# Alerts and reporting | Precursor Intelligence

**Hear about what affects you. Without having to look.**

> Alerts and reporting tell you when something new affects your business, and give you reports to share. We keep watching the software you use and your domains, and as soon as we spot something that affects you, we tell you by email, in the app or by webhook. It is for owners and IT teams who cannot watch a dashboard all day.

Canonical page: https://www.precursorintelligence.com/features/alerts-and-reporting
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Features](https://www.precursorintelligence.com/features) > Alerts and reporting
Start free: https://www.precursorintelligence.com/register · Book a demo: https://www.precursorintelligence.com/contact

We monitor continuously. You hear as soon as we know. Email, in the app or webhook.

Example data on this page uses the fictional company Acme (acme.co.uk, acme-payro11.com).

## Contents

1. [What can you be alerted about?](#what-can-you-be-alerted-about)
2. [How does the monitoring work?](#how-does-the-monitoring-work)
3. [Who hears about it?](#who-hears-about-it)
4. [Can alerts reach our own tools?](#can-alerts-reach-our-own-tools)
5. [What can I hand to someone else?](#what-can-i-hand-to-someone-else)
6. [Questions](#questions)
7. [Related features](#related-features)

## What can you be alerted about?

Alerts come from the things you have told us about: the software you run, your keyword rules, your saved dependency files and the domains you monitor.

1. **Newly published flaws.** A new known flaw in software you have told us you run.
2. **Flaws now being exploited.** A flaw in your software that has just been confirmed as used in real attacks.
3. **Rising exploit likelihood.** A flaw in your software that has become more likely to be used in an attack. See [how we rank risk](https://www.precursorintelligence.com/features/risk-based-prioritisation).
4. **Your keyword rules.** Rules such as a product AND a version, which catch flaws by text match.
5. **Hijacked packages.** A new supply-chain incident affecting a package in a dependency file you saved. See [dependency monitoring](https://www.precursorintelligence.com/features/dependency-monitoring).
6. **Lookalike domains.** New lookalikes of your domains, and changes to the ones we already know about. See [brand protection](https://www.precursorintelligence.com/features/brand-protection).
7. **Expiring certificates.** A warning before the SSL certificate on one of your domains runs out. See [certificate monitoring](https://www.precursorintelligence.com/features/ssl-certificate-monitoring).
8. **Nothing, when things are quiet.** If nothing new matches, no email is sent and nothing lands in your inbox.

## How does the monitoring work?

Alerts are not a stream of pings. We keep watching your software, your domains and your saved dependency files. When something new matches, we tell you, with every new vulnerability match gathered into one email, and nothing at all when things are quiet.

1. **Tell us what to watch (once).** The software you run, any keyword rules, your dependency files and your domains.
2. **Choose who hears (once).** Add your organisation's alert recipients, such as security@acme.co.uk, and any webhook endpoints for your own tools.
3. **We watch your domains (continuously).** New lookalikes, changes to known ones and certificates close to expiry show in the app, and brand alerts can go to a webhook.
4. **We watch your software (continuously).** New flaws, newly exploited flaws and rising exploit likelihood, matched against what you told us. Saved dependency files are re-checked too.
5. **One vulnerability email (as soon as we know).** One email per recipient with every new match, a notification in the app and a post to each webhook. A hijacked package in a saved dependency file gets its own email. Nothing new, nothing sent.

Example email (Acme): subject "Security Alert: 3 New Vulnerabilities Detected", sent to security@, it@ and sam@acme.co.uk. It lists the VPN gateway flaw CVE-2024-3400 (known exploited, risk score 89, emergency patch), the mapping library flaw CVE-2024-36404 (exploit code is public, 71, High) and the mail server flaw CVE-2023-42116 (56, Medium).

## Who hears about it?

**Email and in the app.** Alert emails go to one shared list of recipients for your organisation. Everyone who signs in also sees each alert in their notifications in the app.

- One vulnerability email, not a flood, with every new match for your organisation in it, sent to each recipient.
- Notifications in the app for vulnerabilities, lookalike domains and certificates, side by side.
- One shared recipient list, so the right people hear even when someone is on holiday.

Invite as many colleagues as you like. There is no limit on the number of people in an organisation.

## Can alerts reach our own tools?

**Webhooks.** Give us a web address and we post alerts to it. Choose what each endpoint receives, and for brand protection alerts, the format it arrives in.

