Lacework can generate and send alert summaries and reports to email addresses using an email alert channel. By default, Lacework creates a single email alert channel during the initial Lacework onboarding process and new members are added automatically. The default channel cannot be edited. You can add more email alert channels.
Create a Lacework Alert Channel
- Log in to the Lacework Console with a Lacework user that has administrative privileges.
- Navigate to Settings > Alert Routing > Alert Channels.
- Click + Create New.
- Select Email.
- Name the channel.
- Click Next.
- Add email addresses that you want to receive the alerts.
- Click Save.
- Click Alert Rules and configure your required alert routing details/options by leveraging the alert channel you created.
If your organization uses Microsoft Office 365 Exchange Email server, Lacework recommends adding the Lacework sending domain (lacework.net) to your Office 365 Exchange Email whitelist. For more information, see Whitelist the Lacework Domain in the Office 365 Exchange Email Server.
If a member disables default email notifications in their profile, they do not receive alerts that are sent through the default email alert channel. This setting does not affect alerts sent through other email alert channels.
Compliance Report Schedule
To change the default compliance report schedule (1200 GMT), navigate to Settings > General Settings. This is when Lacework starts running a complete compliance assessment for all accounts, generates reports based on that assessment, and sends those reports to team members.
The time specified in the drop-down is not the time that you will receive the report email because it takes time to collect the data, generate the report, and send the email. Note that this drop-down does not affect when event summaries are generated, only reports. Event summaries start generating at 1200 GMT.