You can send notifications by email using your own SMTP server or, in Cribl.Cloud on an Enterprise plan, the managed system_email target. Policies and Monitors select the target and an email notification template (for example, default-email). The template defines To, Cc, Bcc, subject, and body.

To add an email target in Cribl Insights, go to Alerts > Notification Settings, open the Targets tab, then select Add Notification Target > Email.

Organizations on an Enterprise plan in Cribl.Cloud also have access to a preconfigured system_email target and can send mail without configuring SMTP.

Email Recipients

​

An email target, including system_email, only defines how mail is sent (Cribl-managed delivery or your SMTP server). It does not store who should receive each message.

Recipient addresses are defined in the notification template you use with the email target. In the UI, the default template is named default-email. You can add more templates with Target type SMTP (the label used in the template editor for email).

• The template Content is JSON that includes to (required), optional cc and bcc, plus subject and body.
• You normally map those fields to Monitor Metadata so each Monitor can list its own recipients. For example, the template uses {{metadata.to}} for To, and the Monitor includes a metadata field to with value team-alerts@example.com.
• Alternatively, you can put fixed addresses directly in the template when every alert using that template should go to the same people.

A Notification policy or a Monitor using Select Specific Notification Target chooses both the target (for example, system_email) and the template. At send time, Cribl resolves the template (including metadata) and passes the resulting To / Cc / Bcc to the email target.

Configure a custom email target

​

The following applies when you add your own Email target (not the preconfigured system_email target).

General Settings

​

Target ID: Enter a unique name to identify this email notification target.

Configuration

​

Address: Identify the SMTP server by its hostname or IP address.

Port: Set the SMTP port. Use port 587 for SMTP Secure (SMTPS). You can also use port 25. Use 465 when SSL/TLS is enabled. You can also use port 2525 if your email service provider supports this port as a backup when other ports are blocked by a network provider or a firewall.

From: Identify the email address of the sender.

Encryption type: Specify the encryption type used to secure SMTP communication. Options include:

• STARTTLS: Select this option to start the connection as plaintext, then upgrade it to a TLS-encrypted one if the server supports it. If the server doesn’t support it, the connection remains plaintext.

  STARTTLS upgrades the connection to be encrypted but does not authenticate the server. Take additional steps to prevent man-in-the-middle attacks.

• Require STARTTLS: Select this option to require TLS. If the server doesn’t support a secure connection, the connection is dropped.
• TLS (SMTPS): Select this option to use an encrypted connection from the start without requiring a subsequent connection upgrade.
• None: Select this option to use a plaintext connection.

Minimum/Maximum TLS version: Optionally, select the minimum/maximum TLS version to use when connecting.

Validate server certs: Toggle on to reject certificates that are not authorized by a CA in the CA certificate path or by another trusted CA (such as the system’s CA).

Authentication

​

Username: The authentication principal (if required).

Password: The authentication credential (if required).

Default Email Notification Target for Cribl.Cloud Enterprise

​

For Cribl.Cloud Enterprise organizations, a default system_email notification target is available and managed by Cribl. The target appears on the Notification Settings > Targets tab as system_email. You cannot modify or remove this target.

It uses the same recipient model as any other email target: you do not enter addresses on the target itself. It uses the default-email template whose To (and optional Cc / Bcc) fields resolve to the addresses you want, from {{metadata}} variables matched to Monitor Metadata fields. Then attach that template wherever you reference system_email in a policy or Monitor.

Send Domain for Cribl.Cloud Email Notifications

​

Every Cribl.Cloud Workspace and Organization has a unique address for this email notification target. Messages sent using system_email have a sender address of the form do-not-reply@<workspaceName>-<organizationId>.criblcloud.email. To improve deliverability, recipients should add the criblcloud.email domain to their email allowlists.