Security Notifications for Emby — guide

Installation

You need Emby Server 4.10.1 or newer.

Sign in to your MediaLab Works account, open Licenses and download the plugin DLL (available on an active subscription, a lifetime license within its update window, or during the free 30-day trial).
Copy the DLL into the Emby plugins folder and restart Emby Server:
- Linux (package): /var/lib/emby/plugins/
- Docker: the plugins folder inside your Emby config volume
- Windows: %AppData%\Emby-Server\programdata\plugins\
Open Security Notifications in the Emby dashboard menu and click Open License page. Paste your license key and activate it, or enter your e-mail to start the free 30-day trial or buy a license. The plugin contacts the license server, binds the key to this Emby server and shows the license as Active.

The license is checked once a day (and at every Emby start). Without internet the plugin keeps working for 7 days after the last successful check; after that it is stopped until it can check again.

License

Without a valid license the plugin is stopped: no rule is checked and no alert is sent, and only the License page keeps working (there you can start the trial, buy, enter the key or update). Your settings and the alert history are kept. Nothing is deleted: everything resumes as soon as the license is valid again.

With a valid license, the same page can install an update or roll back to the previous version if an update causes trouble. Restart Emby after either.

Configuration

Open Security Notifications in the Emby dashboard. The page has five tabs: Overview, History, Rules, Channels and Settings.

Channels: turn on the channels you want and set the minimum severity for each, then use Send a test.
- Telegram: enter the bot token, send /start to the bot (or add it to a group), then click Find to fill in the chat.
- E-mail: recipients and your SMTP server. Port 587 with STARTTLS is recommended (port 465 with implicit TLS is not supported). If Registration is installed, you can reuse its SMTP server.
- Webhook: choose Discord, Slack, ntfy, Gotify or JSON and paste the address. The address contains the token and is stored apart from the settings. For Gotify, add ?token=… to the /message address.
- Emby activity log: alerts also appear in the dashboard's activity list.
No spam (same tab): how often the same alert may repeat, the quiet hours (only critical alerts go out at once, the rest arrive in a summary when they end) and the optional daily digest for medium and informational alerts.
Rules: each of the 20 rules has a switch, a severity and, where it applies, thresholds (for example how many wrong passwords in how many minutes, the speed for impossible travel or the administrator's usual hours).
Settings:
- Location: DB-IP Lite (free, no account), MaxMind GeoLite2 (your account id and license key) or off. Without location, the new-country, impossible-travel and new-network rules do not work.
- Network: trusted networks (CIDR) treated as local, such as your own VPN. Private networks are included automatically. Turn on The server is behind its own proxy if Emby is behind nginx, Caddy, Traefik or similar, so forwarded headers are expected; Cloudflare is recognised by itself.
- Bad IP lists: Tor exits (refreshed hourly) and Spamhaus DROP (daily).

Daily use

Overview shows the recent alerts and the plugin's status.
History lists every alert with account, address, location, device and the channels it was sent to; filter by severity, rule and period, or export to CSV.
Each alert says why it is suspicious and what to check. If it was you (a new phone, a trip abroad), nothing needs to be done.

Troubleshooting

Every alert shows the same address (your proxy or Cloudflare): set up your reverse proxy so Emby receives the real visitor address, and turn on The server is behind its own proxy in Settings.
No Telegram messages: send /start to the bot again and click Find; check the minimum severity of the channel.
No location: check the Location source in Settings; with MaxMind, check the account id and key.