Custom Creation¶

Go to Security Monitoring > Security Incident Management > Create to start creating.

Detection Types¶

Basic Settings¶

Detection Frequency¶

The rule will run at the time interval set here (e.g., every 5 minutes, every 1 hour). Includes the last 1 minute, last 5 minutes, last 15 minutes, last 30 minutes, last 1 hour, last 6 hours, last 12 hours, last 24 hours.

In addition to the specific options provided by the system, you can also input a custom crontab task to configure the execution of scheduled tasks based on seconds, minutes, hours, days, months, weeks, etc.

Detection Interval¶

Represents the time range for data querying each time the task is executed. The available detection intervals vary depending on the detection frequency.

Define Detection Rules¶

When defining security detection logic, you can use DQL to query data in the script and set signal trigger logic by defining conditional expressions (e.g., field matching, threshold judgment, etc.).

When writing rules independently, you can:

• Set text auto-wrap or content overflow;
• Use shortcuts for content formatting;
• Copy with one click;
• Write script content directly in the content box;
• Use fx functions;
• Test the script;
• Edit the script in full screen.

Example:

# data1,ok = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
# #data2 = dql("T::re(`.*`):(max(duration), service, span_id, status) by host limit 2")


# #result: Detection result, required, type basic type (string, integer, float)
# #result = data1.avg(duration)

# #dimension_tags: Detection object, optional, type map
# #dimension_tags = {"host":data1['series'][0][0]['tags']['host']}

# #status: Level, optional, type enum, here if defined, priority is higher than user page defined level
# #Optional values: critical, high, medium, low, info
# status = "high"

# #extra_data: Additional attributes, optional, type map
# #related_data = {"service":"wwwww"}
# #related_data = {"service":data1['series'][0][0]['columns']['service'],
#                # "span_id":data1['series'][0][0]['columns']['span_id'],
#                # "status":data1['series'][0][0]['columns']['status']}


# #fn trigger(result: int|float|bool|str, level: str = "", dim_tags: map = {}, related_data: map = {})
# #trigger(data1,status,dimension_tags,related_data)
# host = dql_series_get(data1,"host")
# service = dql_series_get(data1,"service")
# status = dql_series_get(data1,"status")
# trigger(data1,status,dimension_tags={"host":host},related_data={"service":service,"status":status})



data1 = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
status = "high"
host = dql_series_get(data1,"host")
#printf("%v", {"host": host_o})
#host_info = dql_series_get(host_o,"host")
#printf("%v", {"host": host_info})
service = dql_series_get(data1,"service")
span_id = dql_series_get(data1,"span_id")

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

In the above script example, it is mainly divided into three parts:

1. Data query: Query all metrics (re(.*)) through DQL, calculate the average value of the duration field under each host group, and return the service, span_id, status fields, limit 1 means only return 1 result;

2. Data processing:

   host = dql_series_get(data1,"host")  # Extract the `host` field from the query result
   service = dql_series_get(data1,"service") # Extract the `service` field
   span_id = dql_series_get(data1,"span_id") # Extract the `span_id` field
   

   3. Alert triggering:

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

Security Level¶

Select the security level of the current monitoring rule:

Configure Rule Description¶

When adding a detection rule, input the detection conclusion and remediation suggestions. These contents will be sent as the title and description of the alert notification.

1. Define the rule title;
2. Input the rule description.
3. Choose to add global labels to the current rule.

Alert Configuration¶

Select the existing alert strategies in the current workspace for association. After the rule is enabled, alert notifications will be triggered according to the selected alert strategies.

Permissions¶

Set view permissions for security monitoring data to enhance data security.