Working with alerts

Viewing alerts

Generated alerts are displayed on the Audit Store Dashboards. View and acknowledge the alerts from the alerting dashboard by navigating to OpenSearch Plugins > Alerting > Alerts. The alerting dashboard is shown in the following figure.

Destinations for alerts are moved to channels in Notifications. For more information about working with Monitors, Alerts, and Notifications, refer to the section Monitors in https://opensearch.org/docs/latest/dashboards/.

Creating notifications

Create notification channels to receive alerts as per individual requirements. The alerts are sent to the destination specified in the channel.

Creating a custom webhook notification

A webhook notification sends the alerts generated by a monitor to a destination, such as, a web page.

Perform the following steps to configure the notification channel for generating webhook alerts:

1. Log in to the ESA Web UI.

2. Navigate to Audit Store > Dashboard.

   The Audit Store Dashboards appears. If a new tab does not automatically open, click Open in a new tab.

3. From the menu, navigate to Management > Notifications > Channels.

4. Click Create channel.

5. Specify the following information under Name and description.

   • Name: Http_webhook
   • Description: For generating http webhook alerts.

6. Specify the following information under Configurations.

   • Channel type: Custom webhook
   • Method: POST
   • Define endpoints by: Webhook URL
   • Webhook URL: Specify the URL that receives the alert. For example https://webhook.site/9385a259-3b82-4e99-ad1e-1eb875f00734.
   • Webhook headers: Specify the key value pairs for the webhook.

7. Click Send test message to send a message to the email recipients.

8. Click Create to create the channel.

   The webhook is set up successfully.

9. Proceed to create a monitor and attach the channel created using the steps from Creating the monitor.

Creating email alerts using custom webhook

An email notification sends alerts generated by a monitor to an email address. It is also possible to configure the SMTP channel for sending an email alert. It is recommended to send email alerts using custom webhooks, which offers added security. The email alerts can be encrypted or non-encrypted. Accordingly, the required SMTP settings for email notifications must be configured on the ESA.

• Non-Secure alerts using ESA SMTP settings
• Secure alerts using ESA SMTP settings with certificates

Creating an email notification

Perform the following steps to configure the notification channel for generating email alerts:

1. Log in to the ESA Web UI.

2. Navigate to Audit Store > Dashboard.

   The Audit Store Dashboards appears. If a new tab does not automatically open, click Open in a new tab.

3. From the menu, navigate to Management > Notifications > Channels.

4. Click Create channel.

5. Specify the following information under Name and description.

   • Name: Email_alert
   • Description: For generating email alerts.

6. Specify the following information under Configurations.

   • Channel type: Email
   • Sender type: SMTP sender
   • Default recipients: Specify the list of email addresses for receiving the alerts.

7. Click Create SMTP sender and add the following parameters.

   • Sender name: Specify a descriptive name for sender.
   • Email address: Specify the email address that must receive the alerts.
   • Host: Specify the host name of the email server.
   • Port: 25
   • Encryption method: None

8. Click Create.

9. Click Send test message to send a message to the email recipients.

10. Click Create to create the channel.

    The email alert is set up successfully.

11. Proceed to create a monitor and attach the channel created using the steps from Creating the monitor.

Creating the monitor

A monitor tracks the system and sends an alert when a trigger is activated. Triggers cause actions to occur when certain criteria are met. Those criteria are set when a trigger is created. For more information about monitors, actions, and triggers, refer to Alerting.

Perform the following steps to create a monitor. The configuration specified here is just an example. For real use, create whatever configuration is needed, per individual requirements:

1. Ensure that a notification is created using the steps from Creating notifications.

2. From the menu, navigate to OpenSearch Plugins > Alerting > Monitors.

3. Click Create Monitor.

4. Specify a name for the monitor.

5. For the Monitor defining method, select Extraction query editor.

6. For the Schedule, select 30 Minutes.

7. For the Index, select the required index.

8. Specify the following query for the monitor. Modify the query as per the requirement.

   {
       "size": 0,
       "query": {
           "match_all": {
               "boost": 1
           }
       }
   }
   

9. Click Add trigger and specify the information provided here.

   1. Specify a trigger name.

   2. Specify a severity level.

   3. Specify the following code for the trigger condition:

      ctx.results[0].hits.total.value > 0
      

10. Click Add action.

11. From the Channels list, select the required channel.

12. Add the following code in the Message field. The default message displayed might not be formatted properly. Update the message by replacing the Line spaces with the n escape code. The message value is a JSON value, use escape characters to structure the email properly using valid JSON syntax.

```
{
"message": "Please investigate the issue.\n  - Trigger: {{ctx.trigger.name}}\n  - Severity: {{ctx.trigger.severity}}\n  - Period start: {{ctx.periodStart}}\n  - Period end: {{ctx.periodEnd}}",
"subject": "Monitor {{ctx.monitor.name}} just entered alert status"
}
```
>   The **message** value is a JSON value. Be sure to use escape characters to structure the email properly using valid JSON syntax. The default message displayed might not be formatted properly. Update the message by replacing the Line spaces with the **\\n** escape code.

13. Select the Preview message check box to view the formatted email message.
14. Click Send test message and verify the recipient’s inbox for the message.
15. Click Save to update the configuration.

• ←Previous
• Next→