Notifications overview
Choose which Detection posture changes reach you, how fast, and where.
Tracemill Cloud tells you when the posture of your Detections changes — a Detection starts failing, its Tests stop running on schedule, it recovers, or it gains or loses coverage. You choose, per class of change, whether to hear about it right away, in a daily or weekly digest, or not at all.
Notifications go to two kinds of recipient:
- You, by email. Every member manages their own settings under Workspace → Notifications.
- A Slack or Microsoft Teams channel, through a workspace destination. Owners and admins manage these under Workspace → Destinations.
Notification settings are per workspace: a member of several workspaces sets each one separately.
What you can receive
| Delivery | What it is | Where it is configured |
|---|---|---|
| Immediate alert | One message per target a few minutes after a change is recorded | The Alerts matrix, delivery Immediate |
| Daily or weekly digest | One message summarising every change across all targets since the previous digest | The Alerts matrix, delivery Daily or Weekly, plus Digest schedules |
| Scheduled report | A weekly or monthly posture report per target | Scheduled reports |
See Alerts and digests for when each is sent and what it contains.
Notification classes
Every posture change belongs to one class:
| Class | Sent when | Can be immediate |
|---|---|---|
| Regression | A run shows a Detection regressed, or failed for the first time | Yes |
| Staleness | A Detection's Tests stopped running on schedule, so its result went stale | Yes |
| Recovery | A failing or stale Detection is passing again | Yes |
| Coverage change | A Detection gained or lost coverage, or was turned off, turned back on, removed, or restored in your SIEM | No — digest only |
Coverage changes are usually deliberate — someone disabled a rule or removed a schedule — so they are never sent as immediate alerts. They appear in digests and reports.
The class × delivery matrix
The Alerts section of Workspace → Notifications is a matrix: one row per class, and for each class a delivery of Immediate, Daily, Weekly, or Off. Immediate is unavailable for Coverage change.
The All targets rows apply to every target in the workspace, including targets created later.
Per-target overrides
Under Per-target overrides, choose Add an override and pick a target to give it its own delivery. On an override, each class is either set explicitly or left on Inherit, which follows All targets.
An explicit setting on an override always wins, including Off — set a class to Off on a target to mute that class there while every other target keeps the All targets delivery. Choose Remove to drop the override.
When a target is archived, its overrides are removed with it. An override for a target that no longer exists shows Target unavailable; remove it before saving.
Saving
Changes to Alerts and Digest schedules take effect when you choose Save in the You have unsaved changes. bar. Your timezone has its own Save timezone button. Scheduled reports and snoozes are saved as soon as you make them.
Defaults
Every workspace member starts with all four classes set to Weekly for All targets, and a weekly digest on Monday at 09:00 in their timezone. Nothing is immediate by default. A member whose access is removed and later restored gets the defaults again.
Tracemill takes your timezone from your browser the first time you sign in to Tracemill Cloud (UTC until then), and never changes it on its own after that. See Your timezone to change it.
Destinations start with no subscriptions; nothing is posted to a channel until an owner or admin chooses what it receives.
Your timezone
Your timezone is the default for your digest schedules, for new scheduled reports, and for the period of a live report. It is yours, not the workspace's: it applies in every workspace you belong to.
To change it, open Workspace → Notifications, pick a zone under Timezone, and choose Save timezone. Use browser timezone fills in the zone your browser reports. Changing it:
- Moves every digest that still follows your timezone, in every workspace.
- Leaves alone a digest whose time, day, or timezone you set yourself; it keeps its own.
- Leaves existing scheduled reports on their own timezone; use Edit on a report to change it.
When your browser's timezone keeps a different clock from the one Tracemill has, a banner offers to switch to the browser's zone or keep the current one. Zones that keep the same clock, such as Europe/Paris and Europe/Berlin, do not raise it. Keeping it hides the banner in that browser until the browser reports yet another zone. Tracemill never switches without your choice.
Who can do what
| Action | Who |
|---|---|
| Manage your own alerts, digest schedules, scheduled reports, and timezone | Every member, any role |
| View destinations, their notification settings, and their delivery history | Every member |
| Add, edit, test, turn off, or delete destinations and their notification settings | Owners and admins |
| Snooze a target | Owners and admins |
Notification settings belong to members: API tokens cannot change them. In a workspace without an active subscription, notification settings cannot be changed and digests and scheduled reports are not sent.
In this section
- Alerts and digests — when immediate alerts, digests, and scheduled reports are sent
- Slack and Teams — post notifications to a channel
- Email — verified addresses, unsubscribing, bounces, and allowlisting
- Snooze a target — silence a target during maintenance
- Delivery history — what was sent, what was not, and why