External Event Detection¶

External event detection is used to receive anomaly records generated by third-party systems and produce relevant events. Through the standard Webhook address in the detection rule, it generates corresponding monitoring event data and associated alert strategies as well as visual dashboards in Guance.

Use Cases¶

Anomaly events or records generated by third-party systems are sent via a POST request to an HTTP server using a specified URL address, generating event data for Guance.

Default Configuration¶

1. Monitor Name: Supports custom names.

2. Webhook Address: A Webhook address is generated by default when entering the creation page, and you can customize additional parameters to mark the purpose of the address.

External event data is proactively reported to the Guance center by the third-party system and provides necessary event data. Only after detecting and matching the corresponding fields can events be generated and anomalies recorded for alerts.

The required fields can be seen in the example below: The five fields under event must be included to successfully match with Guance; extra_data represents the custom-added fields:

{
    "event": {
        "status": "warning",
        "title": "External Event Monitor Test 1",
        "message": "Hello, this is the message from the external event monitor",
        "dimension_tags": {"heros": "caiwenji"},
        "check_value": 20
    },
    "extraData": {
        "name": "xxxxxxxx"
    }
}

For more details, refer to External Event Monitor Event Reception.

Other Configurations¶

For more details, refer to Rule Configuration.