Alerts and digests
When immediate alerts, daily and weekly digests, and scheduled reports are sent, and what they contain.
Every message — email, Slack, or Teams — carries a short summary, the names of the Detections involved, and a link into Tracemill Cloud. Event payloads and rule searches are never included; the detail stays behind sign-in.
Immediate alerts
Classes set to Immediate (Regression, Staleness, Recovery) are sent as alerts.
- Batched per target. Tracemill waits about five minutes after the first change on a target, then sends one alert per recipient covering every change recorded on that target in the meantime, grouped by class.
- Flaps cancel out. Each Detection is compared before and after the batch. A Detection that regressed and recovered within those minutes is not alerted. A Detection that failed for the first time is alerted unless it is passing again by the time the alert is built. A Detection that regressed and then went stale is reported only as stale.
- Contents. The title names the count and the target — for example 3 Detections failing on Production Splunk — or Detection posture changed on … when several classes are involved. The message lists Detection names under Failing, Went stale, and Recovered (up to ten names each, then and N more), and Review in Tracemill Cloud opens the target's Activity.
Daily and weekly digests
Classes set to Daily or Weekly are collected into a digest.
Schedule
Each recipient has one Daily digest and one Weekly digest under Digest schedules, each with a Time, a Timezone, and for the weekly digest a Day. A card shows In use when at least one class is set to its cadence. Both default to 09:00, and the weekly digest to Monday.
A digest follows your timezone until you change its time, day, or timezone; from then on it keeps the values you set, even when you change your timezone.
What a digest contains
One digest covers every target and every class routed to it, in a single message:
- The title — Daily digest: posture changed on 4 targets — and a summary of what was recorded since the previous digest: failing, went stale, recovered, coverage changes.
- One line per changed target (the first ten targets) with up to three Detection names per class and the state each ended in, followed by the target's current state: how many Detections are failing and stale, and its coverage.
Changes are compared again when the digest is built, so a regression that has since recovered is not listed as failing.
When a digest is sent
- Empty digests are not sent. If nothing changed since the previous digest, no message goes out, and the schedule moves on to its next slot.
- Recent changes are included. If changes are still being routed when a digest falls due, it waits a few minutes past its scheduled time for them.
- Nothing is lost. A change recorded after a digest is built goes into the next one.
- No bursts after downtime. If digests could not be sent for a while, only the most recent missed digest is sent, and it includes everything collected until then.
Scheduled reports
A scheduled report is a full posture report generated for a whole past period and sent on a schedule. Add one under Scheduled reports with Add report:
| Cadence | Sent | Covers |
|---|---|---|
| Weekly | Every Monday | The previous week, Monday to Sunday |
| Monthly | On the 1st of every month | The previous calendar month |
You choose the time (default 09:00) and timezone; the period is made of whole days in that timezone. Each target and cadence can be scheduled once.
- A report is never generated before its period has ended: it waits at least 15 minutes past the end of the period, so that changes from the period's final minutes are recorded. A report scheduled for 00:00 arrives at about 00:15.
- All targets sends one report per target, each in its own message.
- Reports are sent even for a quiet period: a week with no changes is still evidence.
- The message shows the target's coverage, health, failing, stale, and uncovered counts, and Open the report in Tracemill Cloud opens the stored report. The report is kept in the workspace Reports list.
- Edit changes a report's time and timezone; the next report is scheduled from the new time. Its cadence and target cannot be changed: delete the report and add a new one instead.
- Pause stops a scheduled report without deleting it. A paused report does not catch up on the periods it missed; Resume schedules the next one from now.
- As with digests, after downtime only the latest period is sent.
When nothing is sent
Alerts and digest entries pause for a target that is snoozed or archived; scheduled reports for a snoozed target are still sent. Digests and scheduled reports stop while the workspace's subscription is inactive and resume when it is active again. Each workspace also has a daily send limit per channel. See Delivery history for the reasons a queued message was not sent.