• Services & Support
  • Devo.com
  • Contact
    • Contact Us
    • Request a Demo
    • Partner Inquiry
  • Log In
    • USA Devo
    • EU Devo
  • The Devo data operations platform
    • Deployment models
    • How Devo works
    • Key concepts
  • Getting started
    • Sign up and log in
    • Navigating the Devo app
    • User preferences
    • Devo video tutorials
  • Domain administration
    • Users and roles
      • Managing users
      • Monitoring user activity
      • Managing roles
    • User authentication
      • Multi-factor authentication
      • SAML
        • Google as an identity provider
        • Okta as an identity provider
        • OneLogin as an identity provider
    • Security credentials
    • Data processes and feeds
    • Domain preferences
  • Sending data to Devo
    • The Devo In-House Relay
      • Installing the Devo Relay
        • Install on a virtual machine
        • Install on an Ubuntu box
        • Install on a Unix-like box
      • Configuring the in-house relay
        • Customizing in-house relay settings
        • Defining relay rules
        • Managing the relay on the command line
        • Setting up high-availability
      • Relay troubleshooting tips
    • Event sources
      • Unix-like machines
        • Configuration packages for *nix
          • Ubuntu and Debian
          • Fedora and RHEL
          • CentOS V5-6
        • syslog configuration
          • rsyslog
            • Simple sending using rsyslog
            • Secure sending using rsyslog
            • Monitoring files using rsyslog
          • syslog-ng
            • Simple sending using syslog-ng
            • Secure sending using syslog-ng
            • Monitoring files using syslog-ng
          • syslog
          • SELinux configuration conflicts
      • Windows
        • Devo Agent for Windows
        • Snare Agent for Windows
        • Configuring WMI for Devo file monitoring
      • MacOS X
      • Cloud services
        • AWS S3 Buckets
        • Microsoft Azure
      • Commercial products
      • Custom apps
        • Java apps
          • JDK java.util.logging
          • Scoja client library
        • Node.js apps
        • Python apps
        • Sample code
    • Other data collection methods
      • HTTP endpoint
      • Logstash
    • Uploading log files
  • Supported technologies
    • About Devo tags
    • List of supported technologies
      • Antivirus
        • av.mcafee
      • Box (PC/Server)
        • box.iptables
        • box.stat
        • box.unix
        • box.vmware
        • box.win
      • Firewall
        • firewall.checkpoint
        • firewall.cisco
        • firewall.fortinet
        • firewall.huawei
        • firewall.juniper
        • firewall.meraki
        • firewall.paloalto
        • firewall.pfsense
        • firewall.sonicwall
        • firewall.sophos
        • firewall.stonegate
        • firewall.windows
      • Network
        • netstat.netflow
        • switch.cisco
      • Proxy
        • proxy.bluecoat
        • proxy.squid
      • Web
        • web.apache
        • web.apache.mod-security
        • web.iis
        • web.jboss
        • web.nginx
        • web.tomcat
      • Other technologies
        • db.mysql
        • dns.bind
        • my.app
        • social.salesforce
        • test.drop
        • test.keep
        • uba.varonis
        • unknown.unknown
  • Querying your data
    • Accessing data tables
      • Run a search using a finder
        • Use the default finder
        • Use a custom finder
          • Create a custom finder
          • Assign a custom finder to a role
          • Edit a custom finder
        • Use the aliased finder
          • Add a query to your aliased finder
      • Run a global search
      • Run a LINQ free text query
    • Working in the query window
      • Setting up a data table
        • Modifying the column layout
          • Arrange and resize columns
          • Hide and show columns
          • Change the position of column headers
          • Sort data
          • Setting a default table layout
        • Add a description to a data table
      • Building a query
        • Build a query using the query window tools
          • Filter data
            • Order group (filter)
            • String group (filter)
            • General group (filter)
            • Name group (filter)
            • Network group (filter)
            • Logic group (filter)
            • Web group (filter)
          • Group data
          • Aggregate data
            • Aggregation operations
          • Create columns
            • Order group
            • Arithmetic group
            • String group
            • General group
            • Date group
            • Name group
