> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/insight/guardware-insight/audit-reports/understanding-your-daily-weekly-incident-alerts.md).
# Understanding Your Daily/Weekly Incident Alerts
GuardWare automatically sends two types of scheduled alert reports via email to help you stay on top of user activities and potential risks:
* [**User-Based Incident Alerts**](#user-based-incident-alerts) (Daily/Weekly)
* [**Incident Summary Alerts**](#incident-summary-alerts) (Daily/Weekly)
Both reports are **interactive;** clicking on an item takes you directly to the Dashboard for deeper investigation.
{% hint style="info" %}
**Before opening the links, make sure you’re logged in to the INSIGHT Management Console.**
{% endhint %}
### User-based Incident Alerts
User-based Incident Alerts show user-specific incidents and highlight individuals who may be bypassing policies or engaging in risky behaviour. The daily/weekly alerts help you identify issues early and take timely action.
This feature ensures you receive timely, actionable alerts for critical user-specific risks without needing to log in and manually check the dashboard. This makes it easy to see which users are showing risky behaviour, so security teams can take necessary actions on time.
**What You Will Receive**
Daily/weekly emails containing:
* A list of users displaying risky behaviour
* Number of users and the type of incident associated with each user
* A direct link to view more details in the Dashboard
**How to Check Details**
These emails are clickable. Clicking any incident takes you directly to the relevant Dashboard.
**Example:**\
Clicking **“Emailing of attachments from Corporate Email Address to Non-Corporate Email Address”** takes you to the **Risks Summary > Email Activities** widget in the Dashboard.
From here you can:
* Click an individual record to see username, date and time, sender and recipient addresses, subject, and file name.
* Use the **Arrow icon** in the **Action** column to drill down further.
* Use the **search box** at the top to quickly locate specific information.
Similarly, clicking on a **username** in the alert email takes you to the same widget but **filtered for that specific user**, allowing you to review all their related activities in detail.
#### How to Configure
1. Log in to the GuardWare INSIGHT Management Console.
2. Click **Open Management Console**.
3. Navigate to **Audit Report > Manage Report > User Based Incident Alerts.**
4. Click **Create a new User-based Risk Email**, enter a name for the alert, and choose how often you’d like to receive the alert (**daily, weekly, or monthly**).
5. Click **Create Risk** to define the type of incident you want to track (e.g., file uploads to non-corporate websites, time spent on non-corporate apps). This step sets the foundation for what the alert will monitor.
6. Select **Risk Type**, enter a **Risk Name** and define **Risk parameters** such as **incident thresholds** (e.g., number of files, time duration).
7. Select the **User Groups** you want to monitor and click **Save**.
8. Select the previously created alert name, set a **start** and **end date**, and select the risks you want included.
9. Click **Generate a User-based Risk Email now for these dates** to verify the configurations and generate a test email. Once the setup is complete, you’ll automatically begin receiving emails at the frequency you selected.\
### Incident Summary Alerts
Incident Summary Alerts provide a high-level overview of all incident categories across your organisation. You’ll see how many users were involved, how many incidents occurred, and the associated risk levels. This gives you a complete snapshot of your security posture in a single email.
**What You Will Receive**
Daily/weekly emails summarising:
* Incident categories
* Number of users involved
* Total incidents logged
* Risk levels and severity indicators
* Direct links to relevant Dashboards
**How to Check Details**
Just like the user-based alerts, these emails are interactive as well. Clicking any incident takes you directly to the relevant Dashboard.
**Example:**\
Clicking **“Files Uploaded to Generative AI Websites”** takes you to the **Risks Summary > Usage of AI Tools** widget in the Dashboard. This widget displays instances where corporate files have been uploaded to AI-powered platforms such as ChatGPT or claude.ai.
From here you can:
* Click any record to view username, application name, URL, PC name, and violation date and time.
* Use the **Arrow icon** in the **Action** column for deeper investigation
* Use the **search box** to filter specific information quickly.
#### How to Configure
1. Log in to the GuardWare INSIGHT Management Console.
2. Click **Open Management Console**.
3. Navigate to **Audit Report > Manage Report > Incident Summary Alerts.**
4. Click **Create New Risk Summary Email**, enter a name for the alert, and choose how often you’d like to receive the alert (**daily, weekly, or monthly**).
5. Click **Create Risk Set** to define the type of incident you want to track (e.g., file uploads to non-corporate websites, time spent on non-corporate apps). This step sets the foundation for what the alert will monitor.
6. Select **Risk Type**, enter a **Risk Name** and define **Risk parameters** such as **incident thresholds** (e.g., number of files, time duration).
7. Select the **User Groups** you want to monitor and click **Save**.
8. Select the previously created alert name, set a **start** and **end date**, and select the risks you want included.
9. Click **Generate a test Risk Summary Email now for these dates** to verify the configurations and generate a test email. Once the setup is complete, you’ll automatically begin receiving emails at the frequency you selected.\
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.guardware.com/insight/guardware-insight/audit-reports/understanding-your-daily-weekly-incident-alerts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.