Simple Each alert

DevoSource

This unit will launch a query and send its results to the indicated outputs. In this case, we want to query the Devo table that stores all the domain's users activity (siem.logtrust.web.activity).

Drag a DevoSource unit to the canvas and open its configuration options by double-clicking it.

Enter a Name for the unit (in this example, GetWebActivity), and in the Query field, enter the query from which you want to get data. In this example, we will use the following:

from siem.logtrust.web.activity
select *

Also, you can optionally choose a Start time for the query. In this case, we enter 03/31/20 00:00:00

Click Apply to save the configuration.

Filter

We will use this unit to filter the events that come from the indicated table and get only those that include actions taken by a specific user in our domain.

Drag a Filter unit to the canvas and link the output port data of the DevoSource unit to the input port of this unit.

Then, open the configuration options of the unit by double-clicking it. Enter a Name for the unit (in this example, GetUsername), and in the Predicate field, we enter the conditions for the filter. In this case, we want to get only entries for a specific user, so we indicate his email address. Also, we will get rid of null values. This is the expression that we will use:

username != null && username.equals("email_address")

Click Apply to save the configuration.

Reducer

This unit applies the reduce function to the events sent by the source query. In this case, it will add a  count of all the events that match the condition of the filter applied.

Drag a Reducer unit to the canvas and link the output port out of the Filter unit to the input port in of this unit.

Then, open the configuration options of the unit by double-clicking it. Fill the following fields with these values:

• Name - Enter a name for the unit (in this example, reducerCount).

• InitValue - Expression that determines the initial value of the reducer. In this example, we enter 0L.

• Field name - Enter a name for the field that will be added to the events with the reducer results. In this case, we will name it counter.

• Accumulator Type - The expected data type of the values generated by the reducer. In this case, we select Long.

• Expression - Groovy expression that will determine the behavior of the reducer. In this case, we will add the following expression to get the count of occurrences:
  _acc_ +1

Click Apply to save the configuration.

Filter

This unit will filter only those events where the counter value added by the Reducer is 1000 or more.

Drag a Filter unit to the canvas and link the output port out of the Reducer unit to the input port of this unit.

Then, open the configuration options of the unit by double-clicking it. Enter a Name for the unit (in this example, Counter1000), and in the Predicate field, we enter the conditions for the filter. In this case, we want to get only those events where the counter field shows a value equal to or higher than 1000. This is the expression that we will use:
counter %% 1000 == 0

Click Apply to save the configuration.

EmailSink

This unit will send the results to an indicated email address.

Drag an EmailSink unit to the canvas and link the output port out of the Filter unit to the input port of this unit.

Then, open the configuration options of the unit by double-clicking it. In the General tab, add a Name to the unit (in this example, we called it toMail), the Subject of the mails that will be sent (in this example, User activity > 1000) and the Message to be sent. This is the message that we used in this example, referencing the counter column:

The alert has been fired %%﹛counter﹜times

Now go to the To recipients tab, click the + icon in the TOs section, and enter the email addresses you want to send the mails.

Click Apply to save the configuration.

SlackSink

the Slack Sink unit sends a Slack message to a configurable channel. 

Drag a SlackSink unit to the canvas and link the output port out of the same Filter unit used before with EmailSink to the input port of the SlackSink unit.

Then, open the configuration options of the unit by double-clicking it and enter the following information:

• Name - Add a name to the unit (in this example, we called it toSlack).

• Message - This is the message that will be sent to the specified Slack channel. In this example, we will include the following message, referencing the counter column:
  The alert has been fired %%﹛counter﹜times

• Slack WebHook - Enter the Slack Webhook that references the required Slack workspace and channel where the messages will be sent. Learn more about Slack Webhooks and how to use them here.

Click Apply to save the configuration.