Overview

Webex emergency alerts send an email to one or more people when a Webex Calling user dials emergency services (911, 112, 999 and so on). Alerts are routed by Webex location, so for example every emergency call placed from the Denver office can notify the Denver facilities manager, while a default address receives every alert from every location.

How an alert happens:

1. A Webex Calling user dials emergency services.
2. The call ends. About five minutes later, Webex publishes the call record and marks its call type as SIP_EMERGENCY.
3. VoIP Detective's next Webex import (every five minutes on a PRO license) collects the record.
4. VoIP Detective recognises the emergency call type, works out who should be notified for that location, and emails them.
5. The call is written to the emergency call history and the emergency call log, and forwarded to your syslog server if one is configured.

No dialed-number configuration is needed. Unlike the CUCM alerts, you do not maintain a list of emergency numbers or prefixes. Webex classifies emergency calls itself according to the emergency dialing rules of each location's country, and VoIP Detective relies on that classification.

Webex writes one call record per phone or app involved in a call. VoIP Detective groups those records and sends one alert per call, not one per device.

Requirements

• VoIP Detective PRO license.
• Webex call reporting enabled and importing call records.
• Email configured and enabled under Administration -> Mail settings (SMTP or Microsoft 365 OAuth2). If mail is disabled, emergency calls are still recorded in the history and log, but no email is sent.

Opening the page

From the Administration menu, choose Webex Emergency Alerts. The page is available to administrators only. If Webex call reporting is disabled, the page says so and nothing else is shown.

Settings

Each address receives its own email. If the same address appears in the default list and in a location alert, it is emailed once.

Webex locations

Alerts are matched on the Webex location name, exactly as it appears in Control Hub. VoIP Detective reads the list of Webex Calling locations from Webex once a day. The Webex Locations card shows how many locations are known and when the list was last refreshed.

Refresh locations now. If you have added or renamed a location in Control Hub, press this button. The refresh runs as a background job; a progress bar appears at the top of the page and shows the result when it finishes, usually within a minute or two.

Creating a per-location alert

Below the alert table, fill in the three fields and press Add:

There is no limit on the number of alerts, and several alerts may point at the same location. When an emergency call is placed, every alert whose location matches (plus every "any location" alert, plus the default address) is notified.

Editing and deleting

• Edit (pencil) opens a popup where the location, addresses and description can be changed.
• Delete (bin) removes the alert after a confirmation. This cannot be undone.
• The default alert address is shown as the first row of the table and is edited in the Settings card above.

Testing an alert

Every row in the alert table, including the default row, has an envelope button. Pressing it sends a test email for that row's location to everyone who would be notified for a real emergency call from that location - the default address plus every alert matching the location. A confirmation popup appears first.

• The test email has [TEST] in the subject and a notice at the top saying who sent it and that no emergency call was placed.
• The test does not create a call record, does not appear in the emergency call history, does not update "last triggered", and does not go to the emergency log or syslog.
• If no one would be notified for that location (no default address and no matching alert), the test tells you so instead of sending.
• If the email cannot be sent, the test reports the failure; details are in Administration -> Logs -> error log.

What the alert email contains

The email is plain text and lists everything VoIP Detective knows about the call from the Webex record:

• User name and user number
• Calling number, called number and dialed digits
• Webex location
• Time of call and release time, each shown in your local time zone and in UTC
• Duration and ring duration
• Answer indicator, call outcome and who hung up
• Device type and device MAC address
• Correlation ID and call ID (useful when searching the Webex call records)
• Which alert rules matched, and the "not for dispatch" notice

History and logs

Emergency call history. The bottom of the page lists the most recent Webex emergency calls that were detected, when they were placed, from which location and device, and who was notified. Hover over a time to see it in UTC. History is kept for 90 days.

Emergency call log. Every detected call is also written to the emergency call log (Administration -> Logs), the same log used by the CUCM emergency alerts. Each Webex entry begins "Webex emergency call from ..." and includes the full text of the email that was sent.

Syslog. If a syslog server is configured, emergency entries are forwarded under the "emergency" category, so a SIEM can alert on them in real time.

Tips and tricks

• Set the default address to a shared mailbox or distribution list that is always monitored, then add per-location alerts for the people who should respond locally.
• Use the envelope button after any change to addresses to confirm mail is flowing before you need it.
• If an alert shows a warning triangle next to its location, the location has been renamed or removed in Control Hub. Edit the alert and choose the current name.
• The history table only shows calls detected after the feature was enabled. Calls that were already in the database when you switched it on are deliberately ignored, so enabling the feature never sends a flood of old alerts.

Troubleshooting