Emby security alerts on Telegram: turn scan noise into signals you can act on

Why a public Emby server needs ears

If your Emby server answers on a public address, it is being scanned right now. Bots walk common paths, try a handful of passwords, and move on. Most of that noise is harmless, but buried in it are the few events that matter: someone spraying passwords across your accounts, a sign-in from a country you have never visited, a new administrator you did not create, or a probe for /.env.

The problem is not detection — Emby already logs a lot — it is attention. You do not want to read a log file every morning. You want a short message on your phone when something is worth a look.

That is exactly what Security Notifications does: it watches your Emby server for abnormal and security-sensitive events and sends alerts to Telegram, e-mail, a webhook or the Emby activity log. This tutorial walks through installing it, wiring up a channel, and tuning the rules so the alerts stay useful. The full reference lives in the user guide.

Prerequisites

• Emby Server 4.10.1 or newer, on Linux, Windows or Docker.
• A MediaLab Works account with an active license, a lifetime license inside its update window, or the free 30-day trial.
• One delivery channel: a Telegram bot, an SMTP server, or a webhook address (Discord, Slack, ntfy, Gotify or plain JSON). The Emby activity log works with none of these.
• Optional but recommended: a reverse proxy that forwards the real visitor address, so alerts show the attacker's IP and not your proxy's.

Step 1 — Install the plugin

1. Sign in to your MediaLab Works account, open Licenses and download the plugin DLL.
2. Copy it into the Emby plugins folder and restart Emby Server:
   • Linux (package): /var/lib/emby/plugins/
   • Docker: the plugins folder inside your Emby config volume
   • Windows: %AppData%\Emby-Server\programdata\plugins\
3. Open Security Notifications in the Emby dashboard menu, click Open License page, paste your license key and activate it — or enter your e-mail to start the trial. The license is checked once a day and at every Emby start; without internet the plugin keeps working for 7 days after the last successful check.

Without a valid license the plugin is stopped: no rule runs and no alert is sent, though your settings and history are kept.

Step 2 — Connect a channel and send a test

Open the plugin and go to the Channels tab. Every channel is off by default, and each has its own minimum severity.

Telegram. Create a bot, paste its token, send /start to the bot (or add it to a group), then click Find to fill in the chat. Use Send a test to confirm the message arrives.

E-mail. Enter recipients and your SMTP server. Port 587 with STARTTLS is recommended; port 465 with implicit TLS is not supported. If the Registration plugin is installed, you can reuse its SMTP server.

Webhook. Choose Discord, Slack, ntfy, Gotify or JSON and paste the address. For Gotify, add ?token=… to the /message address. The address contains the token and is stored apart from the settings.

Emby activity log. Alerts also appear in the dashboard's activity list — a good baseline while you tune.

Start with Telegram or e-mail at a high minimum severity, and leave the activity log on.

Step 3 — Set the location and network basics

Under Settings:

• Location: choose DB-IP Lite (free, no account), MaxMind GeoLite2 (your account id and license key) or off. Geolocation happens locally; IP addresses are never sent anywhere. Without a location source, the new-country, impossible-travel and new-network rules cannot work.
• Network: list trusted networks as CIDR — your own VPN, for example. Private networks are included automatically. Turn on The server is behind its own proxy if Emby sits behind nginx, Caddy, Traefik or similar, so forwarded headers are expected. Cloudflare is recognized by itself.
• Bad IP lists: Tor exits (refreshed hourly) and Spamhaus DROP (daily) are on by default and can be turned off.

If every alert later shows the same address, this is the setting to revisit — see the troubleshooting section.

Step 4 — Decide which rules earn an alert

The Rules tab holds 20 rules, each with its own switch, severity and, where it applies, thresholds. Think of them in four groups.

Attacks on accounts. A burst of wrong passwords from one address, many accounts tried from the same address (password spraying), a successful sign-in after many failures, a locked account. These are the classic signs that someone is guessing. The threshold is yours to set: how many wrong passwords in how many minutes.

Unusual sign-ins. A new country for the account, or impossible travel — two places too far apart in too little time. For administrators: a sign-in from a new device, a new network, from outside the local network or at an unusual hour. Also sign-ins from a Tor exit or a known bad network.

Sensitive changes. A new administrator or sensitive rights granted, a password changed, an account deleted, an API key created or deleted, a plugin installed, updated or removed, and critical settings changed (remote access, HTTPS, trusted proxies, ports, UPnP). These are quiet events, and they are exactly the ones you want to hear about.

Damage and signs of compromise. Mass deletion from a library, one account used from too many places at once, an active session of a disabled account. Scans and probes such as /.env, wp-login or path traversal, spoofed proxy headers, "Forgot password" used, the known files of the May 2023 attack on Emby servers, DLLs that appear in the plugins folder without a catalog install, and a server version with published vulnerabilities.

A practical starting point: keep the account-attack and sensitive-change rules at high severity, keep new-country and impossible-travel on once location works, and treat scan rules as informational until you know what your own traffic looks like.

Step 5 — Tune out the spam

Still on the Channels tab, the no-spam controls keep your phone quiet:

• Repeat interval — the same alert is sent at most once per interval.
• Grouping — a burst of similar events arrives as one message.
• Quiet hours — only critical alerts go out at once; the rest arrive in a summary when quiet hours end.
• Daily digest — optional, for medium and informational alerts.

Each alert tells you what happened, which account, from where (address, country, city, network, device), why it looks suspicious and what to check. Names typed by an attacker — device, app, account — are passed on as plain text, so treat them as untrusted text.

Step 6 — Read the history, adjust, repeat

The Overview tab shows recent alerts and plugin status. History lists every alert with account, address, location, device and the channels it was sent to; filter by severity, rule and period, or export to CSV. After a week, look at what fired: raise severities on rules that are pure noise for your setup, lower them on anything you would have wanted to know sooner.

Tips and troubleshooting

• Every alert shows the same address. That is your proxy or Cloudflare. Configure your reverse proxy so Emby receives the real visitor address, and turn on The server is behind its own proxy in Settings.
• No Telegram messages. Send /start to the bot again and click Find; check the channel's minimum severity.
• No location. Check the Location source in Settings; with MaxMind, check the account id and key.
• Scan detection has limits. Emby logs only some requests, so scan rules see 404s and POSTs, not every GET. Treat them as one signal among several.
• fail2ban is complementary, not redundant. Security Notifications tells you what is happening; fail2ban can act on repeated failures at the network or proxy layer. Run both: the alert tells you it is happening, the ban reduces the noise.
• Keep the activity log channel on as a local fallback, especially while you are still tuning severities.
• Updates. The License page can install an update or roll back to the previous version; restart Emby after either. See the changelog for what changed.

Conclusion

Exposing Emby to the internet is a choice many of us make; flying blind is not. With Security Notifications you get a short, readable message when someone attacks an account, signs in from somewhere unexpected, changes something sensitive or probes your server — and silence when nothing is wrong. Install it, connect one channel, start with the high-severity rules, and tune from the history. If you get stuck, the knowledge base and FAQ are a good next stop, or contact us.