Security Center:Notification settings

Step 1: Manage notification recipients

Before configuring alert rules, confirm that the right person receives them. By default, Security Center sends alerts to the Account Contact from account registration — often not the security team.

1. Go to the Message Center. On the Security message tab, find Security Notice and click Modify in the Actions column. The Modify Message Receiving Configurations page opens.

2. On the Contact tab, manage the recipient list:

   • Select an existing contact: In the dialog box, select the checkbox next to each contact.

   • Add a new contact: Click Manage Contacts, then click Add Receiver in the upper-right corner. Enter a name and email address, then click OK. > Important: A newly added email address must be verified before it can receive alerts. Check your inbox for a verification email and follow the instructions. For more information, see Manage basic message notifications.

   • Modify a contact: Click Manage Contacts. On the Manage Contacts page, click Modify in the Actions column. Edit the name or email address, then click OK.On the Manage Message Recipients page, click Edit in the Actions column of the target contact.On the Manage Message Recipients page, click Add Receiver in the upper-right corner.

3. Click OK. The changes take effect immediately.

Step 2: Configure notification rules

1. Log on to the Security Center consoleSecurity Center console.Log on to the Security Center console.

2. In the left-side navigation pane, choose System Settings > Notification Settings. In the upper-left corner, select the region where your assets are located: China or Outside China.

3. On the Email/Internal Message tab, find the notification item to configure. Set the following fields: Notification Time — When alerts are sent: Concerned Level — Select the severity levels to receive alerts for, such as Critical or High Risk. Notification Method — Choose Email, Internal Message, or both.

   Important

   Alerts triggered outside the 08:00–20:00 window may be delayed. The sending frequency is fixed and cannot be adjusted. See Quotas and limits for details.

   Not all alert types support all notification methods. Only supported options appear in the console. If you select multiple methods, the same alert is sent to all selected channels simultaneously.

   Option	Behavior	Use when
   24 hours	Immediate alerts, around the clock	Critical or emergency events
   08:00–20:00	Alerts only during this window	Non-urgent events

Prerequisites

Before you begin, make sure you have:

• A Security Center Enterprise or Ultimate edition subscription. Upgrade if needed.

• At least one pay-as-you-go feature enabled.

Step 1: Get the webhook URL from DingTalk

If you haven't created a chatbot yet:

1. In the DingTalk client, select the target group chat and click Group Settings in the upper-right corner.

2. In the Group Management section, click Bot. On the robot management page, click Add Robot and select Custom.

3. In the Security Settings area, set Custom Keywords to Security Center or Security based on the notification language you plan to use.

4. Select the I Acknowledge and Accept *DingTalk Custom Robot Service Terms of Service* checkbox.

5. Click Finished. Copy the webhook URL displayed on the page.

If you already have a chatbot:

1. In the DingTalk client, select the target group chat and click Group Settings in the upper-right corner.

2. In the Group Management section, click Bot. Click the target robot to view its webhook URL on the details page.

Step 2: Add the chatbot in Security Center

1. Log on to the Security Center consoleSecurity Center console.Log on to the Security Center console.

2. In the left-side navigation pane, choose System Settings > Notification Settings. Select the region where your assets are located: China or Outside China.

3. On the DingTalk Chatbot tab, click Add Chatbot. In the Add DingTalk Chatbot panel, configure the following parameters and click Add.

   A newly created DingTalk Chatbot is Enabled by default.

   Parameter	Description
   Webhook URL	Paste the webhook URL from Step 1. Keep it confidential — exposing it on public websites creates security risks.
   Asset Groups	Select asset groups from the Assets page. Alerts are sent only for assets in the selected groups. See Manage server groups.
   Notify On	Select alert types and risk levels. A notification is sent if any selected condition is met (OR logic). For example, selecting both "Security alert" type and "Suspicious" level means either condition independently triggers a notification. To avoid unexpected alerts, review both type and level selections together.
   Notification Interval	How often the chatbot sends batched notifications: 1 minute, 5 minutes, 10 minutes, 30 minutes, or No Limit. Each webhook URL can receive up to 20 notifications per minute. See DingTalk Chatbot rate limits.
   Language	The language of notifications: Chinese or English.

Step 3: Test the connection

In the DingTalk Chatbot list, find the newly created chatbot and click Test in the Actions column. A test message is sent to the DingTalk group to verify the connection.

Editing or deleting a chatbot configuration only affects DingTalk notifications and does not change your email or internal message settings.

Disable email and internal message notifications

1. Log on to the Security Center consoleSecurity Center console.

2. In the left-side navigation pane, choose System Settings > Notification Settings. Select the region where your assets are located: China or Outside China.

3. On the Email/Internal Message tab, find the target notification item and deselect the channels in the Notification Method column.Email/Internal Message

Disable or adjust a DingTalk Chatbot

1. Log on to the Security Center consoleSecurity Center console.

2. In the left-side navigation pane, choose System Settings > Notification Settings. Select the region where your assets are located: China or Outside China.

3. On the DingTalk Chatbot tab, find the target chatbot and take one of the following actions:

   Goal	How	Notes
   Temporarily disable	Turn off the switch in the Enabling Status column.	The configuration is saved and can be re-enabled at any time.
   Permanently delete	Click Delete in the Actions column.	This action is irreversible. Reconfigure the chatbot to use it again.
   Filter notifications	Click Edit in the Actions column, then update the Notify On section.	Remove alert types or levels you no longer want to receive.

Email and internal message limits

Defense alerts

Detection alerts

Container security alerts

Agentless detection alerts

Periodic and threshold-triggered notifications

DingTalk Chatbot rate limits

• Notification Interval options: 1 minute, 5 minutes, 10 minutes, 30 minutes, or No Limit.

• Rate limit for "No Limit": A single webhook URL can receive up to 20 notifications per minute.

Contact and recipient management

How do I update the email address or phone number that receives alerts?

Update it in the Alibaba Cloud Message Center. Follow the steps in Step 1: Manage notification recipients.Alibaba Cloud Message Center

I updated a contact, but alerts are still going to the old address. What's wrong?

Check two things. First, confirm the new contact completed email verification — unverified addresses don't receive alerts. Second, check whether other cloud products (such as CloudMonitor) have separate alert rules that still reference the old contact.

Can I assign different alert recipients by role, such as O&M or developers?

Batch assignment by role isn't supported. As a workaround, add a position tag when creating or editing contacts to identify them by role.

Troubleshooting alert delivery

I configured notifications but I'm not receiving any alerts. What should I check?

Work through these checks in order:

1. Verify the recipient: Confirm the email address or phone number is added and verified in Step 1.

2. Check notification settings: Make sure the notification item is enabled, the Concerned Level matches the actual alert severity, and Notification Time is set to 24 hours if you need around-the-clock coverage.

3. Check spam: Look in your email spam or junk folder.

4. Check rate limits: See Quotas and limits to confirm you haven't reached the daily sending limit.

5. Check the region: The region you selected in Notification Settings (China or Outside China) must match the region where the alerting asset is located.

My DingTalk Chatbot received an "Unusual Logon" alert even though I disabled that alert type. Why?

The Notify On field uses OR logic — a notification is sent if the alert matches either the selected type or the selected level. If you set the level to Suspicious, any alert at that severity level triggers a notification regardless of type. To stop receiving this alert, go to Notification Settings and deselect Suspicious from the level settings for Security alert.