What you will do: learn to recognise each email Warden sends, what it is telling you and what to do about it. Immediate alerts are kept for serious events; the evening digest and the Monday reports give you the wider picture.
Time: about 10 minutes to read; a few minutes each time an email needs action.
You need: access to the mailbox of an alert recipient, and the server where Warden is installed for anything that needs the dashboard.
Before the first email arrives
- Add these senders to your contacts or safe-senders list so Warden emails do not land in spam: [email protected] (alerts and summaries), [email protected] (update notices) and [email protected] (sign-up and welcome emails).
- Make sure everyone who should get alerts is listed and verified under Settings, Alert Recipients. See Set working hours, recipients and which alerts you get.
- Remember one rule for every email: to open the dashboard, use the Prixl Warden Dashboard icon on the server’s desktop, not the “Open Dashboard” button or the “Warden Dashboard” link in the email. Those links point to http://localhost:9843, and a browser that has not been opened through the desktop icon shows a “Session Expired” page there.
Times in Warden emails, and the times the digest and reports are sent, are Indian Standard Time (IST).
The emails at a glance
| When | Subject starts with | |
|---|---|---|
| Immediate alert | As soon as a high or critical event happens | [Warden] followed by the severity |
| Daily digest | 18:00 IST, only on days with something to report | [Warden] and your organisation name |
| Weekly Security Summary | Monday 08:00 IST | [Warden] Weekly Security Summary |
| Weekly User Activity Report | Monday 08:00 IST (paid plans) | [Warden] Weekly User Activity Report |
| Silent server notice | Daily check at 09:00 IST, once a server has been silent for more than 72 hours | [Prixl Warden] Device Unreachable |
| Licence notices | 14 and 7 days before expiry, and on the day | [Warden] Plan expiring soon / [Warden] Plan expired |
| Dashboard change | Whenever someone changes something in the dashboard | [Prixl Warden] followed by the change |
| Update notice | When a new Warden version is released | [Warden] followed by the update details |
Immediate alert
The subject reads “[Warden] severity: what happened on server name“. Only events rated high or critical are emailed straight away. Some alerts have their own subjects, such as “Distributed brute-force activity” or “Brute-force from TRUSTED IP” followed by the address.
The email is headed “Warden Security Alert”. A table at the top gives the severity, the event, the time, the server and, where they apply, the user account and the IP address involved. Below it, “Why” and “Alert Explanation” (What happened / Why it matters) explain the event in plain English. Depending on the event you may also see a “Brute-force summary”, an “Incident Timeline (last 2 hours)” and recommended steps. These explanations are written by our team for each event type; they are not generated by AI.
What to do
- Read the event, the user account and the IP address. Ask yourself whether it was you, a colleague or your IT vendor at that time.
- If you recognise it, no action is needed. If it is your own office or vendor address and it keeps alerting, add it on the Trusted IPs tab so it is never auto-blocked.
- If you do not recognise it and the source is an internet address, block it: use the block link in the email if there is one (see below), or open the dashboard from the desktop icon and use IP Blocking, Manual Block. See Block attackers.
- If the alert is about an account (a new account, a change to the administrators group, a sign-in you cannot explain), check that account with your IT vendor and change its password if there is any doubt.
- If the email says “IP … has been AUTOMATICALLY BLOCKED in Windows Firewall”, Warden’s auto-block has already acted. Review it, or unblock it if it was a mistake, from IP Blocking in the dashboard.
The “Block this IP” link
On paid plans, some alerts include a box “Block IP address?” with a red button “Block address“. The box describes it as a one-click block, time-limited and single use, and explains that the Warden agent applies the firewall rule on your server. The free trial does not include this link.
- When it appears: only for sign-in and brute-force alerts from a public internet address that has not already been auto-blocked. It never appears for an address on your own network (the email says “NO BLOCK LINK” instead), for staff connected through Prixl Guard (“VPN SUBNET IP”), or in the separate alert about a trusted IP.
- How long it lasts: the link works once and only for a limited time: up to 30 minutes on paid plans at the time of writing. The email itself says only that the link expires shortly, so use it promptly.
- What happens when you click it: a page titled “IP Block Requested” confirms that the address has been queued, and says the Warden agent will apply the firewall rule within the next polling cycle (typically under 30 seconds). You can check it on the IP Blocking tab.
- If you see another page: “Invalid or expired link” or “Link already used” means you need to block the address from the dashboard instead (IP Blocking, Manual Block). “Cannot block this IP” means the address is private or belongs to your Guard network. “Feature not available” means your plan does not include email blocking.
Before you click, make sure the address is not your own office, home or vendor connection. Blocking your own address can cut you off from the server.
Daily digest (18:00 IST)
An evening summary of the day, headed “Warden daily summary”. It is sent only when there is something to say: a day with no issues, no connections and no blocks sends nothing. The subject starts with “[Warden]” and your organisation name, then a short status such as “firewall OFF”, how many items need attention, how many are still open, or “all clear”. Your very first digest starts with “First summary.”
