Create¶

Go to Security Monitoring > Security Incidents > Create to start creating.

Detection Type¶

Basic Settings¶

Detection Frequency¶

The rule runs at the interval set here (e.g., every 5 minutes, every 1 hour). The available options are: Last 1 minute, Last 5 minutes, Last 15 minutes, Last 30 minutes, Last 1 hour, Last 6 hours, Last 12 hours, Last 24 hours.

In addition to these predefined options, you can enter a custom crontab schedule to configure the execution cycle based on seconds, minutes, hours, days, months, weeks, etc.

Detection Range¶

The time range for data query each time the task runs. The available detection ranges vary depending on the detection frequency.

Define Detection Rules¶

When defining security detection logic, you can use DQL to query data in the script and set signal trigger logic by defining conditional expressions (e.g., field matching, threshold judgment, etc.).

When writing rules manually, you can:

• Toggle text wrapping or overflow;
• Use shortcuts to format content;
• Copy with one click;
• Write script content directly in the editor;
• Use fx functions;
• Test the script;
• Edit the script in full screen.

Example:

# data1,ok = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
# #data2 = dql("T::re(`.*`):(max(duration), service, span_id, status) by host limit 2")


# #result: detection result, required, type: basic type (string, integer, float)
# #result = data1.avg(duration)

# #dimension_tags: detection object, optional, type: map
# #dimension_tags = {"host":data1['series'][0][0]['tags']['host']}

# #status: severity, optional, type: enum. If defined here, takes precedence over the severity defined on the UI page.
# #Available values: critical, high, medium, low, info
# status = "high"

# #extra_data: additional attributes, optional, type: map
# #related_data = {"service":"wwwww"}
# #related_data = {"service":data1['series'][0][0]['columns']['service'],
#                # "span_id":data1['series'][0][0]['columns']['span_id'],
#                # "status":data1['series'][0][0]['columns']['status']}


# #fn trigger(result: int|float|bool|str, level: str = "", dim_tags: map = {}, related_data: map = {})
# #trigger(data1,status,dimension_tags,related_data)
# host = dql_series_get(data1,"host")
# service = dql_series_get(data1,"service")
# status = dql_series_get(data1,"status")
# trigger(data1,status,dimension_tags={"host":host},related_data={"service":service,"status":status})



data1 = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
status = "high"
host = dql_series_get(data1,"host")
#printf("%v", {"host": host_o})
#host_info = dql_series_get(host_o,"host")
#printf("%v", {"host": host_info})
service = dql_series_get(data1,"service")
span_id = dql_series_get(data1,"span_id")

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

The script example above consists of three main parts:

1. Data Query: Use DQL to query all metrics (re(.*)), calculate the average value of the duration field for each host group, and return the service, span_id, and status fields. limit 1 means only one result is returned.

2. Data Processing:

   host = dql_series_get(data1,"host")  # Extract the `host` field from the query result
   service = dql_series_get(data1,"service") # Extract the `service` field
   span_id = dql_series_get(data1,"span_id") # Extract the `span_id` field
   

3. Alert Trigger:

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

This triggers an alert with a severity of high. dimension_tags identifies the detection object (here, host is used as the dimension tag), and related_data attaches associated data (service and span_id).

Security Severity¶

Select the security severity for the current detection rule:

Configure Rule Description¶

When adding a detection rule, enter the detection conclusion and remediation suggestions. These will be sent as the title and description of the alert notification.

1. Define the rule title;
2. Enter the rule description.
3. Optionally add global tags to the current rule.

Alert Configuration¶

Select an existing alert policy from the current workspace to associate with this rule. Once the rule is enabled, alert notifications will be triggered according to the selected alert policy.

Permissions¶

Set view permissions for security monitoring data to enhance data security.