Custom Script Detection¶

Write scripts to define detection rules and cover detection needs for various system data types. DQL is supported for querying data, and signal triggering logic can be set through custom logic (such as field matching, threshold evaluation, etc.) to implement flexible monitoring and alerting policies.

Detection Configuration¶

Detection Frequency¶

Set the time period for executing detection.

• Preset options: 30 seconds, 1 minute, 5 minutes (default), 15 minutes, 30 minutes, 1 hour

• Crontab mode: click "Switch to Crontab Mode" to configure a custom schedule, supporting scheduled task execution based on periods such as seconds, minutes, hours, days, months, and weeks.

Detection Range¶

Set the data time range queried by each detection. (❗️ If the DQL query in the detection rule specifies a time range, the system will prioritize the time range defined in the rule.)

• Custom format: enter a custom detection range, for example: 20m (last 20 minutes), 2h (last 2 hours), 1d (last 1 day).

Define Detection Rules¶

Define security detection logic by writing scripts. DQL can be used to query data in scripts, and signal triggering logic can be set through conditional expressions (such as field matching, threshold evaluation, etc.).

Editor Features¶

Script Example¶

Example:

data1 = dql("T::re(`.*`):(avg(duration), service, span_id) by host limit 1")
status = "high"
host = dql_series_get(data1,"host")
service = dql_series_get(data1,"service")
trigger(data1,status,dimension_tags={"host":host},related_data={"service":service})

The script example above is mainly divided into the following parts:

1. Execute a data query to find, from all services, the performance data with the worst average response time on each host;

2. Set the alert level: priority is high;

3. Locate the data source:

   host = dql_series_get(data1,"host")  # Extract the faulty host
   service = dql_series_get(data1,"service")  # Extract the problematic service
   

4. Finally, generate the alert: Service {service} on host {host} has abnormal response time

Next Steps¶

After completing the detection configuration above, continue with:

1. Event Notification: define the event title, content, notified members, data gap handling, and associated incidents;

2. Alert Configuration: select an alert policy, set notification targets and mute periods;

3. Link: associate dashboards for quick navigation and data viewing;

4. Permissions: set operation permissions to control who can edit/delete this monitor.