            • Network group
            • Geolocation group
            • Logic group
            • Flow group
            • Web group
            • Mathematical group
            • Conversion group
            • Cryptography group
            • Packet group
              • Ethernet operations
              • IPv4 operations
              • TCP operations
              • UDP operations
        • Build a query using LINQ
          • Filter data using LINQ
          • Group data using LINQ
          • Aggregate data using LINQ
          • Create new columns using LINQ
          • LINQ query examples
      • Generate charts
        • Affinity chord diagram
        • Availability timeline
        • Bipartite chord diagram
        • Bubble chart
        • Chart aggregation
        • Custom date chart aggregation
        • Flame graph
        • Flat world map by coordinates
        • Flat world map by country
        • Google animated heat map
        • Google area map
        • Google heat map
        • Graph diagram
          • Creating a graph diagram
          • Graph diagram menu
          • Monitor intranet traffic to dangerous websites
        • Histogram
        • Pie chart
        • Pie layered chart
        • Punch card
        • Sankey diagram
        • Scatter plot
        • Time heatmap
        • Voronoi treemap
      • Data enrichment
        • Upload a lookup table
        • Add lookup values to a data table
        • Manage lookup tables
        • Dynamic lookups
        • Threat lookups
      • Advanced data operations
        • Graphical correlation
          • Cross-Search Graph Diagram
          • Cross-Search Table Join
          • Cross-Search Sankey Diagram
          • Cross-Search Line Chart
        • Custom tables
          • Create a custom table
          • Merge a custom table with a query
          • Edit custom tables
        • Inject data to a new table
    • Managing your queries
      • Rename a query
      • Favorite queries
      • Last accessed queries
      • Check currently running queries
      • Add a description to your query
      • Block a query
      • Download a query
      • Close a query
    • Best practices for data search
  • Dashboards
    • Setup a data source
    • Create a new dashboard
    • Working with dashboard widgets
      • Availability timeline widget
      • Chord diagram widget
      • Circle world map widget
      • Color key value widget
      • Color world map widget
      • Column chart widget
      • Comparative chart widget
      • Funnel widget
      • Gauge meter widget
      • Google heatmap widget
      • Heat calendar widget
      • Line chart widget
        • Customize your Line chart
      • Monitoring widget
      • Pie chart widget
      • Punch card widget
      • Sectored pie chart widget
      • Table widget
      • Time heatmap widget
      • Tree diagram widget
      • Voronoi tree widget
    • Configuring and sharing dashboards
  • Panels
    • Using panels
    • Create and customize a panel
    • Adding an alert to a panel
    • Adding a query to a panel
  • Alerts and notifications
    • Configuring alerts
      • Create a new alert
        • Alert trigger methods
      • Set up an inactivity alert
      • Create an alert over an alert
      • Activate or deactivate an alert
      • Create a delivery method
        • Email delivery methods
        • HTTP-JSON delivery methods
        • Service Desk delivery methods
        • Jira delivery methods
        • Pushover delivery methods
        • PagerDuty delivery methods
      • Create an anti-flooding policy
      • Create a sending policy
      • Assign a sending policy to an alert
      • Make an alert available for panels
      • Modify or delete an alert
    • Managing triggered alerts
      • Add a comment to a triggered alert
      • Apply a filter for post-processing
    • Pre-installed alert reference
    • Notifications
  • Applications
    • Security Insights
      • Installing Security Insights
        • Security alerts
      • Navigating the Security Insights application
        • Overview tab
        • Threats tab
        • Network tab
        • DNS tab
        • Proxy tab
        • Firewall tab
        • Web tab
        • IDS tab
  • Social Intelligence
  • API reference
    • REST API v2
      • Authorization methods
      • How to query with API v2
        • Forwarding query responses to HDFS
        • Forwarding query responses to Kafka
        • Forwarding query responses to S3
        • Send requests with Postman
      • Job requests
    • Provisioning API
    • OData API feeds management
      • Connecting with Excel
      • Connecting with Tableau
      • Connecting with Power BI
PREVIOUS
Create a new alert
NEXT
Set up an inactivity alert

