---
id: KB-AD-019
url: https://app.codecontract.io/help/administration/which-security-alerts-are-worth-switching-on
idioma: en
categoria: administracion
audiencia: usuario
nivel: intermedio
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-AD-004, KB-AD-007, KB-AD-013]
citadoPor: [KB-AD-016]
---

# Which security alerts are worth switching on

_An alert that reaches everyone reaches nobody. Which ones matter and who they must reach._

**Responde a:** account security alerts · new device login notifications · who should receive the alerts · too many security notifications

Many things can be alerted on, and that is the problem. When everything alerts, the team learns to ignore it within two weeks, and the alert that mattered arrives on the same day as thirty others. The question is not what can be alerted: it is what deserves to interrupt someone.

## The ones worth an alert

| Event | Why it matters | Who it must reach |
| --- | --- | --- |
| Someone signs in from a new device or place | First sign of a compromised account | That person, always |
| A password or second factor changes | If it was not you, it is urgent | That person, immediately |
| Someone gains administrator rights | It changes what that account can do to everything | The administrators |
| An integration key is created or withdrawn | It opens or closes a door that is not a person | The administrators |
| Many failed attempts in a row | Someone is trying | The administrators |

> [!IMPORTANT]
> And the criterion that decides whether this works is not on the list, it is the recipient: **a security alert cannot go only to a shared mailbox everyone can read**. If the compromised account is one of those reading that mailbox, whoever got in sees the alert before you do and can delete it. A person's alerts go to that person; the organisation's go to two named administrators, not to `info@`.

## What is better left unalerted

**En corto**

- Every normal sign-in: it is noise, and it buries everything else.
- Every document someone opens: that is what the log is for, consulted when needed.
- And anything nobody will look at twice in a row.

> [!WARNING]
> There is a consequence of this that surprises people: **the best alert is the one that almost never arrives**. If your team gets a security alert every couple of weeks, the day a real one lands they will read it carefully. If they get five a week, that day they will file it with the rest. Tuning what alerts is not about comfort: it decides whether the alert works when it counts.

## How to set it up in ten minutes

1. **Switch on the five in the table and nothing else at first** — Widen it later if something is missed.
2. **Name the people who receive the organisation ones** — Two people, not a mailbox; and both should know they get them.
3. **Check they actually arrive, once** — Sign in from another device and see whether it warns you.
4. **And decide what happens on receiving each one** — An alert with no action attached ends up ignored.

> [!NOTE]
> If an alert nobody recognises ever arrives, the order matters: close sessions and change that account's password first, investigate afterwards. It is set out step by step in the article on suspected access.

**What if the team travels a lot?**

The new-device alert will keep firing: that is correct, and it is dismissed in a second.

**Do alerts replace reviewing the log?**

No: they flag the urgent. The monthly review catches what does not fire.

**Should management be alerted?**

Only about what they will decide. Otherwise it is noise with more seniority.

## Ejemplos

**A company sends every security alert to the general admin mailbox.**

- Routes personal alerts to each person and organisation ones to two named administrators

→ The alert reaches someone who can act, not a mailbox anyone can clear.

**No security notices are switched on.**

- Turns on those warning about access and changes

→ The odd thing shows in the moment.

**Notices go to a single person.**

- Addresses them to more than one

→ The notice reaches somebody who can act.

**There are so many notices nobody reads them.**

- Leaves on the ones that genuinely matter

→ The notice works again.

**A notice fires and nobody knows what to do.**

- Writes down what to do with each

→ The response is not improvised.

**Notices go to a mailbox nobody watches.**

- Directs them to a monitored address

→ The notice gets read.