Managing Alerts
Security Requirements and Controls
Change triggers and actionspermission
The main Alerts page shows a list of the
currently configured alerts for the selected repository or view. This
view shows the list of alerts, allows you to search configured alerts,
and manage them.
 |
Figure 156. Alerts Overview
From within this page and the list of configured alerts, you perform the following actions:
To search existing alerts, either using name or label, use the Find alert... box.
To create a new alert, click the button. For more information, see Creating Alerts.
To edit the alert, click on the alert name in the list. For more information, see Editing an Alert.
To manage an alert, click the ⋮ menu icon next to the alert name.
Figure 157. Managing Alerts
From this pop-up you can:
For more detail on monitoring the alert and execution and the list of alerts on this page, see Monitoring Alerts.
Reusing an Alert
Over time you'll find that you will have many Alerts that are similar, but with slight deviations to their underlying queries. To make it easier to create an alert that is similar to an existing one, you can duplicate it and then modify it.
To duplicate an alert:
Go to the tab to see the full list of alerts saved in that repository.
Click the ⋮ menu icon to the right of an alert and choose .
Fill in the information as required in the New alert page, then click .
You can also export an alert to use elsewhere — to reuse an alert from another repository:
Go to the tab to see the full list of alerts saved for that repository.
Click the ⋮ menu icon to the right of an alert and choose . This will generate a
yamlfile that your browser will download.Tip
You might export all of you alerts and keep a version history of changes by storing them on GitHub or elsewhere as a back-up, and to install them to your repositories from there.
If needed, edit this file with a simple text editor before using it later.
When creating a new alert, choose and select the previously saved YAML file.
Editing Alerts
To edit an existing alert:
Go to the tab to see the full list of alerts saved in that repository.
Click on the name of the alert you want to edit.
Change the properties in the Edit standard alert or Edit filter alert page.
The alert type cannot modified after the query has been created. To create an alert of a different type with the same query (providing the query is compatible), create a new alert and copy the query and actions.
When editing an existing alert, the alert query can be edited from within the
Searchinterface, by clicking the button.
Figure 158. Alert Advanced Edit
This will open the full
Searchenvironment, allowing you to select fields and refine your query.
Figure 159. Alert Query Editing
Click to cancel any edits you have made, or click to save the query. When you click you will be prompted to complete the remainder of the fields on the Alert using the same fields as in the main editing page.
When you've finished editing the alert, click on the bottom right. You will return to the page for Managing Alerts.
Disabling an Alert
There may be times when you want to disable an alert. You might do this, for instance, if you've received a notification of an alert and need time to resolve the problem. You might want to disable the alert until then, so that it won't bother you while you're working on it. You can re-enable it when you're finished.
Go to the Alerts tab and select the alert to disable, which will open the alert in edit mode.
Uncheck the Alert Enabled check box under section General. Should you want to re-enable a disabled alert, simply check the box.
Deleting an Alert
Go to the tab to see the full list of alerts saved in that repository.
Open the menu shown in Reusing an Alert and click
Confirm that you want to delete the alert.
Warning
The action cannot be undone and you cannot restore an alert.