search

airbus-cyber / graylog-plugin-alert-wizard

Alert Wizard plugin for Graylog to manage the alert rules
Other
46 stars 7 forks source link

Description "Generated by the alert wizard" is not relevant #102

Closed frantz45 closed 1 year ago

frantz45 commented 1 year ago

Currently when we create a rule via the Wizard, both descriptions of Event Definition and Notification are set to "Generated by the alert wizard". It isn't customizable. The initial idea was to inform users which rules were created by the Wizard in order they don't break them by editing them directly in Event Definition or Notification instead of using the Wizard. But I think it's useless and there are other ways to achieve it, for example you could add the tag "[Wizard]" in the rule title. Moreover for the Notification body it would be more relevant to be able to notify with a real description of the alert instead of "Generated by the alert wizard". I propose the following things:

  1. The Wizard description field should be mapped to Event Definition description. So when you set a description in the Wizard it should set the Event Definition description, and when you modify the Event Definition description it should be get by the Wizard
  2. By default the (logging alert) Notification description should also be the same when the rule is created
  3. But then the Notification description can be modified independantly (it must not impact the Wizard or Event Definition description)
c8y3 commented 1 year ago

For 1, careful, check whether a database migration would be necessary. Try to avoid, if possible. For 3, check notification description will not be lost during the import/export process.

c8y3 commented 1 year ago

What would you say should be the description of the second event definition (when any)?

c8y3 commented 1 year ago

For 1, event definition description should not be lost during the import/export process. The field description of the alert rule will be removed in database. It shouldn't pose any problem when updating the the plugin on an instance where rules have been created. However this should be checked during validation.

frantz45 commented 1 year ago

By default the 2nd Event Definition description should also be the same when the rule is created and updated from the Wizard.

frantz45 commented 1 year ago

Documentation: before update, push Wizard description to Event definitions description (for example export/delete/import)

frantz45 commented 1 year ago

I've tested with Wizard v5.1.0 and I confirm it works well (update procedure included)