Create Detection Rules¶

Go to Security Monitoring > Security Incident Management > Create to start creating.

Basic Settings¶

Detection Frequency¶

The rule will run once according to the time interval set here (such as every 5 minutes, every 1 hour). It includes the last 1 minute, the last 5 minutes, the last 15 minutes, the last 30 minutes, the last 1 hour, the last 6 hours, the last 12 hours, and the last 24 hours.

In addition to the specific options provided by the system above, you can also enter custom crontab tasks, configuring scheduled task execution based on minutes, hours, days, months, weeks, etc.

Detection Interval¶

This indicates the time range for data queries each time the task is executed. Affected by the detection frequency, the selectable detection intervals may vary.

Define Detection Rule¶

When defining security detection logic, you can use DQL in the script to query data and set signal trigger logic by defining conditional expressions (e.g., field matching, threshold judgment, etc.).

When writing your own rules, you can:

• Set text to automatically wrap or overflow content;
• Use shortcuts to format the content;
• Copy with one click;
• Write script content directly in the content box;
• Select fx functions.

Example:

# data1,ok = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
# #data2 = dql("T::re(`.*`):(max(duration), service, span_id, status) by host limit 2")


# #result:Detection result, required, type basic type (string, integer, float)
# #result = data1.avg(duration)

# #dimension_tags:Detection object, optional, type map
# #dimension_tags = {"host":data1['series'][0][0]['tags']['host']}

# #status:Level, optional, type enumeration, if defined here has higher priority than level defined on user page
# #Possible values: critical, high, medium, low, info
# status = "high"

# #extra_data:Additional attributes, optional, type map
# #related_data = {"service":"wwwww"}
# #related_data = {"service":data1['series'][0][0]['columns']['service'],
#                # "span_id":data1['series'][0][0]['columns']['span_id'],
#                # "status":data1['series'][0][0]['columns']['status']}


# #fn trigger(result: int|float|bool|str, level: str = "", dim_tags: map = {}, related_data: map = {})
# #trigger(data1,status,dimension_tags,related_data)
# host = dql_series_get(data1,"host")
# service = dql_series_get(data1,"service")
# status = dql_series_get(data1,"status")
# trigger(data1,status,dimension_tags={"host":host},related_data={"service":service,"status":status})



data1 = dql("T::re(`.*`):(avg(duration), service, span_id, status) by host limit 1")
status = "high"
host = dql_series_get(data1,"host")
#printf("%v", {"host": host_o})
#host_info = dql_series_get(host_o,"host")
#printf("%v", {"host": host_info})
service = dql_series_get(data1,"service")
span_id = dql_series_get(data1,"span_id")

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

In the above script example, it is mainly divided into three parts:

1. Data Query: Through DQL querying all metrics (re(.*)), calculating the average value of the duration field grouped by each host, while returning the service, span_id, and status fields. limit 1 means only return 1 result;

2. Data Processing:

   host = dql_series_get(data1,"host")  # Extract the `host` field from the query results
   service = dql_series_get(data1,"service") # Extract the `service` field
   span_id = dql_series_get(data1,"span_id") # Extract the `span_id` field
   

   3. Alarm Trigger:

trigger(data1,status,dimension_tags={"host":host[0][0]},related_data={"service":service,"span_id":span_id})

Security Level¶

Select the security level for the current monitoring rule:

Configure Rule Description¶

When adding a detection rule, input the detection conclusion and remediation recommendations. This content will be sent out as the title and description of the alert notification.

1. Define the rule title;
2. Input rule description.
3. Choose to add global labels for the current rule.

Alert Configuration¶

Select an existing alert strategy within the current workspace for association. After the rule is enabled, alert notifications will be triggered according to the selected alert strategy.

Permissions¶

Set viewing permissions for security monitoring data to enhance data security.