Triggers
With the use of triggers, AccuKnox can send alerts to third-party SIEM (security information and event management) platforms and logging tools like Slack, Splunk, Elastic Search, Cloud Watch, and Jira.
How to create a new trigger?¶
-
After choosing specific log filter from the Logs Screen, click on
Create Trigger
button. You can either click elements directly from the log events list, search for elements directly in the filter, or use Search Filters to choose a specific log filter -
Configure the required options:
Name: Define an alert trigger name.
When to initiate this trigger: Set the frequency of the trigger. You have four options to select, (1) Runtime as it happens (2) Once a day (3) Once a week (4) Once a month
Define Threat Level: Define the threat level for the trigger. You have three options (1) High (2) Medium (3) Low
Selected Filter: The chosen log filter from step 1 is populated here. You can shift to predefined filters from here also.
Notification channel: Choose the notification channel that should receive the alerts.
Note: Before selecting the notification channel, you should complete the channel integration for this channel. Review the Channel Integration for more context. Channel Integration Guide
- Click
Save
button to store the trigger in database.
Manage Triggers¶
Triggers can be managed individually, or as a group, by using the checkboxes on the left side of the Trigger UI. Select individual/group of triggers and perform actions, such as enabling, disabling, or deleting.
View Trigger Details¶
To view Trigger alert details, click the Details
of corresponding Tigger alert row. This will give query info of the selected trigger additionally.
Enable/Disable Triggers¶
Alerts can be enabled or disabled using the slider or the actions drop-down menu. You can perform these operations on a single trigger or on multiple triggers
-
From the Triggers UI, check the boxes beside the relevant triggers.
-
Click
Actions
drop-down -
Click Enable or Disable as necessary.
Use the slider beside the trigger to disable or enable individual triggers
Edit an Existing Trigger¶
To edit an existing Tigger alert:
-
click
Edit
from the right cornerMore options
icon of the corresponding trigger alert -
Edit the trigger, and click
Save
to confirm the changes.
Duplicate a Trigger¶
Triggers can be duplicated so that similar triggers can be created quickly.
-
Click
Duplicate
from the right cornerMore options
icon of the corresponding trigger alert -
Make necessary changes and
save
the trigger.
Delete Trigger¶
Open the Triggers page and use one of the following methods to delete triggers:
You can perform delete operation on a single trigger or on multiple triggers
-
From the Triggers UI, check the boxes beside the relevant triggers.
-
Click
Actions
drop-down -
Click
Delete
Click Delete
from the right corner More options
icon of the corresponding trigger to delete individual trigger