Notifications
Choose which events notify you in the app and by email, and who receives critical alerts.
Updated
Revo notifies people in the app (the bell in the top bar) and by email. Everything is off until you turn it on, per event and separately for the app and email, with one exception: critical alerts go to the workspace's alert recipients.
Open Settings → Notifications, or Settings in the bell menu.
Events
| Group | Event | Sent when |
|---|---|---|
| Security | Security events | Threats and suspicious activity from Defender, ThreatLocker, Microsoft 365 and the agents. One notification per customer per run, for new high and critical events |
| Actively exploited vulnerability found | A threat watch matched software on a customer's systems | |
| New vulnerabilities | New known-exploited or critical vulnerabilities on customer devices, code and dependencies | |
| Assessments | Assessment completed | An assessment finished, with its score and issue count |
| Assessment or scheduled scan failed | An assessment, scheduled scan or exposure check couldn't finish | |
| Report ready | A report you or a schedule asked for was generated | |
| Domain verified | A customer domain's ownership was verified | |
| Domains added from Microsoft 365 | A connected tenant has new verified domains, added to the scanning scope | |
| Domain no longer verified | A domain verified through Microsoft 365 left the tenant, or the connection ended | |
| Devices | Device stopped checking in | A device's agent hasn't checked in for more than 10 minutes |
| Agent stopped after an update | A device went quiet right after it was offered an agent update | |
| Device back online | A device that stopped checking in is reporting again | |
| Device enrolled | A new device installed the agent and joined a customer | |
| Patching | Patch deployment had failures | Updates failed on one or more devices in a deployment |
| Patch deployment completed | A deployment finished on every device | |
| Windows upgrade failed | A device couldn't move to its approved Windows version, with the reason | |
| Workspace | Prospect became a customer | A prospect was converted to a managed customer |
| Customer disabled or deleted in your PSA | A customer linked to Syncro (or another PSA) was disabled or deleted there | |
| AI analyst asks for approval | The AI analyst filed an approval request |
Alert recipients
Some events are alerts: critical or high-severity security events, actively exploited vulnerabilities found on customer systems, and an agent that stopped after an update. Alerts are on, in the app and by email, for the workspace's alert recipients, so they always reach someone.
- Owners and admins choose the alert recipients (at least one active team member) under Alert recipients on the same page.
- Until someone does, the recipient is the workspace's first owner, normally whoever set it up.
- If every chosen recipient is deactivated or leaves, alerts fall back to the first owner.
- Recipients can turn alerts off for themselves; anyone else can turn them on.
Who gets notifications
Owners, admins, technicians and analysts. Customer-portal users never get notifications. If an email isn't arriving, check that the event's email switch is on for you, then your spam filter.
Notifications and webhooks
Webhooks are separate: an endpoint gets the events it subscribes to, whatever anyone's notification settings are. Use webhooks to send events into chat or your own tools.