A Drupal security release matters only if it affects a site you run. The useful alert names the site, the advisory and the installed version, and reaches the people who will act on it. This guide explains how SentinelConnector's release-day alerts work and how to set them up for your team.
Note
Disclosure: SentinelConnector publishes this guide and is our product. TrueCMS, the Drupal agency that maintains it, contributed.
When Drupal security releases arrive
The Drupal Security Team normally publishes security releases on Wednesdays, between 16:00 and 22:00 UTC, with exceptions outside that window. In eastern Australia that is early Thursday morning. (Release timing.)
Drupal.org announcements tell you that a release exists. They do not tell you which of your production sites run the affected version. That matching step is what turns an announcement into work for a particular team.
How a release becomes an alert
SentinelConnector compares each site's reported inventory with published advisories. When it confirms that an advisory affects the version a site reported, it raises a critical Security update needed message for that site and emails the people in the organisation's security alert audience. It checks for new findings every minute.
The email is not instant from the moment Drupal.org publishes. Advisory collection, the site's next inventory report, assessment and email delivery all take time. A project-name match without confirmation that the installed version is affected does not send an alert.
Important
No alert does not prove that a site is secure. A site that has stopped reporting, or custom code that no advisory covers, can still need attention. Check when each site last reported.
What the email contains
Each recipient gets one email per organisation for each check, with every affected website listed once and its advisories under it. For one site and one advisory, the subject is "Security update needed for" followed by the site name. Each entry names the advisory and links to the site's Updates tab, where you can review the affected component and the version that fixes it.
The same message appears in the dashboard for every member of the organisation, whether or not they receive the email.
Why security alerts cannot be turned off
Security alerts are required notices. Notification rules and quiet hours cannot suppress or delay them. The organisation decides who is emailed; a person in that audience cannot opt out. This keeps a release-day alert from being lost because one person changed a setting months earlier.
Choose who gets the email
There are two choices for each organisation:
| Choice | Who is emailed |
|---|---|
| Email all members (the default) | Every member with a verified email address |
| Email administrators only; members can opt in | Administrators, plus members who turned the alert on for themselves |
The person who creates an organisation is asked during sign-up, on the Choose who gets security alerts step. It can be skipped, which keeps every member on the email. An administrator can change the choice later in Organisation Details with Security alert audience: email all members.
How members opt in
When only administrators are emailed, other members can opt in under Profile → Email preferences with Email me security alerts. Members who have not opted in are also asked once in the dashboard: Get security alert emails? The opt-in covers security alerts only. It does not add members to certificate or other administrator-only messages.
Add Slack
Slack is optional and available on every plan, including Free. Connect your workspace in Settings → Integrations, then choose a channel for each site in Add New Site or Edit site. Security update notices go to the chosen channels without any extra option. Email still goes out as usual; Slack is an extra destination, not a replacement.
Why someone did not get an email
Check these first:
- Their email address is not verified.
- They are not in the audience: only administrators are emailed and they have not opted in.
- They were removed from the organisation, or the site is paused or inactive.
- The finding was already emailed. Sentinel does not send the same open finding twice.
- Sentinel has not yet confirmed that the advisory affects the installed version.
Release-day alerts and weekly summaries
Release-day alerts and weekly maintenance summaries do different jobs.
| Release-day security alert | Weekly maintenance summary | |
|---|---|---|
| When | As soon as a release is confirmed to affect a site | Monday 09:00 in the organisation's time zone |
| What | The affected site and advisory | Fixes in the past week, open findings, available updates and certificates |
| Can a person turn it off? | No, for people in the audience | Yes, for their own copy |
| Set up by | On for every organisation, on every plan | An administrator enables it; paid plans only |
Use the alert to start the response and the summary to review the week.
Frequently asked questions
When do Drupal security alerts arrive in Australia?
Usually on Thursday morning, because Drupal security releases are normally published on Wednesday between 16:00 and 22:00 UTC. An alert follows once SentinelConnector confirms that a release affects one of your sites.
Source: Drupal release timing.
Can I stop receiving security alert emails?
Not while you are in the organisation's security alert audience. An administrator can limit the audience to administrators; members can then choose whether to opt in.
Do security alerts go to Slack?
Yes, when a site has a Slack channel chosen in its settings. Slack is optional and does not replace the email.
Source: Dashboard Help, Workflow integrations.
Read next: How to monitor security updates across many Drupal sites.