Workspace / Alerts
PRO WORKSPACE Local storage
Display detailReadable stories and guided controls.Changes what you see, not collection, alerts, response or permissions.

Explore Pro tools

LESS REBUILDING THE SAME REPORT

Set up the review once. Reuse it next time.

Save the filters for a client, store or team review, then schedule private reports from that saved search.

Scheduled reports in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open reports
Included in Free

Filter the activity you need and export a private CSV or JSON record on demand.

Added by Pro

Reuse saved searches and generate private reports on a configured schedule, with optional report-ready notices.

Explore the stepsRead-only example · no site changes
1Save the scope

Choose the evidence and filters that answer your recurring question.

Save that definition so the next review starts from the same scope.
2Set the period

Choose the supported period and inspect the retained evidence it contains.

A structured local summary explains the selected records and their limits.
3Configure the repeat

Choose a daily or weekly schedule and, if needed, report-ready email notices. This example creates no schedule.

Background workers generate private reports. An authorized user still needs to open the report; a notice is not the report itself.

SELECT THE CHANGE AND THE DESTINATION

Get selected alerts where your team works.

Configure an email, Slack or HTTPS webhook destination and choose the supported activity that should trigger an alert.

Advanced alerts in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open advanced alerts
Included in Free

Use the included critical security and failure notices. Routine activity notification emails are in Pro.

Added by Pro

Choose configurable rules and email, Slack or webhook destinations, then review recorded delivery results.

Explore the stepsRead-only example · no site changes
1Choose the change

Select a supported permissions-change event and review the rule conditions.

Start with a change your team needs to review; this example saves no rule.
2Choose the destination

Select an email recipient, Slack incoming webhook or HTTPS webhook you control.

Review the destination and its privacy terms before enabling it. This example makes no connection.
3Verify the result

After setup, check the recorded delivery result and confirm receipt with the intended recipient.

A destination accepting a message does not prove a person received or read it. Background processing must be available.

KEEP THE REVIEW TOGETHER

Pick up the review where you left it.

Keep related evidence, your notes and decisions in one case. Return to it yourself or let an authorized teammate continue.

Cases & handover in Logged.ai Pro, using fictional demo data.
Genuine plugin screen · fictional demo data · select to enlarge
Open cases
Included in Free

Find and inspect individual records, including the actor, result and captured differences.

Added by Pro

Review supported associations in one case, add notes, assign the review and retain its decision history.

Explore the stepsRead-only example · no site changes
1Plugin updated

A component update starts the review. Compare the recorded result with your planned maintenance.

A case keeps this record beside the related observations.
2Settings changed

A later configuration change adds context. Its sequence alone does not establish a cause.

Keep the source fact separate from your interpretation.
3Permissions changed

Review the captured role difference and whether the access change was intended.

Record a decision against the case and return to its history.
Also included: review priorities

Inspect an experimental local ranking, its contribution breakdown and evaluation coverage. This experimental ranking helps choose a review order. It is not an attack probability or a verdict.

Availability depends on supported sources and configuration.

Team alerts, on your terms.

Choose the activity that needs attention and send a minimized alert to an authorized WordPress email recipient, Slack or a configured HTTPS destination. Rules and destinations must be enabled; delivery runs in the background. Saving a destination does not send a test notification.

Notification acceptance is separate from mailbox or app delivery. Unknown attempts may retry with the same delivery ID; duplicates are possible. No IP address, secret, request body or actor name is included in notification content.

Destinations

Stored URLs are never displayed. A new webhook signing secret is shown only immediately after saving. Editing a destination requires fresh consent and, for webhooks, its URL again; saving replaces its secret and invalidates queued messages for its previous revision.

LabelChannelStateActions
Fictional review team - sending disabled
Technical details9f877f0a-48dc-4eb3-ad5b-1445425fa72c
Revision 1
WordPress emailDisabled

Edit

Add a destination
Find an email recipient

Search before entering destination details. This reloads the editor and does not save the form.

For email destinations, only users with current event and investigation access and a valid email address are listed. Up to 200 user candidates are checked; use Find an email recipient if someone is missing. Access is checked again when saving and sending.

Webhooks require a public HTTPS destination on port 443. Slack URLs are treated as secrets. Every HTTPS attempt checks current DNS addresses and pins the connection; unsupported platforms do not send.

Rules

Choose which matching observations should produce an alert and where it should go. New versions start with future sources unless replay is explicitly selected. Each preview is a bounded sample, not a complete historical assessment.

Use condition fields from the event catalog, or fact_kind, incident_rule, incident_status and incident_priority. Conditions support all, any and not; maximum depth 4 and 20 terms. No executable code or regular expressions are accepted. A rule needs at least one current destination ID.

Recent delivery history

Latest 50 records. Open the exact supporting event or case references for a rule match. Removed or expired evidence stays unavailable. Synthetic tests have no real triggering evidence. “Accepted” means only the transport or WordPress mail subsystem reported acceptance.

DeliveryKindStatusAttemptsAcceptanceReasonEvidence