Custom Creation¶

Go to Security Monitoring > Security Incident Management > Create to start creating.

Detection Type¶

Basic Settings¶

Detection Frequency¶

The rule runs at the interval set here (e.g., every 5 minutes, every 1 hour). Options include last 1 minute, last 5 minutes, last 15 minutes, last 30 minutes, last 1 hour, last 6 hours, last 12 hours, last 24 hours.

In addition to the specific options provided by the system, you can also enter a custom crontab task to configure scheduled task execution based on cycles such as seconds, minutes, hours, days, months, weeks.

Detection Interval¶

Represents the time range for data query each time the task is executed. The available detection intervals vary depending on the detection frequency.

Define Detection Rule¶

When defining security detection logic, you can use DQL to query data in the script and set signal triggering logic by defining conditional expressions (e.g., field matching, threshold judgment, etc.).

When writing rules independently, you can:

• Set text auto-wrap or content overflow;
• Use shortcuts for formatting;
• Copy with one click;
• Write script content directly in the content box;
• Use fx functions;
• Test scripts;
• Edit scripts in full screen.

Example:

# data1,ok = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
# #data2 = dql("T::re(`.*`):(max(duration), service, span_id, status) by host limit 2")


# #result:Detection result, required, type basic type (string, integer, float)
# #result = data1.avg(duration)

# #dimension_tags:Detection object, optional, type map
# #dimension_tags = {"host":data1['series'][0][0]['tags']['host']}

# #status:Level, optional, type enum, if defined here, priority overrides user page defined level
# #Optional values: critical, high, medium, low, info
# status = "high"

# #extra_data:Additional attributes, optional, type map
# #related_data = {"service":"wwwww"}
# #related_data = {"service":data1['series'][0][0]['columns']['service'],
#                # "span_id":data1['series'][0][0]['columns']['span_id'],
#                # "status":data1['series'][0][0]['columns']['status']}


# #fn trigger(result: int|float|bool|str, level: str = "", dim_tags: map = {}, related_data: map = {})
# #trigger(data1,status,dimension_tags,related_data)
# host = dql_series_get(data1,"host")
# service = dql_series_get(data1,"service")
# status = dql_series_get(data1,"status")
# trigger(data1,status,dimension_tags={"host":host},related_data={"service":service,"status":status})



data1 = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
status = "high"
host = dql_series_get(data1,"host")
#printf("%v", {"host": host_o})
#host_info = dql_series_get(host_o,"host")
#printf("%v", {"host": host_info})
service = dql_series_get(data1,"service")
span_id = dql_series_get(data1,"span_id")

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

In the script example above, it is mainly divided into three parts:

1. Data Query: Query all metrics (re(.*)) via DQL, calculate the average value of the duration field for each host group, and return the service, span_id, status fields. limit 1 means only one result is returned;

2. Data Processing:

   host = dql_series_get(data1,"host")  # Extract the `host` field from the query result
   service = dql_series_get(data1,"service") # Extract the `service` field
   span_id = dql_series_get(data1,"span_id") # Extract the `span_id` field
   

3. Alert Triggering:

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

Indicates triggering an alert with a priority of high. dimension_tags identifies the detection object (here using host as the dimension tag), and related_data attaches associated data (service and span_id).

Security Level¶

Select the security level for the current monitoring rule:

Configure Rule Description¶

When adding a detection rule, input the detection conclusion and remediation suggestions. These will be sent as the title and description of the alert notification.

1. Define the rule title;
2. Input the rule description.
3. Choose to add global labels for the current rule.

Alert Configuration¶

Associate with existing alert strategies within the current workspace. After the rule is enabled, alert notifications will be triggered based on the selected alert strategy.

Permissions¶

Set view permissions for security monitoring data to enhance data security.