Contents

Alert channels

About 5 minApplies to v2.3.1Updated 2026-11-02

Besides in-panel alerts, email and SMS, administrators can push attack and operations alerts to the chat tools their team already uses. Open Security Center › Protection settings › Alert.

Supported channels

DingTalk, Feishu, WeCom, Telegram and Generic JSON (webhook). You can configure several at once and enable or disable each one.

FieldNotes
Type, NamePick the channel type and a recognizable name
Address / tokenThe bot address or token; after saving only the last 4 characters are shown
Signing secretFill in when the bot has signing enabled
TelegramNeeds a Bot Token and a Chat ID

After configuring, click "Send test message" and confirm it arrives before enabling.

Caution Channel addresses cannot point to internal addresses; requests to internal addresses are rejected.

Trigger conditions

The same type of alert for the same site is sent at most once every 30 minutes, to avoid flooding. The list on the tab shows the fixed trigger conditions and recipients:

AlertTriggerSent to
WAF block spikeA single site blocks more than 500 requests in 5 minutes, at least 5 times its usual levelAdministrators + the site's tenant
Website checkupA checkup finds a critical issueAdministrators + the site's tenant
Upload scan hitAn upload with a dangerous file, trojan signature or antivirus hit is blockedAdministrators + the site's tenant
Library update failedPulling or verifying the rule, antivirus or IP geolocation library from the platform failsAdministrators
License expiringDaily from 7 days before the license, WAF enhanced, WAF rule updates or IP geolocation expiresAdministrators

With WAF enhanced and rule updates licensed, the tab also lists "URL protection triggered", "Tamper / leak protection hit" and "New rule library version".

Email and SMS follow the method and time window set in System Admin › System Settings › Notification Settings; webhooks are not subject to the time window, and every enabled channel receives the alert. For which messages an individual receives, see Alerts and notifications.

Tip Set up a channel for a test group first, watch the alert volume for a few days, and only then connect the on-call group.