> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raidenhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# RAIDEN alert notifications: who gets them and when

> Find out which events trigger email notifications, who receives them by default, and how to adjust notification settings for your team.

RAIDEN sends email notifications when new high-severity cases are created, so your team is informed immediately when something needs urgent attention. Notifications are on by default for the roles most likely to act on them, and you can adjust the settings at any time.

## What triggers a notification

RAIDEN sends an email when a new **High** or **Critical** case is created. These are the two severity levels that require same-day action.

| Severity     | Meaning                                | Notification sent |
| ------------ | -------------------------------------- | ----------------- |
| **Critical** | Active or confirmed account compromise | Yes               |
| **High**     | Strong indicators of attack            | Yes               |
| **Medium**   | Suspicious but unconfirmed             | No                |
| **Low**      | Unusual activity, low risk             | No                |
| **Info**     | Contextual data, no direct risk        | No                |

## Who receives notifications

Email notifications are sent automatically to all team members with the following roles:

* **Owner**
* **Admin**
* **Analyst**

Viewers do not receive email notifications by default.

## Adjusting notification settings

To change who receives notifications or to modify notification preferences:

1. Go to **Settings → Notifications**
2. Adjust the settings for your team

<Info>
  If you want a Viewer to receive notifications, consider whether an Analyst role would be more appropriate for their responsibilities.
</Info>

## Notifications and automated response

If you have opted in to [automated response](/response-actions#automated-response-opt-in), RAIDEN may already have contained a high-confidence threat (revoked sessions, removed malicious inbox rules) by the time the email reaches you. The case note records exactly what RAIDEN did and why, so the notification becomes a prompt to review and confirm rather than a call to act from scratch. Automated response is off by default — without it, every notification is purely informational and no action is taken until you click.

## Getting urgent support

For active compromise situations that need immediate escalation, email [support@raidenhq.com](mailto:support@raidenhq.com) with **URGENT** in the subject line. RAIDEN prioritises these requests.

For standard queries, include:

* Your organisation name or tenant slug (found in **Settings → Account**)
* The Case or Alert ID if your question relates to a specific detection
* A brief description of what you expected to see and what you saw instead

RAIDEN responds to standard queries within 1 business day.