Integration alerts: what fires and when
Plain rules with fixed thresholds watch your monitoring, security, backup, network and identity feeds: failing backups, open critical detections, people without MFA, a gateway down, and more. Alerts open once, resolve themselves, and show on the company record.
On this page · 4 sections
Integration alerts are Current watching your customers' environments for you, so a problem doesn't wait for the next review to surface. They're deterministic: plain rules with fixed thresholds, not a vague AI hunch, so when one fires you know exactly what tripped it. They read your monitoring, security, backup, network and identity feeds and show up on the company record.
The rules
Each rule has a fixed, deliberately conservative threshold, set high enough that a fired alert is worth your attention. A rule only reads the feeds you have connected, so a workspace without a backup tool never gets a backup alert. Severity is shown as critical (red) or a warning (amber):
| Alert | Fires when | Severity |
|---|---|---|
| Backups need attention | A protected system has had no good backup in 3 or more days, its last backup failed, it has never backed up after 3 days, or its boot check hasn't been verified in 3 days. Paused or archived backups don't count. Where your backup tool already applies its own policy, its verdict is used as it is. | Critical |
| Critical security alerts open | A critical endpoint, SOC or MDR detection, or an email threat, has been open for 48 hours or more. The first time Current sees one with no earlier history to compare against, it fires straight away. | Critical |
| Phishing activity spike | Phishing volume over the last 7 days is at least 3 times the customer's own 30-day weekly average, and at least 5 messages. | Warning |
| Endpoint compliance slipping | Patch compliance is under 80% (with at least 5 machines reporting), Mac policy compliance is under 80% (at least 3 Macs), or offline devices grew 25% or more on the week before. | Warning |
| RMM alerts active | Your RMM has one critical alert open (critical), or three or more critical and major alerts together (warning). Minor alerts never count. | Critical or warning |
| People can sign in without MFA | At least one person can sign in without a second factor. Critical when anyone is in bypass, or when it's 20% or more of at least 5 people. | Warning or critical |
| Security awareness risk | The latest phishing test found 15% or more of people clicking (30% is critical), with at least 5 test emails delivered; or 25% or more of training enrollments are overdue. | Warning or critical |
| Network down | A gateway or firewall is offline (critical); or, with every gateway up, three or more other devices are offline, your network monitoring has an open critical alert, or a monitoring collector has been offline for 15 minutes (warning). | Critical or warning |
| Support or licence expiring | A network device is already out of support or licence (critical), or is inside its expiry window (warning). | Critical or warning |
| Admin rights exposed | A computer has been in audit mode for 30 days or more (warning), or left in technician bypass for a day or more (critical). | Warning or critical |
| Account compromise open | A Microsoft 365 account compromise is still open. Critical while an attacker may still be in the account, a warning for an older one that hasn't been closed. | Critical or warning |
| Critical Microsoft 365 setting open | A critical-severity Microsoft 365 security control is not in place, or was and has drifted. There is no score threshold: a low posture score alone never fires this. | Critical |
| Documented renewals are due | A warranty, licence, certificate or domain in your documentation lapsed in the last 30 days (critical), or is due within 30 days (warning). | Critical or warning |
| MFA off because of a policy | A sign-in policy lets people in without a second factor. Critical when it's the global policy, a warning for a narrower policy, network list or country list. | Critical or warning |
| Automatic security response waiting | An automatic response from your MDR has waited more than 2 hours for someone to approve it. | Warning |
| Important device down | A device you marked as vital in your network monitoring has been down for more than 15 minutes. | Critical |
Three payment rules (a stored card about to expire, no autopay on file, autopay that stopped charging) work the same way but show on the company's Payments card, and the account manager hears about them there.
Open once, resolve themselves
Alerts are open-once and self-resolving. When a rule trips, Current opens one alert for that company. It won't open a second for the same condition while the first is still standing, so a backup that's been failing all week is one line on the record, not fifty. If the condition gets worse, the same alert's severity and detail update. When the condition clears (the backup succeeds, the detection is closed, the device comes back) the alert resolves itself. There's nothing to dismiss by hand.
Where alerts appear
Open alerts show on the company record, in the open-alert strip at the top of the Infrastructure & security section. See "The company page: Infrastructure & security" for how that section reads. An open alert on a company you own also lands in your morning daily brief as an attention item, and you can ask Ask Current which customers have backups failing or MFA gaps. Because the alerts read the same feeds the SBR does, they're also a useful pre-review check: a company with open alerts is one whose telemetry chapters will have something to say.
Notifications are off by default
Integration alerts live in the app: on the company record, in the daily brief, and in Ask Current. A bell to your tenant admins when a new alert opens exists but is off by default, so Current won't start notifying you about a customer's backups unless your workspace has it switched on. The thresholds are conservative precisely so that when it is on, what reaches you is worth reading.