Email Alerts

Configure SMTP email notifications for alarm events. When an alarm fires and email is enabled for that alarm rule, the console sends a notification to the configured recipients.

Email Alerting Toggle

The master on/off switch for the email alerting feature. When disabled, no emails are sent regardless of individual alarm rule settings. Individual alarm rules also have their own email enable flag — both must be on for emails to be sent.

SMTP Configuration

Transport

• STARTTLS (default, port 587) — connects on plain SMTP, upgrades to TLS using STARTTLS negotiation. Recommended for most mail servers including Office 365 and Google Workspace.
• SSL/TLS (port 465) — opens a TLS connection from the start. Used by some older mail servers.
• Plain (port 25) — no encryption. Use only for internal relay servers on a trusted network.

SMTP Host

The hostname or IP address of your SMTP server. DNS resolution is supported (e.g. smtp.office365.com) as well as direct IP addresses (e.g. 192.168.1.10 for an on-premise relay).

Port

The TCP port for your SMTP server. Defaults to 587 (STARTTLS). Change to 465 if using SSL/TLS mode, or 25 for plain relay.

SMTP Username / Password

Authentication credentials for your SMTP server. Leave blank for unauthenticated internal relays.

The password field uses a two-box design:

• Current password — read-only indicator showing •••••••• when a password is stored. Use the eye button to toggle visibility (the actual value is never shown; the field always displays a mask). This confirms that a password is saved without revealing it.
• New password — enter a new value here to change the password. Leave blank to keep the existing stored password.

The password is stored AES-256 encrypted on disk. Saving settings from any other tab will never overwrite the stored password unless a new value is entered in the "New password" box.

From Address

The email address that appears in the "From:" field of sent notifications (e.g. airgap-alerts@yourcompany.com). This address must be allowed to send from your SMTP server.

Alert Recipients

The list of email addresses that will receive alarm notifications. Add addresses one at a time using the input field and "Add" button. Recipients receive all alarm notification emails — both digest batches and real-time alerts.

Delivery Options

Batch Window (seconds)

Alarm notifications accumulate in a buffer and are sent together as a single digest email at the end of each batch window. The default is 300 seconds (5 minutes). This prevents email floods when many alarms fire in quick succession.

Individual alarm rules can override this using the Real-time flag (⚡) in the rules table (Alarms > Rules) — those alarms bypass the batch window and send immediately.

How the batch window works: the console collects all alarms that fire within the window, then sends a single email listing all of them with their code, severity, and context. If no alarms fire in a window, no email is sent.

Daily Job Summary Email

When enabled, sends a daily email at the configured time listing all jobs that started, completed, and failed in the previous 24 hours. This provides a passive daily health check of vault operations. The summary time uses 24-hour format (e.g. 08:00 for 8:00 AM server time).

Test Email Connection

Sends a single test email using the current saved SMTP configuration to verify that the server is reachable, credentials are correct, and delivery succeeds. You can optionally override the recipient to send the test to a specific address.

SMTP Handshake Log

After clicking "Send Test Email", the full SMTP session protocol exchange is shown — EHLO, AUTH, STARTTLS negotiation, DATA, and QUIT (or the error at the point of failure). This is the same level of detail as running swaks or openssl s_client manually, and is the best tool for diagnosing SMTP connectivity issues such as:

• TLS certificate errors
• Authentication failures (wrong username/password, wrong mechanism)
• Relay restrictions (SMTP server rejects the from address or recipient domain)
• Firewall blocking the connection

Note: The test email sends using the last saved settings. If you have unsaved changes (including a new password), save first, then test.

Per-Alarm Email Configuration

Email notifications can be enabled or disabled for each individual alarm rule on the Alarms > Rules tab. Each rule has two email-related flags:

• Email (✉) — whether this alarm sends a notification when it fires. Blue = enabled, gray = disabled.
• Real-time (⚡) — when enabled, this alarm bypasses the batch window and sends immediately. Amber = real-time, gray = batched. Only active when Email is also enabled.

Bulk editing: Select multiple rules using the checkboxes, then use the bulk action bar to enable/disable email or set real-time/batched mode across all selected rules at once.

Filter pills: The Rules tab has three filter options above the table:

• All Rules — shows every alarm rule regardless of email status (default).
• Email not configured — shows only rules where email is disabled. Use this to identify rules that still need email set up. Rules disappear from this view as you enable email on them — this is expected.
• Email enabled — shows only rules that currently send email notifications.

The filter count in parentheses updates in real time as you toggle email flags. Selecting all via the header checkbox only selects the currently visible (filtered) rules, not all rules.

Default Email Settings (default alarm rules)

Missing default alarm rules are added automatically at console startup (the same as clicking Load Default Rules; you don't need to click it after an upgrade). When a default rule is added, the following alarm codes get email enabled by default — rules that already exist are never changed:

Code	Alarm	Delivery
AG-001	Agent offline	Real-time
LI-001	License expiring soon	Batched
LI-002	License expired	Real-time
CV-001	CyberVault source auth failed (full copy)	Batched
CV-002	CyberVault target auth failed (full copy)	Batched
CV-104	CyberVault source auth failed	Batched
CV-105	CyberVault target auth failed	Batched
CV-106	CyberVault ClickHouse changelist query failed	Batched
PG-001	PostgreSQL connection failure	Real-time
SY-001	Console JVM near-OOM	Real-time
AU-001	ECS audit ingest failed	Batched

All other alarm codes default to email disabled. You can change these settings at any time using the toggles on the Alarms > Rules tab.