Graylog2 / Graylog2/graylog2-server
Allow saving a group of fields as a preset for reuse in event definitions
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When creating event definitions currently, you have to define the fields available in that event for use in alert/notification templates. You should be able to save a collection of fields as a preset, similar to how notifications work currently. This way, you can reuse these presets for other event definitions.
For example, if you need to configure multiple alerts based on Sysmon messages that always share a common set of fields (such as process name, process_path, user_name etc), you should have the ability to load a preset containing these common fields. Then, if needed, you can choose to add any additional fields specific to that event definition. This would eliminate the need to manually add these common fields each time.
* Graylog Version: 5.1.4 (Graylog Cloud)
* OpenSearch Version: ?
* MongoDB Version: ?
* Operating System: ?
* Browser version: Edge 115
Contributor guide
Assessment
This issue has not been assessed yet.