keywords detected. Keyword alerts allow you to detect if your workforce, for example, was searching for 'crime' on Google search, enabling you to notify the appropriate individuals accordingly.
Throughout the entire process, you will be guided by helpful tooltips.
2. Name Your Alerts
After selecting the alert type, give the alert a descriptive name. This makes the alert easy to recognize in your alert list in Settings → Alerts, on Alerts → Overview, and in Alerts → Logs.
3. Set the Conditions
By customizing conditions based on your requirements, you can refine your alerts to meet your specific needs. For security alerts, you will be prompted to define URLs and apps that will trigger alerts.
Detected Site - Define the modifier and URLs that will trigger an alert:
Modifier: Choose between 'equals' or 'contains' options. If 'equals' is selected, an alert will be sent only for an exact URL match specified in the alert. If 'contains' is selected, an alert will be sent even for partial matches.
URLs: Define proper URLs in the appropriate format such as www.youtube.com (only 'youtube' is not sufficient).
Detected App - Define the apps that will trigger an alert. Choose an application from the list that you have visited already in the Productivity Labeling or add the name of the app you haven’t used yet and get alerted when we first detect access to that application.
Detected Keyword - Define the modifier and keywords that will trigger an alert:
Modifier: Choose between 'equals' or 'contains' options. If 'equals' is selected, an alert will be sent only for an exact keyword match specified in the alert. If 'contains' is selected, an alert will be sent even for partial matches.
Keywords: The minimum length criteria is 2 characters and only words can be used. Keywords are checked in the app name and URL, but characters like 'www' or only 'http' or 'https' are not considered.
Keyword detection does not include keylogging.
4. Allow Screenshot Option when Alert is Triggered
This is an option for the Detected Site alert.
If you want to capture a screenshot when a risky website is detected, select the 'Take Screenshot' option. If your organization does not have the Screenshot feature in their plan, this action will not be available when creating an alert.
Once an alert is triggered and the Screenshot option is enabled, you can view the screenshots taken as a result of alerts on the Screenshot page. You will be able to filter by Screenshot type, where you can choose only those that were triggered with the alert:
Employees
Teams
Org Groups
Apps & Websites
Projects
Tasks
Screenshot types
Productivity types
Category
5. Decide Who Receives Notifications When and Where
Team & Employees: Specify the teams and employees for whom you want to set up alerts. This is based on the teams you oversee.
Days: Determine which days you want to set up alerts for.
Recipients: Determine who will receive these notifications. Recipients are also determined based on the scope. For example, if you are a manager setting up an alert, you will be the only recipient due to your scope.
6. Delivery
Determine if you want to receive in-app notifications, email notifications, or both. The delivery method is also based on the teams you oversee.
If you choose to receive alerts via email, you will receive them for all the alerts you've selected within 10 minutes of the alert being triggered.
At the bottom of the emails, clicking on Find out more will redirect the user to the Logs page, where they will find filtered alerts from the email.
Now, you are ready to click the Save button and start receiving alerts! All notifications you see after clicking on the notification bell list will be sorted from newest to oldest.
If a Manager created an alert while they had the permission and was its only recipient, the Admin will see N/A as the recipient in the alert list in Settings → Alerts. The Admin can assign a new recipient with Edit, or remove the alert with Delete, from the three-dot menu (⋯).
7. Managing existing alerts
To manage an alert, go to Settings → Alerts, find the alert in the list and click the three-dot menu (⋯) next to it. You’ll see:
• Edit: change the alert’s settings
• View logs: see when the alert was triggered
• Deactivate: stop the alert without deleting it. The alert stays in your list with the status Inactive.
• Delete: remove the alert
The Alerts page in the left-side menu is for viewing alerts only.
Alerts → Overview shows your alerts and their activity, and Alerts → Logs shows alerts that have already been triggered. You can’t edit, deactivate or delete an alert from either page.
Who can manage an alert
These rules apply to all alert types (Attendance, Security and Irregular Behavior):
• An Admin can manage any alert. That includes alerts created by Managers or other Admins, and alerts where they are only a recipient. For an alert created by another Admin, the Alert Type and Delivery settings can’t be changed.
• A Manager can only manage the alerts they created themselves.
Don’t see the option you need? Check that you’re in Settings → Alerts, because Alerts Overview and Logs don’t have these options.
If you’re a Manager, you can only edit, deactivate or delete alerts you created.
👉 Learn more:
How to set up Attendance alerts