search

airbus-cyber / graylog-plugin-alert-wizard

Alert Wizard plugin for Graylog to manage the alert rules
Other
45 stars 7 forks source link

Replace aggregation plugin by builtin aggregation #71

Closed c8y3 closed 1 year ago

c8y3 commented 2 years ago

The ability to perform aggregation with more than one distinct-by field will be lost. It will always be possible to encode all the fields into a tuple and do a distinct-by on this new tuple field.

frantz45 commented 1 year ago

I confirm the wizard is well plugged with the built-in Graylog "Filter & Aggregation" functionality. Import of old rules works well as the creation of new rules.