So you can be confident you're being protected, Red Canary sends daily and weekly email summaries to show how many workstations and servers we’re actively monitoring in your environment, call out any new threats that have occurred, and warn you if telemetry isn’t being received.
Daily Email Summary
Daily email summaries are generated at approximately 16:00 UTC and show a snapshot of activity over the previous 24 hours.
Recently active endpoints - shows the number of licensed workstations and servers that have checked in during the previous 24 hours.
Threats to your organization - shows new threats that were published during the previous 24 hours, alongside any earlier threats that are still marked as unread. Click the links to view these threats in the Red Canary portal.
Uncommunicative servers - shows servers that have a sensor installed and aren’t decommissioned, but became uncommunicative during the previous 24 hours and remained so at the time of email generation. (A server is flagged as uncommunicative after three hours.) Click the links to view the affected servers on the Endpoints page in the Red Canary portal. For convenience, there are also links that take you to the Endpoints page with the search filters pre-filled to generate lists of servers and workstations that have either never sent telemetry, or else stopped sending telemetry more than three days ago.
Endpoints missing telemetry - shows endpoints that have checked in but haven’t sent telemetry during the previous 3 hours. Click the links to view the affected endpoints in the Red Canary portal.
Decommissioned endpoints by users - shows endpoints that have been decommissioned during the previous 24 hours. Click the links to view these decommissioned endpoints in the Red Canary portal.
Monthly monitored endpoints - counts the number of active workstations and servers that were monitored over the last month.
Status Checks - monitors the health of your entire Red Canary configuration, including all your alert sources and integrations. Click the your status page link view the Status Check page in the Red Canary portal and see which have passed or failed.
Weekly Email Summary
Weekly email summaries are generated at approximately 10:00 UTC every Monday and show a snapshot of activity over the previous seven days.
Monitored - counts the number of active workstations and servers that have been monitored from among your licensed endpoints in the past week. The percentage indicates the change from the previous week.
Newly observed endpoints - shows any monitored workstations or servers that were created during the past week. Click the links to view these new endpoints in the Red Canary portal.
Decommissioned endpoints by user - shows any workstations or servers that were decommissioned during the past week. Click the links to view these decommissioned endpoints in the Red Canary portal.
Reviewed events - shows the number of events that were reviewed and determined to be either a threat or not a threat.
Detected threats - shows the number of new and open threats that were detected during the past week. Click the links to view the threat details in the Red Canary portal.
Impact Summary - click the link to view the 30-day Impact Summary report in the Red Canary portal.
Threat Breakdown - lists detections by classification (Malicious Software, Suspicious Activity, or Unwanted Software).
Newly Detected - threats that have been published during the week
Still Active - threats that were last seen during the week
Unremediated - threats that are still unread or unacknowledged
Monitored endpoints - counts the total number of active workstations and servers that were monitored in the last month.
Status Checks - monitors the health of your entire Red Canary configuration, including all your alert sources and integrations. Click the your status page link view the Status Check page in the Red Canary portal and see which have passed or failed.