Configure alert emails

Brand Monitor sends alert emails when a hit scores at or above its watcher's minimum notification score.

Set the recipient

The notification email is set per watcher.

1. Open the watcher in Brand Monitor → Watchers.
2. Update the Notification email field.
3. Save.

Updates take effect immediately. Future hits email the new address; past hits stay where they are.

Use a shared inbox or alias

Most teams point alerts at a shared inbox or a Slack-to-email integration:

• [email protected]
• [email protected]
• A unique Slack channel address from your workspace's Email apps.

This keeps the email volume out of one engineer's personal inbox.

What each alert contains

• The matched domain and the watcher that matched it.
• The match reason (substring, homoglyph, typosquat, …) and the score.
• The issuing CA and the cert SANs (other domains on the same cert).
• An optional AI verdict if the watcher has AI content check on: whether the page appears to impersonate your brand, with reasoning.
• A direct link to the hit detail page in the dashboard.

Reduce noise

If you're getting too many alerts:

• Raise the minimum notification score. Hits below the threshold still appear in Detections in the UI; they just don't email.
• Add to the allowlist. Each new false positive that's actually a legitimate partner / employer / known impersonator gets added to the watcher's allowlist.
• Enable AI content check. Doubles down on quality – Brand Monitor visits the domain and confirms impersonation before alerting.
• Split into multiple watchers with narrower keywords. A watcher for norcube- (with trailing hyphen) catches norcube-login.com and ignores norcube.com itself.

Delivery

Alerts are sent as transactional email from [email protected]. If you don't see them:

• Check spam. Especially on first delivery. Add [email protected] to your safe senders.
• Check your CT log activity is real. Detections without notifications are below threshold or for disabled watchers.
• Check transactional email isn't blocked by your corporate domain filter.

Behaviour and edge cases

• Email delivery is fire-and-forget. There's no retry on bounce today; transient mail-server outages can drop a single notification. The hit is still recorded in the dashboard.
• One email per hit, not per cert. Cert renewals don't re-email.
• Disabling a watcher stops new emails immediately, including for hits that arrived but haven't been emailed yet.