Skip to main content
Flarehawk sends alert emails from Flarehawk <[email protected]>, so you can identify and allowlist the sender in your mail client. When a qualifying incident opens or escalates, Flarehawk waits for up to three minutes for the investigation summary. If it is ready sooner, the email is sent immediately; otherwise the email uses a deterministic incident description so essential context is never replaced by an unavailable-investigation placeholder.

​
What an alert email contains

Each alert email provides a compact, inbox-friendly incident snapshot:
  • Incident title and description — the investigation summary when ready, with a deterministic incident description as the fallback
  • Severity — a labelled badge showing low, medium, high, or critical
  • Domain — the monitored domain where the alert was detected
  • Incident snapshot — up to four relevant metrics such as alert count, peak request rate, unique IPs, duration, or top source IP
  • Recommended next step — one concise investigation action when available
  • Review actions — authenticated links to open the incident, review acknowledgement, or inspect mitigation options
The email footer includes a link to manage your notification preferences at Settings → Notifications.
Review links never change incident state just by being opened. Acknowledgement requires explicit confirmation, while mitigation opens the incident workspace for review.

​
Configuring email recipients

1

Open notification settings

In the Flarehawk dashboard, navigate to Settings and click the Notifications tab.
2

Enable the email channel

Toggle the email channel on if it is not already active.
3

Add recipients

Enter one or more email addresses in the recipients field. You can add multiple addresses separated by commas. All recipients receive the same alert emails.
4

Save your settings

Click Save. Changes take effect immediately for new alerts.
You must be an organization admin to modify notification settings. Members can view the configuration but cannot make changes.

​
Controlling which severities trigger email

You can set a per-channel minimum severity for email so that only alerts at or above a chosen level generate an email. For example, setting the email minimum severity to high means low and medium alerts are silently logged but do not produce emails. To change the threshold:
  1. Go to Settings → Notifications.
  2. Under the email channel, find the Minimum severity selector.
  3. Choose low, medium, high, or critical.
  4. Save your settings.
The global minimum severity applies to all channels unless you override it per channel.

​
Pausing and resuming email notifications

You can pause email notifications without removing your recipients or changing your configuration. Toggle the email channel off in Settings → Notifications to stop delivery. Toggle it back on to resume. Your recipient list and severity settings are preserved while the channel is paused.
Use quiet hours if you want to pause emails only during off-hours rather than disabling the channel entirely. See Notifications Overview for details.

​
Troubleshooting

Check your spam or junk folder for messages from [email protected]. Add this address to your contacts or allowlist to ensure future messages are delivered to your inbox. If you use a corporate email gateway, ask your IT team to allowlist the sender domain flarehawk.com.
Verify the following:
  • The email channel is enabled in Settings → Notifications (the toggle should be on).
  • Your email address is listed in the recipients field with no typos.
  • Your minimum severity setting is not filtering out alerts you expect to receive. Try lowering it to low temporarily to test.
  • Send a test notification from Settings → Notifications to confirm basic delivery is working.
Email recipients are configured at the organization level. Check that each person’s address is included in the recipients list. Confirm that their mail client or spam filter is not blocking messages from [email protected].
Real alert emails are only sent when a detection rule fires an alert that meets your severity threshold. If you recently lowered your threshold or an attack hasn’t occurred, no real emails will be sent. You can review recent alerts in the dashboard under Alerts to confirm rules are firing.
Go to Settings → Notifications and remove the specific email address from the recipients list. Other addresses in the list continue to receive alerts.