Issue
An administrator wants to be notified proactively when a patch fails on a device, rather than checking the console manually.
Environment
- Automox (current agent release)
- All plans
Overview
Automox offers several ways to be alerted when devices fail to patch. Which to use depends on who should be notified and whether the alert should be real-time or a periodic summary:
| Method | Who receives it | Timing | Where it is set |
|---|---|---|---|
| Native email — Devices Failed to Patch | The individual signed-in user | Per event | Settings → User Profile |
| Slack notification | Everyone in the connected Slack channel, regardless of permissions | Per event | Settings → User Profile Profile → Add to Slack |
| Webhook | Any external system the organization owns (ticketing, PagerDuty, SIEM, email relay) | Real-time | Automox API |
| Scheduled Analytics report | The email recipients listed on the schedule | Periodic snapshot | Insights → Analytics |
Native email and Slack notifications
Enable Settings → User Profile → Notifications → Devices Failed to Patch to have Automox email the signed-in user when devices fail to patch. Each administrator enables it for their own account. On the same page, Add to Slack posts the same events to a Slack channel — this requires the Organization: Manage permission, and everyone in the channel receives them regardless of individual permissions. The full option list is in the Settings / Profile documentation.
Scheduled report
For a periodic summary rather than per-event alerts, open Insights → Analytics, open a board reflecting patch or compliance status, and select Schedule → Create schedule (set the frequency, recipients, and attachment type). See Analytics Board and Report Scheduling.
Route failures to another system with a webhook
Webhooks let Automox send an event to an HTTPS endpoint the organization controls (a ticketing tool, PagerDuty, a SIEM, or an email relay) when a patch policy fails. The webhook API is part of the Automox API at base https://console.automox.com/api/; the organization is taken from the API key or passed as a query parameter ?o={orgId} (there is no /orgs/{orgId}/ path segment).
- Stand up an HTTPS endpoint that can receive a JSON POST.
- Review the available events with
GET /webhook-event-typesand subscribe topolicy.non_compliant— "triggered when a patch policy fails to apply to a device." Use this current event name; older documentation may show a legacysystem.patch.failed, which is out of date. - Create the subscription with
POST /webhooks. Manage subscriptions withGET /webhooks,GET /webhooks/{id},PATCH /webhooks/{id}, andDELETE /webhooks/{id}. Review delivery history withGET /webhooks/{id}/deliveries, and rotate the payload signing secret withPOST /webhooks/{id}/rotate-secret. - Configure the receiving system to format and route the alert (email, chat message, or ticket).
Full request and response details for each endpoint are in the Webhooks API Reference on the Automox Developer Portal.
Notes
- Email notifications are per-user. Each administrator enables Devices Failed to Patch on their own Profile; there is no single org-wide email toggle.
- Slack notifications are channel-wide. Everyone in the connected Slack channel receives the selected alerts regardless of permissions, unlike the per-user email settings.
- "Devices Failed to Patch" is specific to patch failures — it is not a generic policy-failure or "device needs attention" alert.
- Webhooks post to an endpoint the customer owns (email is sent by that receiving system); a scheduled Analytics report is a periodic snapshot, not a real-time trigger.
Related: the Settings / Profile documentation, the Automox Developer Portal webhooks reference, and "Creating Reports."