| Kind | Raised when | For | Default |
|---|---|---|---|
| Alert assigned to me | Someone assigns you an alert. | You | Inbox |
| Case assigned to me | You are made lead on a case. | You | Inbox |
| Mentioned by name | Someone @-mentions you in a war room or on a board. | You | Inbox |
| Action waiting for approval | A playbook staged an action that an organization's guardrails hold for an analyst. | Organization leads | Inbox, email |
| Playbook run failed | A playbook you own stopped on an error. | You | Inbox |
| Agent went silent | An always-on host stopped reporting for longer than its grace window, or a host went quiet right after reporting tampering. | Team | Inbox |
| SLA approaching | An alert reaches the warning point of its target (80 percent by default, set per organization). | Team | Inbox, email |
| SLA breached | An alert misses its target. | Team | Inbox, email |
| New customer ticket | A customer opens a ticket in the portal. | Team | Inbox, email |
| Customer replied | A customer replies on a ticket. | You | Inbox, email |
| Report published | A report is published to a customer's portal. | Team | Inbox, email |
| Shift handover digest | Every eight hours, a brief for the incoming shift. | Team | Inbox, email |
Each analyst can change the defaults under Settings › Notifications. An organization can mute any kind under Settings › Organizations, and a mute wins over personal choices.