Skip to content

External Event Detection

Current Document Positioning

This document is the second step in the detection rule configuration process. After completing the configuration, please return to the main document to continue with the third step: Associate Incidents.

The external event detection feature is used to receive anomaly records from third-party systems. When these records are sent to the system via the preset Webhook address in the detection rule, the system automatically converts them into standard monitor events, which can be further associated with alert strategies and visualization dashboards, enabling unified monitoring management.

It is suitable for sending anomaly events or records generated by third-party systems (such as Prometheus, Zabbix, Nagios, etc.) to Guance via a specified URL address using POST requests to generate event data, achieving cross-platform unified alert management.

Application Scenarios

  • Integrate with third-party monitoring systems to aggregate scattered alerts into the Guance platform
  • Receive anomaly events from custom business systems to implement business monitoring alerts
  • Consolidate monitoring data from multi-cloud and hybrid cloud environments for unified display and analysis

Default Configuration

Basic Configuration

Configuration Item Description
Monitor Name Customize the monitor name to identify this external event detector
Webhook Address The system automatically generates a unique Webhook address by default, and supports custom appended parameters to mark the address purpose.

Format: http://<domain>/api/v1/push-events/<random_string>

The third-party system needs to send anomaly events to this address via POST requests

Advanced Configuration

Mark as Change Event: When enabled, all events reported by this monitor will be automatically treated as change events and displayed on the timeline of the corresponding entity. The system does not change the source of the events themselves, and does not affect the existing filtering and statistics logic of the event center.

Event Data Format

External event data is actively reported by the third-party system to the Guance center, providing the necessary event data. Only when the corresponding fields are detected and matched can events be generated and anomaly records be created.

Required Fields (Must contain the five fields under the event object to successfully match with the system):

Field Type Description
status string Event status, optional values: fatal, error, warning, info, ok
title string Event title, used to describe the core content of the event
message string Event details, used to describe the specific information of the event
dimension_tags object Dimension tags, used to identify the event source, e.g., {"host": "server01", "service": "nginx"}
check_value number Detection value, a numerical value used for trigger condition judgment

Optional Fields:

Field Type Description
extraData object Custom extension fields, can be used for variable substitution in event notification templates

Request Example:

{
    "event": {
        "status": "warning",
        "title": "External Event Monitor Test 1",
        "message": "Hello, this is the message of the external event monitor",
        "dimension_tags": {"heros": "caiwenji"},
        "check_value": 20
    },
    "extraData": {
        "name": "xxxxxxxx"
    }
}

For more details, refer to External Event Monitor Event Reception.

Subsequent Configuration

After completing the detection rule configuration, you also need to perform the following related settings:

  1. Associate Incidents;
  2. Alert Configuration: Select alert strategies, set notification targets and mute periods;
  3. Associate: Associate dashboards for quick navigation to view data;
  4. Permissions: Set operation permissions to control who can edit/delete this monitor;
  5. Associate Entities: After enabling "Mark as Change Event", events will be automatically associated with the entity of the corresponding name in the unified catalog. The change history can be viewed in the Timeline View under the "Events" tab on the entity details page.