Graylog2 / Graylog2/graylog2-server

Allow saving a group of fields as a preset for reuse in event definitions

Open
#16,256 0 comments 0 reactions 0 assignees View on GitHub
alerting feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When creating event definitions currently, you have to define the fields available in that event for use in alert/notification templates. You should be able to save a collection of fields as a preset, similar to how notifications work currently. This way, you can reuse these presets for other event definitions.

For example, if you need to configure multiple alerts based on Sysmon messages that always share a common set of fields (such as process name, process_path, user_name etc), you should have the ability to load a preset containing these common fields. Then, if needed, you can choose to add any additional fields specific to that event definition. This would eliminate the need to manually add these common fields each time.

* Graylog Version: 5.1.4 (Graylog Cloud)
* OpenSearch Version: ?
* MongoDB Version: ?
* Operating System: ?
* Browser version: Edge 115

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.