Security Notifications tells the administrator of your Emby server as soon as something abnormal or security-sensitive happens: who did it, from where, why it looks suspicious and what to do about it.
What it watches
20 rules, each with its own switch, threshold and severity:
- Attacks on accounts: bursts of wrong passwords from one address, many accounts tried from the same address (password spraying), a successful sign-in after many failures, a locked account.
- Unusual sign-ins: a new country for the account or "impossible travel" (two places too far apart in too little time); an administrator signing in from a new device, a new network, from outside the local network or at an unusual hour; sign-ins from a Tor exit or a known bad network (Spamhaus DROP).
- Sensitive changes: a new administrator or sensitive rights granted, a password changed, an account deleted, an API key created or deleted, a plugin installed, updated or removed, critical settings changed (remote access, HTTPS, trusted proxies, ports, UPnP).
- Damage and abuse: mass deletion from a library, one account used from too many places at once, an active session of a disabled account.
- Signs of compromise: scans and probes (
/.env,wp-login, path traversal), spoofed proxy headers, "Forgot password" used, the known files of the May 2023 attack on Emby servers or DLLs that appear in the plugins folder without a catalog install, a server version with published vulnerabilities.
Notifications
- Channels: Telegram, e-mail (SMTP), webhook (Discord, Slack, ntfy, Gotify or plain JSON) and the Emby activity log. Each channel has its own minimum severity and a test button.
- No spam: the same alert at most once per interval, bursts grouped into one message, quiet hours (only critical alerts go out at once, the rest come in a summary at the end), optional daily digest.
- Content: what happened, which account, from where (address, country, city, network, device), why it is suspicious and what to check. Names sent by an attacker (device, app, account) are passed on as plain text.
- History of all alerts on the plugin page, with filters and CSV export.
Location and privacy
Location works without any account, from the free DB-IP Lite database (CC BY 4.0, "IP Geolocation by DB-IP"), downloaded monthly. With your own free MaxMind account the plugin can use GeoLite2 City and ASN instead. The databases are stored on your server: IP addresses are never sent to an outside lookup service. The Tor exit list and Spamhaus DROP are downloaded as lists and checked locally.
Requirements
- Emby Server 4.10.1 or newer (Linux, Windows or Docker).
- For Telegram, e-mail or webhook alerts: a Telegram bot, an SMTP server or a webhook address. The Emby activity log works without any of them.
Frequently asked
Can Emby warn me when someone tries to break into my server? Yes, with Security Notifications: repeated wrong passwords, password spraying, a sign-in after many failures, a new country or an admin signing in from a new device send you an alert on the channels you choose. See the guide.
Is this the same as Access Log? No. Access Log keeps the full history of sign-ins for you to browse; Security Notifications watches for suspicious events and changes and alerts you right away. They work well together.
Licensing
One license per Emby server. Monthly, yearly or lifetime, or included in the Bundle. Free 30-day trial.