search

opendistro-for-elasticsearch / alerting

📟 Open Distro Alerting Plugin
https://opendistro.github.io/for-elasticsearch/features/alerting.html
Apache License 2.0
279 stars 80 forks source link

Custom Alert Configure #397

Open zakirpcs opened 2 years ago

zakirpcs commented 2 years ago

Custom alert configure.

I want to create a custom alert as like follows:

For example a user failed logon (ssh) attempt happen 5 times within one minutes then a custom alert will be generated as per below format:

  1. User Name
  2. Source IP (Client Terminal IP)
  3. Server IP
  4. Number for failed attempt.

My testing environment is as follows:

Is there anyone who can help me on this.

Thanks in advance.

Zakir Hossain