Overview
When an integration fails, a detection rule triggers a finding, or an ingestion source stops sending logs, Blumira can send your team notifications (Email, Voice, SMS text) so that your team can take action. You can also receive notifications when a responder is assigned to a finding or a new comment is added as a note on a finding. Notifications can be enabled or disabled according to priority and type.
Ensure that your organization's users can receive notifications from Blumira to respond to findings or integration health issues in an appropriate timeframe. You must also enable alerts for each device transmitting or receiving logs to be notified when a source stops sending logs.
Editing notification settings
Notification settings are managed at the user level and cannot be specified per organization. This means editing notification settings for a user impacts all of the Blumira accounts the user can access.
Users can view and edit their personal settings by clicking Notification Settings (the bell icon) at the top of the screen.
As an Administrator or Manager, you can also configure which notifications your Blumira users receive by editing their notification settings.
To edit a user's notification settings, do the following:
- Navigate to Settings > Users.
- Click Edit (pencil icon) in the row with the user's name.
- In the Edit user window, click Edit User Notifications.
- Verify that the correct information is provided for the user:
- Voice number (excludes extensions)
- Text number
- Email address
-
Select the relevant check boxes to turn on Voice, Text, or Email notifications per type.
Tip: Blumira sends voice and text alerts from (313) 349-2586. Save the number as a safe caller/sender in your device so that alerts are not marked as spam. - Select or deselect these options:
- Email me on every new finding comment.
- Email me when a responder takes initial ownership of a finding.
- Click Save.
System notifications related to log integrations
System notifications help you monitor the health of your log integrations so you can respond as soon as possible when errors or failures occur. Below, you can find which options are available and what problems each of the notifications can alert you to.
- Sensor status notifications
- Blumira Agent installation failure notifications
- Cloud Connector error notifications
- Monitored ingestion source notifications (i.e., individual agents, connectors, HTTP sources, or sensors)
Sensor status notifications
You can enable the following notifications if you want to receive an email when your Ubuntu sensor needs attention:
| Option | Details |
|---|---|
| Sensor goes online or offline | Sends when a sensor has gone offline, with a 4-hour threshold for inactivity. This setting also alerts you when it comes back online. |
| Sensor resources are low | Sends when the storage resources available to the sensor are too low for it to perform. |
| Sensor stopped sending logs | Sends when the sensor's overall log collection rate suddenly sharply decreases within a 2-hour timeframe. It does not indicate when a specific sensor module's installation or logging fails. |
Blumira Agent installation failure notifications
You can enable the "Maximum Deployable Agents exceeded" notification if you want to receive an email when the Blumira Agent fails to install on an endpoint. When enabled, you will receive an email for every endpoint that fails, and a repeat email every hour until the agent is able to check in.
Usually, the maximum agent limit needs to be increased by adding more users (agents) to the account's licensing, or an administrator needs to remove unused agent devices from the list of installed devices.
Cloud Connector error notifications
You can enable the following notifications if you want to receive an email when your Cloud Connector needs attention:
| Option Name | Related Scenarios |
|---|---|
| Cloud Connector errors and recoveries |
|
| Cloud Connector persistent errors | A connector that previously entered an error state remains in error for at least 24 hours. |
| Cloud Connector failure to complete initialization | A newly added connector is stuck initializing for at least 24 hours and cannot establish a connection. |
Monitored ingestion source notifications
You can enable the "Monitored ingestion sources stopped sending logs" notification if you want to receive an alert when an ingestion source stops sending logs for more than four hours. To receive this notification, you must also enable monitoring for the device receiving or transmitting logs, such as for your connectors in the Edit Cloud Connector window and agent devices in the Device details window.
About Blumira finding emails
The emails Blumira sends for each finding contain the following content:
- A parsable subject line formatted according to this convention: Finding_Type | Finding_Priority | Finding_Name @ Company_Name.
Example: Suspect | P2 | Indicator: Microsoft 365 - Creation of forwarding/redirect rule @ Acme Security - The body of the email includes the timestamp of when the finding was created, along with the analysis for the finding, and a Learn More button that links directly to the finding's detail page (requires login).