# Threat Detection {#threat-detection}

Threat detection is a feature that proactively investigates trace logs when a supply-chain incident occurs and notifies you of the affected jobs.

When an incident occurs, investigating its impact effectively requires a certain amount of expertise, and the response needs to be fast. With this feature, an investigation that leverages our know-how and systems is carried out promptly. You are notified of what the incident is and which CI/CD job runs are likely affected.

Receiving notifications requires setup. See [Threat Notifications](#threat-notifications) below.

## Caveats {#limitations}

The following caveats should be noted:

- **Detection is not definitive**: Threat detection results are reports of "suspicious behavior" — final judgment must be made by the user
- **Not all attacks can be detected**: Sophisticated attacks that are indistinguishable from normal build processes may not be detected

## Threat Notifications {#threat-notifications}

### Configuring Notifications {#configuring-notifications}

Configure notifications with the following steps:

1. In the Shisho Cloud console, navigate to **Runner** > **Settings** and open **Threat Notifications**.

   ![Threat notification settings](/docs/_md-assets/5dec533c85-notification-setup-email.png)

2. Turn on the **Email notifications** toggle and choose the destination address from **Target address**. If the address you want is not shown in the Target address dropdown, add it from **Settings** > **Email Allowlist** in the Shisho Cloud console. For details, see [Configuring Email Notifications](/docs/g/concepts/notification.md#configuring-email-notifications).

3. Click the **Save** button at the bottom of the screen.

Once the settings are saved, notifications will be sent when a threat is detected in your executed CI/CD jobs.

### Sending a Test Notification {#send-test-notification}

You can send a **test notification** to the configured email address to confirm that the setup is correct. The test is sent to the destination currently selected on the screen, so you can check even before saving.

1. In the **Threat Notifications** settings, click **Send test notification**.

   ![Send a test threat notification](/docs/_md-assets/e74e4e822e-notification-test-send-email.png)

2. An email is sent with the subject "[Shisho Cloud] Takumi Runner threat detection notification test".