Trigger management

These pages contain information about how to create, edit, and manage triggers, as well as troubleshooting information.

Note

Alternatively you can use the GraphQL API to view, create, update, manage, and delete triggers using the associated queries and mutations.

Perform activities, such as:

Use the Triggers overview page to create, edit, and manage triggers.

The sidebar shows options to navigate between Triggers and Actions. The filter buttons provide options for filtering the information on the page. Show columns allows you to customize the Triggers overview. Click +New Trigger to create a new trigger, and click ⋮ to import triggers from templates or packages.

The table lists the currently configured triggers for the selected repository or view, with information such as the trigger name, type, status of the trigger, last executed, last triggered, the status of the action attached to the trigger, and so on. Use the Show columns button to show or hide columns in the table.

Column Description
Actions Actions attached to the trigger.
Backfill limit Only for scheduled searches. See Backfill Limit.
Delay run Only for scheduled searches. See Delay run.
Labels Labels applied to the trigger.
Last executed See Last Executed and Last Triggered.
Last modified at Date and timestamp when trigger was last changed.
Last modified by User who last changed the trigger.
Last triggered See Last Executed and Last Triggered.
Max wait time Only for scheduled searches. See Max wait time.
Name Trigger name
Package Package associated with trigger
Query Trigger query
Query owned by Who owns the trigger query. If blank, the query is owned by the organization.
Status Status of the trigger. The statuses that triggers can have are: Okay, Error, Warning, Disabled, Disabled actions, or No actions assigned.
Throttle field Field name to throttle on when field-based throttling applies to the alert. For general information about throttling, see Throttling. For information about throttling for a specific alert type, see Triggers and select an alert type to learn more.
Timestamp Timestamp type used by the trigger. For general information about timestamps, see Timestamps for triggers. For information about timestamps for a specific trigger type, see Triggers and select a trigger type to learn more.
Trigger type Type of trigger.

Last Executed and Last Triggered

The Triggers overview keeps track of the end search interval for when a trigger was run, as well as when it was last run with results — thus being able to distinguish between when a trigger was executed, and the last time it had results and actually triggered an action. This information is displayed in two columns in the Triggers overview.

  • For Aggregate alerts and Scheduled searches

    Last executed indicates the end of the search interval for the last query result that was checked successfully — whether or not any results were returned.

    This means that if any error occurs with the query or the associated actions, the time shown by this field will NOT be updated. For a comprehensive list of errors and solutions for each trigger type, see Scheduled search errors and solutions, Aggregate alert errors and solutions, Filter alert errors and solutions, or Legacy alert errors and solutions.

    On the other hand, if the query result is empty, this field will be updated.

  • For Filter alerts

    Last executed indicates the last time the query result was checked.

  • For Aggregate alerts, Legacy alerts, and Scheduled searches

    Last triggered indicates the end of the search interval for the last query result that was checked successfully, and successfully triggered at least one associated action. It is not updated if the query result is empty.

  • For Filter alerts

    Last triggered indicates the latest @ingesttimestamp on the triggering events.