Third-party Event Check¶

Third-party Event Check is used to receive abnormal records generated by third-party systems and generate related events. By using the webhook address specified in the detection rules, monitoring event data, alert strategies, and visualization dashboards can be generated in Guance.

Use Cases¶

To generate Guance event data, send the exception events or logs generated by a third-party system to a specified URL using the POST request method to an HTTP server.

Setup¶

Step 1: Default Configuration¶

Monitor Name: Supports custom name.

Webhook Address: The webhook address is generated when entering the creation page by default. It supports customizing and appending parameter tags to the address for identification.

Third-party event data is actively reported to Guance by the external system, and the necessary event data is provided. Only when the corresponding fields are detected and matched, can events be generated and abnormal records be alerted.

Refer to the example in the following figure for the required fields: The event field must contain the five main fields to match successfully with Guance; extra_data is a custom added field:

{
    "event": {
        `status`: "warning",
        "title": "Third-party Event Monitor Test1",
        "message": "Hello, this is the message for the third-party event monitor",
        "dimension_tags": {"heros": "caiwenji"},
        "check_data": 20
    },
    "extraData": {
        "name": "xxxxxxxx"
    }
}

Step 2: Notification & Incident¶

Alert Strategy: The alert strategy configured here will be applied to all event data received by the Webhook of the current monitor. When the monitoring meets the triggering conditions, alert messages will be immediately sent to the specified notification targets. The Alert Strategy includes the event level that needs to be notified, the notification targets and the mute alerting period.

Synchronously create Issue: If abnormal events occur under this monitor, an issue for anomaly tracking will be created synchronously and delivered to the channel for anomaly tracking. You can go to Incident > Your selected Channel to view it.

Step 3: Association¶

Associate Dashboard: Every monitor supports associating with a dashboard for quick navigation and viewing.