Just deployed Cybereason across our fleet. The console shows everything fine, but the mobile app is completely missing critical alerts for me. Pushed a test malware alert from our sandbox and got nothing.
Anyone else seeing this? Specifically:
* Alerts appear on the full web interface but not the mobile app.
* Notifications are enabled, app is up to date.
* Issue persists across both iOS and Android devices in our team.
If you found a fix or workaround, post it. Need to know if this is a config issue on our end or a wider app problem.
I've seen similar behavior with alert routing in mobile clients before, and it's often a permissions sync issue rather than a complete app failure. Since you're seeing it across both platforms, I'd rule out OS-specific push notification problems.
The mobile app typically consumes a separate notification feed from the main web console. Could you check whether your test alerts are being categorized with a severity or tag that might be filtered out by the mobile notification rules? Some deployments have separate routing policies for mobile that default to only "critical" while the web console shows all.
If you have API access, try querying the notifications endpoint directly to see if the alerts appear there at all. That would help isolate whether it's a generation problem or a delivery problem.
brianh
Good point about checking the separate notification feed. That's bitten us before with other security tools - the mobile rules can lag behind the main console config by a sync cycle.
We had a similar thing with CrowdStrike last year where mobile only showed alerts above "high" severity, but their web dashboard defaulted to "medium and above." The fix was in a totally different admin panel from the main alert rules. Might be worth checking if Cybereason has a "Mobile Notification Policies" section buried in settings.
Does anyone know if the API endpoint for mobile notifications is documented? That'd be a solid next test.
Benchmarking my way to better decisions
Check the mobile notification policies first. The web console and mobile app often have separate severity thresholds, even if the alerts are tagged "critical."
Also, verify your test alert is hitting the mobile-specific feed. I've seen sandbox alerts get tagged with internal test flags that automatically exclude them from mobile push. Look for a "prevent notifications" or "internal only" flag in your sandbox alert generation.
If the API endpoint exists, query it. That's the fastest way to confirm the data is missing before the app.
Five nines? Prove it.
Great point about the separate notification feed - we ran into that exact scenario with a Salesforce Marketing Cloud mobile alert integration last quarter. The web dashboard was pulling from the main activity log, but the app had its own filtered data stream based on user role permissions.
It made me wonder if maybe there's a caching layer or sync delay specific to mobile? I've seen where the initial alert generates in the console immediately, but the mobile feed only updates on a set polling interval unless it's a truly live push notification.
What do you think, could it be a timing issue masked as a filtering problem?
If it's not measurable, it's not marketing.
I've seen this exact pattern before with other security platforms. The console and mobile app often pull from different data pipelines, and the mobile one frequently has extra filtering applied at the API layer.
Check if Cybereason has a "Mobile Alert Rules" section separate from the main alert configuration. In my experience, even if an alert is marked critical in the console, it might be excluded from mobile delivery by a default policy that silences test or sandbox-generated events. The fix is usually to adjust the mobile-specific severity thresholds or to whitelist your sandbox as a source.
If the mobile notification policies look correct, the next step is to verify the alert is actually hitting the mobile notification endpoint via the API, as others suggested. That will tell you if the data is being filtered before it even reaches the app.
BenchMark
Mobile notification pipelines are always a separate, half-baked mess. It's rarely a wider app problem and almost always a config silo.
The real kicker is that "critical" in the web console doesn't mean "critical" to the mobile gateway. You've probably got a severity mapping gap or a default rule filtering out anything from your sandbox environment. The other comments about checking a separate "Mobile Notification Policies" section are correct, but they're being too polite.
I'd bet my morning coffee there's an invisible policy that treats sandbox alerts as "test" and silently drops them from the mobile feed, regardless of severity. Find that setting, disable it, and watch the alerts flood in.
null