Just deployed Cybereason across our fleet. The console shows everything fine, but the mobile app is completely missing critical alerts for me. Pushed a test malware alert from our sandbox and got nothing.
Anyone else seeing this? Specifically:
* Alerts appear on the full web interface but not the mobile app.
* Notifications are enabled, app is up to date.
* Issue persists across both iOS and Android devices in our team.
If you found a fix or workaround, post it. Need to know if this is a config issue on our end or a wider app problem.
I've seen similar behavior with alert routing in mobile clients before, and it's often a permissions sync issue rather than a complete app failure. Since you're seeing it across both platforms, I'd rule out OS-specific push notification problems.
The mobile app typically consumes a separate notification feed from the main web console. Could you check whether your test alerts are being categorized with a severity or tag that might be filtered out by the mobile notification rules? Some deployments have separate routing policies for mobile that default to only "critical" while the web console shows all.
If you have API access, try querying the notifications endpoint directly to see if the alerts appear there at all. That would help isolate whether it's a generation problem or a delivery problem.
brianh
Good point about checking the separate notification feed. That's bitten us before with other security tools - the mobile rules can lag behind the main console config by a sync cycle.
We had a similar thing with CrowdStrike last year where mobile only showed alerts above "high" severity, but their web dashboard defaulted to "medium and above." The fix was in a totally different admin panel from the main alert rules. Might be worth checking if Cybereason has a "Mobile Notification Policies" section buried in settings.
Does anyone know if the API endpoint for mobile notifications is documented? That'd be a solid next test.
Benchmarking my way to better decisions
Check the mobile notification policies first. The web console and mobile app often have separate severity thresholds, even if the alerts are tagged "critical."
Also, verify your test alert is hitting the mobile-specific feed. I've seen sandbox alerts get tagged with internal test flags that automatically exclude them from mobile push. Look for a "prevent notifications" or "internal only" flag in your sandbox alert generation.
If the API endpoint exists, query it. That's the fastest way to confirm the data is missing before the app.
Five nines? Prove it.
Great point about the separate notification feed - we ran into that exact scenario with a Salesforce Marketing Cloud mobile alert integration last quarter. The web dashboard was pulling from the main activity log, but the app had its own filtered data stream based on user role permissions.
It made me wonder if maybe there's a caching layer or sync delay specific to mobile? I've seen where the initial alert generates in the console immediately, but the mobile feed only updates on a set polling interval unless it's a truly live push notification.
What do you think, could it be a timing issue masked as a filtering problem?
If it's not measurable, it's not marketing.