# Notifications

> Reference for Settings > Notifications: every rule and when it fires, the defaults per use case, destinations and plan limits, and your own email preferences.

Source: https://docs.scriptmonitoring.com/notifications/ · Plan: All plans · Updated 2026-10-13

**Settings > Notifications** decides which Script Monitoring events reach your team and where. There is one team rule per trigger, and each rule sends to email, a webhook or an S3 bucket. Rules run on the notifications engine, so they fire whether or not anyone is signed in. To set up a rule and test it, [follow the guide →](https://docs.scriptmonitoring.com/guides/notifications/).

<Screenshot id="notifications" alt="Settings > Notifications with Your delivery, the Team rules table and Delivery destinations" eager />

## Which events can notify me?

The **Team rules** card lists every trigger, with its status (**Active**, **Paused**, **Locked**, **Not set up** or **Removed integration**) and last delivery.

| Rule | When it fires | Cadence |
| --- | --- | --- |
| Malicious script detected | The rules engine flags a malicious or suspicious script. | Immediately |
| High-risk vulnerability found | Malware, or a high or critical severity vulnerability, in a script. | Immediately |
| Vulnerable library found | A library with a known, lower-severity vulnerability. | Immediately, daily or weekly |
| Threat intelligence match | A script matches the Script Monitoring Threat Intelligence list. | Immediately |
| Data sent to a malicious destination | A page sends data to a destination on the threat list. | Immediately |
| Flagged tag manager container | A script loads a tag manager container on the threat list. | Immediately |
| New outbound connections to review | Outbound hostnames still waiting for review. | Daily or weekly |
| CSP violations digest | Scripts your Content-Security-Policy blocked. | Daily or weekly |
| Recommended CSP header changed | The recommended Content-Security-Policy for a domain changed. | Daily or weekly |
| Security headers changed | Security headers changed on a payment page. | Immediately |
| PCI evidence pack ready | A PCI DSS evidence pack is ready to download. | Daily or weekly |
| PCI vendors need review | Payment-page vendors still need a PCI DSS review. | Weekly |

**Recommended CSP header changed** needs the CSP Builder, which is not on for every team.

## Which rules are on by default?

The use case you pick in Setup step 1 sets the defaults:

| Use case | Rules turned on |
| --- | --- |
| Client-side security | Every rule except **PCI evidence pack ready** and **PCI vendors need review**. |
| PCI DSS 6.4.3 & 11.6.1 | **Security headers changed** and **PCI evidence pack ready**. |
| Both | Every rule. |

Changing the use case later updates only the rules nobody has edited. Turning a rule on from its switch emails all team members; edit it to change that.

## What does each destination need?

| Destination | Fields | Plan |
| --- | --- | --- |
| Email | **Send to all team members**, or chosen **Team members**, plus **Other addresses** for people outside the team, such as a shared security inbox. | All plans |
| Webhook | **URL**, **Signing secret** and **Format**: **JSON**, **Slack** or **Discord**. | Pro and Enterprise |
| S3 | **Bucket**, **Region** and an optional **Path prefix**. | Pro and Enterprise |

Some triggers limit the destinations: **PCI vendors need review** sends email only, and **Recommended CSP header changed** sends email or webhook.

### Webhooks

Script Monitoring posts each alert to your URL, signed with your **Signing secret**. How to verify the signature, and what the payload looks like: [Webhooks](https://docs.scriptmonitoring.com/webhooks/).

### S3

Script Monitoring writes alerts to your bucket as hourly CSV files named `alerts-team-<teamID>-<from>-<to>.csv`, under the path prefix. Your bucket policy must let Script Monitoring write to it.

## What about my own email preferences?

**Your delivery** applies to your account only: **Organization, team and script emails**, **Security emails** and **Marketing emails**.

## Frequently asked questions

### Do rules need someone signed in?

No. Team rules run on the notifications engine, so they fire whether or not anyone is signed in.

### Why can't I pick S3 or a webhook for some rules?

Some triggers limit their destinations: **PCI vendors need review** sends email only, and **Recommended CSP header changed** sends email or webhook. Webhook and S3 also need Pro or Enterprise.

## Related

- [Set up notifications (guide)](https://docs.scriptmonitoring.com/guides/notifications/)
- [Webhooks](https://docs.scriptmonitoring.com/webhooks/)
- [Alerts](https://docs.scriptmonitoring.com/alerts/)