Overview
Rescans tell you how a client’s posture has shifted over a period. Alerts tell you right now. When Telivy detects a specific security event (a new dark web breach, a string of M365 login failures, an admin account with MFA suddenly disabled), it fires a notification to whoever on your team needs to know. You define which events matter and which team members get notified. Alerts work across these coverage areas:- Internal Security: vulnerability changes on managed endpoints
- Typosquatting: newly registered look-alike domains impersonating the client
- Dark Web: new breach and account exposures
- Microsoft 365: identity and access events across connected tenants
- Google Workspace: the same coverage for GWS environments
Configuring Alert Policies
Alert policies are configured at the agency level and apply across all your assessments. Navigate to Alerts → Alert Policies in the Telivy portal to manage them. To add a new policy:- Click Add Policy.
- In the Configure Alert Policy step, select the Alert Category you want to monitor.
- Set the condition that triggers the alert. For Internal Vulnerabilities, for example, you can trigger on severity level, CVSS score, or EPSS score above a threshold.
- Click Continue.
- In the Configure Alert Delivery step, select which team members on your agency account should receive the notification.
- Click Save.
Alert Categories
Internal Vulnerabilities, Typosquatting, and both Dark Web alerts are fully active. Microsoft
365 and Google Workspace event alert coverage is expanding: the cloud event alerts that fire
today are No MFA User and Failed Logins. More categories are rolling out (see
Rolling out below).
Internal Security
Typosquatting
Dark Web
Microsoft 365
Google Workspace
Google Workspace mirrors the Microsoft 365 coverage for organizations running GWS instead of (or alongside) Microsoft 365.Rolling out
More Microsoft 365 and Google Workspace event alerts are being rolled out. Planned categories include Authentication Token Revoked, MFA Failed, MFA Disabled, MFA Enabled, Password Reset, Login Using Token, Login From Unapproved Location, User Created, User Deleted, Registered Device, Admin Role Assignment, Group Membership Change, and Admin Policy Change. Conditional Access Violation is planned for Microsoft 365 only.FAQ
How quickly does an alert fire after an event is detected?
How quickly does an alert fire after an event is detected?
Cloud events (M365, Google Workspace) are evaluated on each sync cycle. Endpoint-based alerts (Internal Vulnerabilities) are evaluated after each completed agent scan. Manual rescans trigger alert evaluation immediately. Notification emails are then batched and sent hourly, so you receive one grouped message rather than one per finding. See Scanning Schedule for when each type of data is collected.
Can I notify multiple team members from the same policy?
Can I notify multiple team members from the same policy?
Yes. In the Configure Alert Delivery step, you can select as many agency users as needed. Each selected user is notified independently when the policy triggers.
Are alert policies scoped to individual clients?
Are alert policies scoped to individual clients?
No. Policies are configured at the agency level and apply across all assessments. You can view alert history filtered to a specific client from that assessment’s Alerts tab, but the policy itself is agency-wide.
Do alerts require Risk Monitoring to be enabled?
Do alerts require Risk Monitoring to be enabled?
No. Alerts are available independently of the automated rescan feature. You can configure alerts on any eligible Risk Assessment without enabling the monitoring cadence.
Can I use webhooks instead of email or SMS?
Can I use webhooks instead of email or SMS?
Yes. Telivy supports outbound webhooks for alert delivery to external systems. See the Webhooks integration guide for configuration details.