- Your URL, with an optional secret header that we store encrypted. Send a test whenever you like.
- Pick categories and events: domain impersonation, vulnerabilities and supply chain, or just some of them.
- Slack, Microsoft Teams, Splunk or Microsoft Sentinel formats for brand protection alerts. Vulnerability and supply-chain alerts arrive as JSON.

There are no ticketing or paging connectors. To go further, use webhooks or our [REST API and other integrations](https://www.precursorintelligence.com/features/integrations).

Example (Acme): an endpoint at https://hooks.acme.co.uk/precursor with an `X-Acme-Token` secret header, receiving domain impersonation, vulnerability and supply-chain alerts. A `brand.lookalike_went_live` event for acme-payro11.com in Slack format:

```json
{
  "text": "[HIGH] Lookalike went live: acme-payro11.com",
  "blocks": [
    { "type": "header", "text": { "type": "plain_text", "text": "Lookalike went live (HIGH)" } },
    { "type": "section", "text": { "type": "mrkdwn", "text": "*acme-payro11.com*\nNow serves a page with a password form." } },
    { "type": "actions", "elements": [ { "type": "button", "text": { "type": "plain_text", "text": "Review finding" } } ] }
  ]
}
```

## What can I hand to someone else?

**Reports and exports.** Every report is made when you click export, from the data you have at that moment. The organisation report gives management your top ranked flaws, recent alerts and latest scan in a few pages.

| Group | Export | Format |
|---|---|---|
| Organisation | Organisation security report: top 10 ranked vulnerabilities, recent alerts, latest scan summary | PDF |
| Organisation | Ranked vulnerability register: your matched vulnerabilities, ranked | PDF |
| Organisation | Saved AI action plans | PDF |
| Brand protection | Monthly brand protection report, for one calendar month | PDF |
| Brand protection | Lookalikes spreadsheet | CSV |
| Brand protection | Threat feed and blocklists: STIX 2.1, DNS RPZ, Microsoft 365 Tenant Allow/Block List | STIX JSON, RPZ, CSV |
| Brand protection | Evidence pack for one lookalike | PDF |
| Attack surface | Scan results, and a comparison of two scans | PDF |
| Threat intelligence | Threat group dossier, single CVE report | PDF |
| Settings | Organisation audit log | CSV |

The organisation report is a current summary, not a history of a period, and it is not sent on a schedule. The one monthly report covers brand protection.

## Questions

### How quickly will I hear about a new flaw?

We monitor continuously and tell you as soon as we spot something that affects you. That covers newly published flaws, newly exploited flaws and flaws whose exploit likelihood is rising in the software you track.

### How many emails will I get?

Only as many as there is news. Every new match for your organisation goes into a single email to each recipient, and nothing is sent when there are no matches. If a package in a saved dependency file is hit by a new incident, that comes as its own email.

### Are lookalike domains and certificates watched too?

Yes, we keep watching them alongside your software. New lookalikes, changes to known ones and certificates close to expiry appear in your notifications in the app, and brand protection alerts can also be sent to a webhook.

### Can alerts go to Slack or Microsoft Teams?

Brand protection alerts can be sent by webhook formatted for Slack, Microsoft Teams, Splunk HEC or Microsoft Sentinel. Vulnerability and supply-chain alerts are sent by webhook as JSON, which your own tools can pass on.

### Is there a monthly report?

Not for your whole organisation. The organisation report is made on demand as a current summary. The monthly report that does exist covers brand protection.

### Is our webhook secret safe?

The optional secret header you give us is stored encrypted.

## Related features

- [Integrations](https://www.precursorintelligence.com/features/integrations): a REST API, webhooks, Tenable sync and scan-file upload to connect the tools you already use.
- [Risk-based prioritisation](https://www.precursorintelligence.com/features/risk-based-prioritisation): every known flaw scored from 0 to 100 and kept up to date, so you fix the riskiest first.
- [Brand protection](https://www.precursorintelligence.com/features/brand-protection): continuous monitoring for lookalike domains using your name, with takedown emails drafted for you to send.
- [SSL certificate monitoring](https://www.precursorintelligence.com/features/ssl-certificate-monitoring): get a warning before your own SSL certificates expire, with every domain's certificate in one place.
- [All features](https://www.precursorintelligence.com/features)

## Get started

Know when something affects you, without having to look. Tell us what you run and who should hear about it. We keep watching your software and your domains, tell you by email, in the app or by webhook as soon as we spot something, and give you reports to hand on.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact
- Nothing to install · Unlimited team members · Data stored in London · Two-factor sign-in for everyone