# Email Notifications CyberGuard can send email notifications about what happens to your automatic assessments: a scheduled assessment that completed or failed, a probe that stopped responding, a weekly summary of the work recorded in the Workspace, a monthly report and alerts about threats that concern your organization. Emails are sent through **your own mail server**, so they come from an address of your organization. Setting up notifications takes two steps, both in **Company Profile → Edit**: 1. Configure and test the mail server in the **SMTP** tab. 2. Turn on the notifications you want, and choose who receives them, in the **Notifications** tab. The same tab holds the [threat intelligence alerts](#threat-intelligence-alerts). ## Step 1 — Configure the Mail Server (SMTP)  | Field | What to enter | | --- | --- | | **SMTP Server** and **Port** | The address and port of your mail server (for example port 587). | | **SSL/TLS** | Whether the connection is encrypted. Keep it active unless your server does not support it. | | **Language** | The language of the notification emails (English or Italian). | | **Username** and **Password** | The account used to send mail. The password is stored encrypted; leave the field empty to keep the saved one. | | **Sender Email** and **Sender Name** | The address and name the emails appear to come from. | Click **Save**, then enter an address in the test field and click **Send Test**. When the test email arrives, the tab shows the date of the successful test and notifications can be turned on. > Notifications work only with a **tested** mail server. If you change the server, port, encryption, account or sender, the test is reset: send a new test before notifications start again. If you remove the mail server configuration, all notifications are turned off. ## Step 2 — Choose the Notifications  Each notification has its own switch and its own recipients. Enter one or more addresses separated by commas or semicolons; recipients are required only for the notifications that are turned on. | Notification | When it is sent | | --- | --- | | **Scheduled assessment completed** | Every time a [scheduled](https://wiki.cyberguard.srl/cat/administration/scheduling.md) Microsoft Entra or Microsoft 365 assessment completes successfully. | | **Scheduled assessment not completed** | When a scheduled assessment fails, remains incomplete or does not run, with the reason. | | **M365 probe not reachable** | When a Microsoft 365 probe has not checked in for the number of hours you set (24 by default). One email per outage: if the probe comes back and later stops again, a new email is sent. | | **Weekly workspace summary** | Every Monday at 08:00: open activities, activities idle for more than 7 days and activities resolved during the week. Not sent when there is nothing to report. See [Workspace](https://wiki.cyberguard.srl/cat/workspace.md). | | **Monthly report** | On the first day of every month at 08:00: a PDF with the Security Score and its trend, the top risks, the exploited vulnerabilities, identity and threats of the month just ended. Sent only when there is at least one assessment. | Click **Save** to apply your choices. Every email sent, or failed, is recorded in the **Audit Log** tab. ## Threat Intelligence Alerts  The **Threat intelligence alerts** card, below the email notifications, warns you by email when the [threat intelligence](https://wiki.cyberguard.srl/cat/getting-started/threat-intelligence.md) of the portal finds something that concerns your organization. The same events also appear on the [Dashboard](https://wiki.cyberguard.srl/cat/getting-started/dashboard.md); the email reaches you without opening the portal. | Alert | When it is sent | | --- | --- | | **Websites under DDoS attack** | One of your **Websites to monitor**, or one of your Microsoft 365 domains, appears among the targets of the NoName057(16) group. A domain also covers its subdomains. | | **Attacks on the sector** | New ransomware victims in your sector and, when both are known, in your country. Sector and country are the ones set in your [Company Profile](https://wiki.cyberguard.srl/cat/getting-started/portal.md#company-profile). | To turn the alerts on: 1. Turn on **Notification on**. 2. In **Recipients**, enter one address per line (up to 20). **Add a portal user…** adds the address of a user of the portal. 3. Under **Alerts to receive**, keep selected the alerts you want: at least one is required. 4. Click **Save**. How the alerts work: - Each email lists every website hit or every new victim found at that moment, followed by the actions to take. A DDoS attack that comes back the following week is reported again. - Only events found after you turn the alerts on are reported: you never receive a backlog of old events. - The DDoS target lists are the attack orders of the group: an alert means that the attack is **under way or about to start**, not an early warning. The portal checks for new events every few minutes; the time the lists take to become public is outside its control. As for the other notifications, the card is available only with a tested mail server, and every email sent, or failed, is recorded in the **Audit Log** tab.