What raises a notification
- New findings at or above your threshold. The default threshold is high. You can change it with
REEF_NOTIFY_MIN_SEVERITY(info,low,medium,high, orcritical). - Known exploited vulnerabilities. Any finding on the CISA KEV list raises a notification, whatever its severity.
- Failed scans. A scan that fails raises a warning with the reason.
- Offline agents. An agent that stops checking in raises a notification once, so you know that host is no longer being monitored.
Each finding raises a notification only the first time it is detected. Repeat sightings on later scans do not alert you again.
Where notifications appear
- The bell icon in the dashboard header shows your unread count.
- The Notifications page (
/notifications/) shows the full history, and you can filter it to unread only. - Email. Reef creates an email copy of every notification. Currently, these copies are written to the
webcontainer log rather than sent.
A noisy scan can’t flood you
If a single scan produces more than 25 notification-worthy findings, Reef combines them into one summary alert instead of sending one per finding. For example, the first vulnerability scan of an out-of-date host produces one alert with a severity breakdown and a link to the findings, not dozens of separate alerts.
Clearing notifications
Mark notifications read one at a time or all at once. Resolving or suppressing a finding also marks its notification read automatically, so the bell count reflects what still needs attention. Each user’s read status is tracked separately.
Current limitation
Notification rules are fixed for now, apart from the severity threshold. User-configurable rules are on the Roadmap.