Turn alerts on or off, and change when they fire

On every plan

Open the domain and go to Alerts. Each kind of alert has a rule there. An admin ticks or clears Send this alert and presses Save. This works on every plan. Who gets an email about an alert is each member's own choice, which Stop or restart alert and summary emails explains.

What a rule covers

A rule covers the domain and its subdomains. Every kind of alert starts on, except the one for arriving forensic reports, which starts off. Members who are not admins see whether each rule is on or off, and cannot change it.

From Pro up, every kind of alert is included. On a plan that does not include a kind, its rule says which plan does, and it cannot be turned on. If the organization moves to a plan without a kind, the open alerts of that kind close without a message.

Change the thresholds

Some kinds have thresholds, such as how many messages a new source must send before it counts, or how many hours without a report mean reports have stopped. From Teams up, an admin changes them in the rule and presses Save. Each field accepts values within the range that kind allows, and the form says when a value is outside it. On lower plans the rule shows its thresholds as text.

Send an alert to a chat channel

From Teams up, a rule also lists the organization's shared channels, such as Slack or Microsoft Teams. An admin ticks the channels that should get this alert. Admins add shared channels under Shared channels on Settings → Notifications. Email to members does not depend on this list.

Turn a rule off or back on

When you turn a rule off, its open alerts close at our next check of the domain, without a message to anyone. A PagerDuty incident the alert opened is resolved.

When you turn a rule back on, its first check records what it finds without alerting. Only a change after that sends an alert, so turning a rule on never sends a burst of old news.

Published 27 October 2026 · Checked 27 October 2026