Problem

Notifications in Everbridge Suite can be stopped before they are delivered when the message content triggers keyword-based security filters. This can occur when:

• The message contains a URL redirect.
• The content includes a keyword or phrase that matches configured keyword filtering rules.
• The content includes terms that are treated as potentially high risk and therefore blocked by security filters.

When this happens, a notification is blocked and is not sent to recipients.

Root Cause

Everbridge may block notifications based on content filtering mechanisms designed to reduce potential security risks or inappropriate content. These mechanisms evaluate message content and can automatically stop notifications when certain conditions are met.

There are two primary root causes described:

• URL redirect patterns: A notification can be blocked by a keyword-match alert when the message contains a URL redirect. Using indirect URL links, such as redirects, may trigger system security measures. In these situations, the presence of the URL redirect is the reason the notification is blocked.
• Flagged keywords and phrases: Everbridge may block notifications that contain certain keywords or phrases that trigger security filters. When a message contains a flagged keyword that matches the system's keyword filtering rules, the notification can be blocked from processing. The platform may treat these words as potentially high risk and prevent the message from being sent.

A “Notification Blocked - Keyword Match Alert” indicates that the notification matched a configured keyword. The alert identifies the matching keyword and provides metadata about the blocked notification so recipients can review the event.

Solution

To resolve a notification blocked due to a keyword match or URL redirect, adjust the notification content so that it no longer matches the configured filters, and provide clear information for review.

Review and adjust message content

• Identify whether the notification contains URL redirects. If the message includes indirect URL links (such as redirects), recognize that these may trigger keyword-match security measures.
• Use direct, main URLs instead of intermediate redirects. To help ensure successful notification delivery, replace problematic URL redirects with direct links to the intended destination.
• Review the notification for flagged keywords or phrases. If a notification is blocked, verify whether the content includes terms that match the platform's keyword filtering rules.
• Remove the blocked keyword from the message content. Work with the sender or message owner to edit the message so that the flagged keyword or phrase is no longer present.
• Use alternative wording if necessary. When a specific word is known to trigger the filter, rephrase the message content to avoid that term while maintaining the intended meaning.

Communicate details about the blocked notification

• When notifying stakeholders that a message was blocked, clearly state that the notification was blocked due to a keyword match and specify whether the reason was a URL redirect or a particular keyword.
• Provide identifying details related to the blocked notification, such as the notification ID(s) and the organization name/ID, so that the event can be easily referenced and reviewed.

Coordinate with security or InfoSec teams

• If a particular keyword is required for business communication, organizations have two practical options:
• Option 1: Continue using alternative wording in notifications so that the blocked keyword is avoided.
• Option 2: Request that the security or InfoSec team allow that keyword for the organization. When making this request, provide the organization details and the specific keyword so the team can evaluate it and, if appropriate, allow it for the organization.

Workaround

If an organization cannot immediately change its security policies or obtain approval to allow a specific keyword, the following approach can be used as an alternative:

• Edit the notification content to remove the flagged keyword and any problematic URL redirects.
• Use direct URLs and substitute terms that do not trigger the keyword filters.
• Resend the adjusted notification so that it complies with the existing keyword filtering rules.

This approach enables notifications to be sent while longer-term decisions about keyword allowances or policy adjustments are being considered.