Several alert type
- Juan Tomás Alonso Nieto (Deactivated)
- Borja Moro Moreno
Overview
The method several triggers an alert when a given number of events occur within a given time period.
The threshold for this kind of alert is defined by the time period and the threshold number of events you specify. So, the alert process will maintain a count of events that meet the conditions of your query over the last time period and trigger an alert when the threshold number has been exceeded at the end of the period. The time period is rolling, which means it will restart after elapsing.
This type of alert could be useful when monitoring potentially malicious activity to be informed whenever the acceptable bound is exceeded.
What data do I need to create this alert?
To create an alert using this triggering method, you can apply filters and create new fields in your query but you cannot group events. If you grouped, this alert type will not appear for you to select in the alert definition window.
Specific settings
After selecting this type of alert, you have to define the following variables:
Period
This setting determines the duration of the intervals used by the system to check for events and trigger the corresponding alert when applicable. You can use preset periods or create custom periods:
Preset periods: click the dropdown and select the desired option (you can use the editable field to filter them).
Custom periods: click the dropdown, write the desired period in the editable field and then click the green field that appears below to confirm it. You have to introduce a valid format, otherwise you will get an error message. The accepted format consists of a number followed by a duration code without space between them:
Duration | Format | Example |
|---|---|---|
Days | (0-n)d | 1 day → 1d |
Hours | (0-24)h | 15 hours → 15h |
Minutes | (0-59)m | 45 min → 45m |
Seconds | (0-59)s | 50 seconds → 50s |
Compound: you can stack the different durations to create a compound | (0-n)d(0-24)h(0-59)m(0-59)s
| 15 hours, 45 minutes, 50 seconds → 15h45m50s |
Starting moment
The period will not start counting from the moment of the alert creation but from a fixed division that takes the Epoch reference date as the starting point (midnight Jan 1, 1970). This means that if you created an alert past the hour with a one-hour period, the first time it will be triggered (if the conditions are met) will be when the clock strikes the hour and not after 60 minutes. In other words, if you created it at 9:37, it will be triggered at 10 and not at 10:37.
The period will be adjusted according to the timezone specified in the alert definition window (more info here).
Triggering delay
An alert is only triggered after the specified period has elapsed and the system has completed the check, resulting in a slight delay between the actual occurrence and the alert generation.
Threshold
This setting specifies how many events you want to use as a limit to trigger the alert (only when a greater number of events is received, the alert will be triggered). Write the desired number.
Keep counter for each value in fields (optional)
You can specify one or more fields to keep count of their unique values to trigger the alert. Simply drag the required field(s) into the box or select them on the table and click the Add selected fields button.
This means that there will be a separate counter for each unique value and an alert will be triggered every time one of them exceeds the threshold. In case you add more than one field, the counter will consider unique value combinations instead of individual values to trigger alerts.
Let's see this in an example to better understand this option. The table below shows the events received during a period and we will use the following settings:
Threshold 5: an alert would be triggered because we have 6 events.
Threshold 5, keep counter Name: an alert would not be triggered because we have 4 events for Mike, 1 for François, and 1 for Lara; none of them above 5.
Threshold 3, keep counter Name: an alert would be triggered because we have 4 events for Mike.
Threshold 3, keep counter Name-City: an alert would not be triggered because we have 1 event for Mike-Liverpool, 3 for Mike-London, 1 for François-Paris, and 1 for Lara-Madrid, none of them above 3.
Threshold 2, keep counter Status: two alerts would be triggered because we have 3 events for online and 3 for away, both of them above 2.
Using field values in Summary and Description
You can use the $fieldName command to display in the Summary and Description fields the field values of the events that triggered the alert. This command can be employed with the names of the fields and properties below. Using a different one will not activate the command and will be interpreted as plain text.
$eventdate
$fieldName of those added to Keep counter for each value in fields.
$count: even though it is not the name of a field, it is a feature that can be used with the several alert types to display the number of events collected during the specified period.
In the following query and with the following fields added to keep counter for, you could use:
from demo.ecommerce.data
where statusCode = 404,
bytesTransferred >= 4000
$eventdate
$bytesTransferred
$timeTaken
$count
Query example
In the demo.ecommerce.data table, imagine that you want to receive an alert when you receive more than 5 events where the bytes transferred exceed 3000 and the status code is 404 in every 30 minutes period.
First of all, you need to filter your query data using the Greater than (gt, >) and Equal (eq, =) operations. Then you need to open the alert definition window, select the several type alert and fill in all the details (pay special attention to the specific settings of this alert type).
To save time, you can copy the following query to reproduce the aforementioned example from the demo.ecommerce.data sample table and create a several type alert.
from demo.ecommerce.data
where bytesTransferred > 3000,
statusCode = 404
Related Articles: