search

airbus-cyber / graylog-plugin-alert-wizard

Alert Wizard plugin for Graylog to manage the alert rules
Other
46 stars 7 forks source link

The wizard fails to get the additional_threshold_type parameter #34

Closed frantz45 closed 2 years ago

frantz45 commented 3 years ago

To reproduce the issue:

  1. Create a rule with the Wizard
  2. Choose a type of rule which allows to use the additional_threshold_type, for example an "AND" rule
  3. Set the threshold_type to "MORE" and the additional_threshold_type to "LESS" (and fill the other parameters as you want)
  4. Save the rule
  5. Edit the rule and you'll see the additional_threshold_type is set to "MORE" and not "LESS"

I have checked the POST (and PUT in case of an update) request, and the additional_threshold_type is well set to "LESS". But in the GET response it's set to "MORE".

In the MongoDB additional_threshold_type is also well set to "LESS". It's also set to "LESS" in the Event Definition page.

So I think the rule is working as expected. But it can be disturbing when you display the rule in the Wizard. Moreover it becomes a real issue if you want to export the rule with the Wizard because the additional_threshold_type will be set to "MORE".

I'm using the 3.3.0 Wizard version.

frantz45 commented 2 years ago

I confirm this issue is fixed in v4.0.0