Inside you will find a coloured verdict line, a “Needs attention” list, a note of any blocked addresses, a “Connections” table (who connected, and to which account) and “Already reported, still happening” for issues you have already been told about. The footer reminds you that serious incidents are emailed the moment they happen, unless the source was already blocked automatically.
- Read the verdict line and the “Needs attention” list first. Each item says what was found.
- Scan the “Connections” table for any name or account you do not expect. Treat an unknown one like an immediate alert (see above).
- If the subject says “firewall OFF”, ask your IT vendor to switch Windows Firewall back on for the network the server uses. The Keep Windows Firewall on switch under Settings can switch it back on automatically in future (if Group Policy is what turns it off, Warden reports it instead).
You can switch the digest off under Settings, Regular Summaries, Daily digest. Think twice: alerts that are normally listed only in the digest, such as repeated sign-in attacks and newly installed services, are then not emailed at all.
Weekly Security Summary (Monday 08:00 IST)
Covers the last 7 days. The subject reads “[Warden] Weekly Security Summary:” followed by the number of events, notes such as “firewall OFF” or how many IPs and attacks were blocked, and the date range. Inside: events by severity, a “Protection status” section for each server, the top event types, servers, source IPs and users, “Auto-Blocked IPs”, network sign-ins, “Attacks Prevented by Firewall” with the most targeted ports, and a “User Activity” section. A quiet week says “No security events were recorded this week.”
- Read “Protection status” first. Warnings there (for example, that protection is degraded) may only ever be reported in this email.
- Look at “Top users” and “Top source IPs” for names or addresses you do not expect.
- If “Top targeted ports” shows the same ports week after week, consider restricting them. See Restrict risky ports.
Weekly User Activity Report
A separate email at the same time on paid plans (not the free trial), headed “Weekly User Activity Report”. It lists each user’s sessions, how long they lasted and which were outside your working hours. Use it to spot sign-ins at times nobody should be working. The odd-hour figures use the working hours you set: see Set working hours.
Both Monday emails are switched off together by Settings, Regular Summaries, Weekly reports.
Device Unreachable (the server has gone silent)
Subject “[Prixl Warden] Device Unreachable” (or “N Devices Unreachable”), heading “Warden Agent Unreachable”. Warden checks once a day at 09:00 IST and sends this when a server has not reported in for more than 72 hours. A table shows the server and when it was last seen. It is sent again each day while the server stays silent.
- Check the server is switched on and connected to the internet.
- Open Services on the server and check that Prixl Warden Activity Monitor is Running.
- If it is stopped, start it. The email suggests
sc start PrixlWarden, which works in Command Prompt but not in PowerShell. In PowerShell (run as administrator) use:
Start-Service PrixlWarden
Get-Service PrixlWardenIf it will not stay running, send the log file C:\ProgramData\Prixl\warden\logs\warden.log to support through the contact form. If you have retired the server on purpose and these emails continue, contact support too.
Licence notices
Sent to your Warden admin addresses 14 days and 7 days before your plan ends (“[Warden] Plan expiring soon for” your organisation ID, with the days left) and on the day it ends (“[Warden] Plan expired for” your organisation ID). Organisations with a longer grace period can also receive reminders 7 and 30 days after expiry, with a subject starting “[Warden] URGENT: Warden license in grace period”. While a licence is in its grace period, alert emails also start with a banner saying the licence has expired and in how many days alerts will stop.
What to do: renew before the date shown. See Trial, licence renewal and what happens at expiry.
Other emails you may see
- Dashboard changes, subject “[Prixl Warden]” followed by what changed and the server name, for example “IP Address Blocked”, “Security Hardening Applied”, “Security Fix Reverted”, “Trusted IP Added” or “Notification Settings Changed”. The email names the Windows user who made the change. If nobody in your team made it, find out who has administrator access to the server.
- Update notices from [email protected]: “Mandatory update”, “Security update available” or “is now available”. See Updates and checking your version.
- Welcome after a server first connects, starting “[Warden] Welcome to Prixl Warden”, with your plan, its expiry and its limits.
- Recipient verification, when someone is added to Alert Recipients, and a notice to all recipients whenever the daily digest or weekly reports are switched on or off.
- Uninstall report, “[Prixl Warden] Uninstalled from” followed by the server name, when Warden is removed. If you did not remove it, treat it as urgent. See Uninstall Warden.
Check it worked
- The three sender addresses are in your safe-senders list.
- Your first daily digest (starting “First summary.”) arrives at about 18:00 IST on a day with something to report, and the first weekly summary on the following Monday morning.
If something goes wrong
- No emails at all: check spam, check the address is verified under Alert Recipients, and check the Daily digest and Weekly reports switches.
- Fewer alerts than expected on the free trial: the trial limits how many alert emails are sent per hour and per day.
- “Session Expired” after clicking a link in an email: close it and use the desktop icon instead.
- More fixes: Troubleshooting Warden.