Configure alert emails

Brand Monitor emails you when a hit scores at or above its watcher's minimum notification score. Everything about alerting is configured per watcher.

Set the recipient

Open the watcher (Brand Monitor → Watchers → click it) → Edit → Notification email. Changes apply to future hits; leaving the field empty disables emails for that watcher while hits keep recording.

Most teams point alerts at a shared destination rather than a personal inbox:

• [email protected],
• a Slack channel's email address (Email app integration),
• a ticketing system's intake address.

What an alert contains

Alerts come from Norcube DomainRadar ([email protected]) and carry the whole picture, so triage usually doesn't require opening the dashboard:

• the matched domain, highlighted with a colour-coded risk badge,
• the keyword and match reason,
• the AI analysis, if the watcher has it enabled — risk level, an Impersonation badge when confirmed, the indicators, and the reasoning,
• certificate details — issuer, CT log, and the other domains on the certificate,
• a "Review & take action" button linking to the hit's detail page.

Getting the volume right

Four levers, in the order to try them:

1. Raise the minimum notification score. Below-threshold hits still appear in Detections — you're trading interruptions for a periodic review habit, not losing data.
2. Grow the allowlist. Every recurring benign match (partners, resellers, your own infrastructure) belongs there — allowlisted domains stop producing hits entirely.
3. Enable AI content check. Real impersonations get pushed well above the threshold by the AI verdict; parked domains and coincidences don't. This is the strongest noise filter for common-word keywords.
4. Narrow the keyword — or split into multiple watchers (norcube-, norcube.) with different thresholds.

Delivery notes

• First alert landing in spam is common for a new recipient — add [email protected] to safe senders, especially behind corporate mail filtering.
• Hits without emails mean the score was below threshold or the watcher has no email set — check Detections and the watcher config before suspecting delivery.
• One email per hit. The 24-hour duplicate suppression on hits means a burst of certificates for the same domain doesn't burst your inbox; a re-detection after the window (e.g. a cert renewal) alerts again if it clears the threshold.
• AI-checked hits may email with a delay — if the page wasn't live at detection time, the AI check retries hourly (up to 48 hours), and the score that decides notification includes its verdict.

Related

• Set up Brand Monitor — threshold tuning strategy.
• Watchers and hits — triaging in the dashboard.