Several alert type

Overview

The several method triggers an alert when a given number of events occur within a given time period. 

The threshold for this kind of alert is defined by the time period and the threshold number of events you specify. So, the alert process will maintain a count of events that meet the conditions of your query over the last time period and trigger an alert when the threshold number has been reached at the end of the period. The time period is rolling, that is to say, that if your chosen time period is 1 hour, the alert will maintain a running count of events over 60 minutes and it will restart after that time.

This type of alert could be useful when monitoring potentially malicious activity to be informed whenever the acceptable bound is exceeded.

What data do I need to create this alert?

To create an alert using this triggering method, you can apply filters and create new columns in your query but you cannot group events. If you grouped, this alert type will not appear for you to select in the alert definition window.

Configuring the alert

After selecting this type of alert, you have to define the following variables:

1. Period: specifies how frequently you want the system to check for events matching the conditions of your query. You can use preset periods or create custom periods:
   • Preset periods: click the dropdown and select the desired option (you can use the editable field to filter them).

   • Custom periods: click the dropdown, write the desired period in the editable field and then click the green field that appears below to confirm it. You have to introduce a valid format, otherwise you will get an error message. The accepted format consists of a number followed by a duration code without space between them:

     Duration	Format	Example
     Days	(0-n)d	1 day → 1d
     Hours	(0-24)h	15 hours → 15h
     Minutes	(0-59)m	45 min → 45m
     Seconds	(0-59)s	50 seconds → 50s
     You can stack them to create a compound → 15h45m50s

     The period will not start counting from the moment of the alert creation but from a fixed division that takes the Epoch reference date as the starting point (midnight Jan 1, 1970). This means that if you created an alert past the hour with a one-hour period, the first time it will be triggered (if the conditions are met) will be when the clock strikes the hour and not after 60 minutes. In other words, if you created it at 9:37, it will be triggered at 10 and not at 10:37

     The period will be adjusted according to the timezone specified in the delivery method assigned to the alert. To know more about this check the Manage delivery methods article.

2. Threshold: specifies how many events you want to use as a limit to trigger the alert. Write the desired number.
3. Keep counter for each value in columns (optional): specifies the columns whose values will be used to trigger the alert in case you want to use unique values. Drag the required column(s) into the Keep counter for each value in columns area or select them on the table and click the Add selected columns button.
   
   
   
   Use this setting if you want to trigger an alert when one of the unique values in one or several columns is repeated a certain number of times. In case you add more than one column, you will get an alert when one of the combinations of values in all columns occurs more times than the specified threshold. For example, you may need to receive an alert when any user logs in to the platform more than 5 times within a 10-minute period. In this case, we don't want to consider the total count of logins but the count of logins per user. Or maybe you need to receive an alert when any user performs the same action 5 times within a 10-minute period. In this case, we want to consider the count per user-action combination.

Using column values in Summary and Description

The $columnName command used to display column values in the Summary and Description fields can be employed with the columns and properties below. Using a different one will not activate the command and will be interpreted as plain text.

Query example

In the demo.ecommerce.data table, imagine that you want to receive an alert when you receive more than 5 events where the bytes transferred exceed 3000 and the status code is 404 in every 30 minutes period.

First of all, you need to filter your query data using the Greater than (gt, >) and Equal (eq, =) operations. Then you need to open the alert definition window, select the several type alert and fill in all the details (pay special attention to the specific settings of this alert type).

To save time, you can copy the following query to reproduce the aforementioned example from the demo.ecommerce.data sample table and create a several type alert.

from demo.ecommerce.data
where bytesTransferred > 3000,
statusCode = 404

Related Articles:

• Alert trigger methods
• Creating new alerts
• Configuring alerts
• Managing triggered alerts