Alerts and notifications / Configuring alerts / Create a new alert / Alert trigger methods

Download as PDF

Alert trigger methods

There are several methods available for triggering alerts in Devo. Here we describe the six methods and offer examples for each.

Each

The each method triggers an alert for each new event that meets the query conditions.

To create a query that can be used to trigger a simple alert, you can apply filters to data and create new columns, but groups and aggregated values are optional.  

The threshold for this kind of alert is defined by the filters you have applied in the query. So, each time that an event is written to the data table and meets the conditions of your query, an alert will be triggered.

An example of a simple alert based on firewall log data might be to trigger an alert whenever there is a connection attempt from a blacklisted IP address. In this case, the query should be filtered to include only events where the source IP addresses are confirmed to also appear on a blacklist lookup table.

Several

The several method triggers an alert when a given number of events occur within a given time period. 

To create a query that can feed an alert using this trigger method, you can apply filters and create new columns, but do not group the table's events.

The threshold for this kind of alert is defined by the time period and the threshold number of events you specify. So, the alert process will maintain a count of events that meet the conditions of your query over the last time period and, trigger an alert with the threshold number has been exceeded. The time period is rolling, that is to say that if your chosen time period is 1 hour, the alert will maintain a running count of events over the last 60 minutes.

An example of this trigger method based on firewall log data might be to trigger an alert whenever there are more than 500 connection attempts from a single IP address within a 1-minute period. 

Low

The low method follows the same principle as the several method except that it triggers an alert when the threshold is not met.

An example might be an alert set to trigger based on heartbeat events since we want to be notified when a system is not sending it's heartbeat events when expected.

Rolling

Based on a user-defined schedule, this method triggers an alert for each event that matches the query conditions. This is essentially the same as the each method except that this alert only checks for the trigger conditions at user-specified intervals and over a configurable time period. This is useful for informative alerts and not recommended for urgent alert conditions.

An example of this kind of alert can be to check, every hour, for events in the last 30 minutes that meet the criteria of the query.

Deviation

The deviation method triggers an alert every time the aggregated value of a single grouped element is significantly higher or lower than the group's median value. 

To create a query that can be used to trigger a deviation alert, you can apply filters to data and create new columns as usual.  But you must group table events by at least two elements (usually by time, then by other table fields) and add just one aggregated value.

You can express the threshold for this kind of alert by either the absolute deviation or a percentage. So, each time that the aggregated value of a grouped element varies significantly from the median value of all the elements within the same grouping period, an alert will be triggered. 

Calculating the deviation

The following formulas describe how the absolute deviation or percentage is calculated. In both cases, i represents each of the values of the grouping period.

  • Absolute Deviation: abs(median of values in group) - value(i) > threshold
  • Percentage: abs(median of values in group) - value(i) > threshold / 100 * median of values in group

Let's use an example. Say we want to trigger an alert when the response time of a server within a balanced architecture is significantly higher (or lower) than the average. In this example, we group the events by a time period and server name, then add the aggregated value of average response time.

Gradient

The gradient method triggers an alert every time the aggregated value of a grouped element varies significantly from one grouping period/set to the next.

To create a query that can use the gradient trigger method, apply filters to the data and create new columns as needed.  But you must group table events by at least two elements (usually by time, then by other table fields) and add just one aggregated value.

You can express the threshold for this kind of alert by either the absolute deviation or a percentage. So each time that the aggregated value of a grouped element varies significantly from one grouping period to the next, an alert will be triggered.

Calculating the gradient

The following formulas describe how the absolute deviation or percentage is calculated.

  • Absolute Deviation: abs(current value - previous value) > threshold
  • Percentage: abs(current value - previous value) > threshold / 100 * previous value

Let's use an example. Say we want to be alerted when the average response time of any server is significantly longer or shorter than in the previous grouped period. As is the previous example, we group the query data by a time period and server name, then add the aggregated value of average response time. 

Download as PDF

Did you find what you were looking for?

If not, please let us know what you need. Your feedback will help us to improve.

PREVIOUS
Create a new alert
NEXT
Set up an inactivity alert

Export

See what Devo can do for you. Request a demo!
Discover what's new (Release notes)
  • Services & Support
  • Devo.com
  • Contact
    • Contact Us
    • Request a Demo
    • Partner Inquiry
  • Log In
    • USA Devo
    • EU Devo
  • +1 888 6830910 (USA)
  • +34 900 838 880 (Spain)
Copyright © 2019 Legal Terms Privacy Policy Cookies Policy

Powered by Confluence and Scroll Viewport