9.1. Manage Alert Groups
An “Alert Group” represents a type of alert. Trisul ships with 6 Alert groups
- Threshold Crossing Alerts : Based on a meter value exceeding fixed Hi and Lo water marks for a certain time
- Flow Tracking Alerts : Anomalous flow behaviour you define
- IDS Alerts : When interfacing with external IDS systems like Suricata
- Blacklist : When triggered by blacklisted indicators
- Threshold Band Alerts : When a meter value drifts outside a “trained” band of normal values
- System Alerts : From Trisul self monitoring, packet drops, memory pressure etc.
You can create your own alert types using the alertgroup LUA API Alert groups you create using the LUA API will also show up in Trisul and be managed along with the built in alert groups.
9.1.1 Viewing alert groups
To view all alert groups currently in the system.
Enable and disable alerts
You can enable or disable entire alert groups by pressing the “Enable” or “Disable” button shown on each row.
When alerts are disabled, it just means that any alerts generated by Trisul or plugins will be ignored by the streaming analytics engine. This means the alerts wont be stored, displayed, or available to your LUA plugins.
Forward alerts to syslog
Forwarding alerts to syslog is used for
- By the Trisul Email dispatching service to send alerts via email to you
- To send to other systems
For each alert type you can choose the Syslog policy by
9.1.2 Viewing and forwarding alerts
The alerts generated appear immediately on the user interface. You can also setup the following