Reports & Alerts

Critical, high, medium, low and informational categories organize supported review signals. The review index describes triage workload; it is not a probability that the site has been compromised.

Shown, retained and total counts keep collection/display limits visible. Completed baseline context gives file findings a reference point.

Recorded policy actions, review holds and observe-only matches remain different outcomes. A report should preserve those distinctions instead of presenting every signal as a blocked attack.

Configure periodic reports with the intended recipients and operational scheduling path. The digest uses the completed inspection context rather than implying a continuous live report.

The daily full scan and email report is a separate setting from the scheduled file inspection and stays off until it is enabled. The chosen hour, in the site timezone, starts the scan, and the email follows its completion. The scheduled file inspection itself runs daily by default without email.

Review an actual delivered message and the underlying stored snapshot when establishing the schedule.

Mail transport setup belongs to Forms & Email; the schedule and report content belong here.

Review report-send state, failures and accepted transport outcomes, with documented bounded retries. Confirm actual recipient receipt separately from a service accepting the send.

Set supported retention periods according to operational needs. Removing older records also changes what later history and reports can inspect.

Preserve evidence needed for an active investigation before changing retention.