Notifications
Notifications
Maro can notify your security team whenever policy violations are detected across your organization. Notifications are configured in Your Organization > Notifications.
Email notifications
Email notifications send a detailed alert to specific recipients each time a violation session is detected. Each email includes a summary of the session, the employee involved, the apps used, and a breakdown of every violation.
Setting up email notifications
- Navigate to Organization Settings from the sidebar.
- Select the Notifications section.
- Click Add channel to create your email notification channel.
- Use the toggle to enable or disable notifications at any time.
Adding recipients
Add the email addresses of the people who should receive violation alerts. Recipients are saved automatically as you add or remove them.
Customizing the email template
The subject line and body of each notification email can be customized using Liquid template syntax. This gives you full control over the format and content of the emails your team receives.
Session variables
These variables are available in both the subject line and the email body.
Variable | Description |
|---|---|
employee_email | The email of the employee who triggered the violations |
organization_name | Your organization's name |
apps | List of apps involved in the session (use `apps join: ", "` to format as a comma-separated string) |
session_summary | AI-generated summary of what happened during the session |
session_start | Session start time |
session_end | Session end time |
violation_count | Total number of violations in the session |
event_link | Direct link to the session detail page in the Maro dashboard |
Violation variables
Individual violation details are available inside a {% for v in violations %} loop in the email body.
Variable | Description |
|---|---|
v.intervention | How Maro responded: Blocked, Logged, or Corrected |
v.violation | The type of violation (e.g., "Unauthorized App Access", "Sensitive Data Submission") |
v.app | The app where the violation occurred |
v.policy | The name of the policy that was violated |
v.description | A description of what happened |
v.violation_timestamp | When the violation occurred |
Default template
The default email template looks like this:
Subject:
Maro Notification: {{ violation_count }} Violations Detected on {{ apps | join: ", " }}Body:
{{ session_summary }}
{{ violation_count }} violation(s) detected for {{ employee_email }}
Apps: {{ apps | join: ", " }}
Session: {{ session_start }} — {{ session_end }}
{% for v in violations %}
{{ v.intervention }} {{ v.violation }} in {{ v.app }}
Policy: {{ v.policy }}
{{ v.description }}
{% endfor %}You can restore this default at any time by clicking Restore to Default.
Previewing your email
A live preview below the template editor renders your email using sample data so you can see exactly what recipients will receive. Expand the Preview Data section to edit the sample session and violation values used in the preview.
Webhooks (coming soon)
Webhook support will allow you to POST violation event payloads to your own endpoints in real time, enabling integration with tools like Slack, PagerDuty, Jira, or your own internal systems.
Digest summaries (coming soon)
Digest summaries will send periodic rollups of violation activity instead of individual real-time alerts — useful for teams that prefer a daily or weekly overview rather than per-event notifications.