---
title: "Manage Threat Alerts"
description: "Get notified by email or webhook when attack volume against a protected app changes unusually."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

Threat alerts watch the attack data collected from a protected app and notify you when it moves in a way worth looking at — a spike against a recent baseline, or a shift concentrated in one threat type or OS version.

Open **Settings → Manage Threat Alert**. The page is titled **Manage Threat Alerts**.

**Note:** 
**Manage Threat Alert** appears in Settings only when threat notification is enabled for your account. To enable it, contact the [Help Center](https://support.doverunner.com). Only the Owner, SubOwners, and group managers can open it; for other members the tab is disabled.


## The Alert List

| Column | Description |
| :----- | :---------- |
| **Notification Name** | The name you gave the alert. |
| **App Name** | The package the alert watches. |
| **Condition** | The comparison that triggers the alert. |
| **Updated On** | When the alert was last modified. |
| **Recipient** | The email addresses or webhooks the alert is delivered to. |
| **Action** | Pause (or resume), edit, or delete the alert. |

Narrow the list with **FILTER**, or download it with **EXPORT**.

## Creating an Alert


1. Click **CREATE**.

2. On the **Create Threat Alerts** page, under **Basic Information**, enter a **Name**. Use something that identifies the app and the condition, since the list shows many alerts side by side.

3. Under **Condition**, choose **Android** or **iOS**, pick the app from **Select App**, and choose a **Select Condition** entry. The OS-version condition adds a **Select OS Version** field, and the threat-type condition adds a **Select Threat Type** field, for the version or threat type to watch.

4. Under **Action**, choose a **Select Communication Channel** and one or more recipients.

5. Click **SAVE**.


### Conditions

| Condition | Fires when |
| :-------- | :--------- |
| **Compare with Yesterday Total Attack Volume with Avg of Past 2 day** | Yesterday's total attack volume diverges from the average of the previous 2 days. |
| **Compare with Yesterday Total Attack Volume with Avg of Past 2 weeks** | Yesterday's total attack volume diverges from the 2-week average. |
| **Compare with Yesterday Total Attack Volume with Avg of Past 1 Month** | Yesterday's total attack volume diverges from the 1-month average. |
| **Compare the Spike of the Total Volume in OS Version between with Yesterday and Day Before** | The volume for a given OS version spikes between yesterday and the day before. |
| **Compare the Spike of the Total Volume in Threat Type between with Yesterday and Day Before** | The volume for a given threat type spikes between yesterday and the day before. |

The three volume conditions differ only in their baseline window. A short baseline reacts quickly but is noisier; a longer one is steadier but slower to flag a gradual rise.

### Communication Channels

| Channel | Recipient |
| :------ | :-------- |
| **Email** | One or more email addresses. Pick team members from the list or type an address. |
| **Webhook** | One or more webhooks registered in [Manage Webhook](https://docs.doverunner.com/mobile-app-security/console/settings/manage-webhook/). If the one you need is not registered yet, click **Add Webhook** next to the field to open the **Create Webhook** dialog, enter the **Webhook URL** and **Channel Name**, and click **SAVE** — the new webhook is then available to select. |

**Note:** 
Alerts are evaluated against collected attack data, so an app only produces them once it has been sealed, released, and run by users. See the [Dashboard Guide](https://docs.doverunner.com/mobile-app-security/console/dashboard/dashboard-guide/) for the data behind these comparisons.