Skip to content

Triggers

A trigger, in an alert or detection, executes an action. For example, in a detection, the trigger section can send an email when the specified activity is detected.

A trigger can:

  • Trigger an event: Send an event to Elasicsearch where it is stored as a document. Then, you can see the event as a log in the TeskaLabs LogMan.io app. You can create your own dashboard to display correlation rule detections, or find the logs in Discover.
  • Trigger a notification: Send a message via email

Trigger an event

You can trigger an event. The end result is that the trigger creates a log of the event, which you can see in TeskaLabs LogMan.io.

Item in trigger How to include 
trigger:
  - event:
In the trigger, event means that the rule will create an event based on this positive detection and send it into the data pipeline via Elasticsearch, where it is stored as a document. Then, the event comes through to TeskaLabs LogMan.io, where you can see this event in Discover and Dashboards. 
      !DICT
      type: "{str:any}"
      with:
!DICT creates a dictionary of keys (fields) and values.

type has "st:any" (meaning string) so that any type of value (numbers, words, etc) can be a value in a key-value pair.

with begins the list of key-value pairs, which you define. These are the fields and values that the event will be made of.

Following with, make a list of the key-value pairs, or fields and values, that you want in the event.

      !DICT
      type: "{str:any}"
      with:
        key.1: "value"
        key.2: "value"
        key.3: "value"
        key.4: "value"

If you're using Elasticsearch and therefore the Elastic Common Schema (ECS), you can read about standard fields in the ECS reference guide.

Trigger a notification

Notifications send messages. Currently, you can use notifications to send emails.

Learn more about writing notifications and creating email templates.