Hi ,
I have created a a detector with acustom rule. But i am unable to get the alerts.
Note:
when i run a GET query for “priority”: “Warning” i am also able to get the results.
I am also able to get the latest logs in Discover. But the alerts are not getting triggered.
Both Detector and Rule are enabled.
Please help, on what is wrong in below custom rule so that i can get the alerts?
id: q6qWa5EB1bdpHijd0ac7
logsource:
product: xxxxx-logs
title: Warning Priority Alert
description: Triggers an alert when the priority in Falco logs is “Warning”.
tags:
falsepositives:
level: high
status: experimental
references:
author: sourav
detection:
condition: Selection_1
Selection_1:
query:
- |
priority: “Warning”
timeframe: 5m
threshold:
value: 1