You're viewing version 2.17 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.

Actions

Actions send notifications when trigger conditions are met. See Notifications to learn about creating notifications. If you don’t want to receive notifications, don’t add actions to your triggers.

Adding actions

To add an action:

1. In the Triggers panel, select Add action.

2. Enter the action details, including action name, notification channel, and notification message body, in the Notification section.

   You can add variables to your messages using Mustache templates. You have access to ctx.action.name, the name of the current action, and all actions variables.

   If your notification channel is a custom webhook that expects a particular data format, include JSON (or XML) directly in the message body:

    { "text": "Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue. - Trigger: {{ctx.trigger.name}} - Severity: {{ctx.trigger.severity}} - Period start: {{ctx.periodStart}} - Period end: {{ctx.periodEnd}}" }
   

   In the preceding example, the message content must conform to the Content-Type header in the custom webhook.

3. If you’re using a bucket-level monitor, choose whether the monitor should perform an action for each execution or for each alert.

4. (Optional) Use action throttling to limit the number of notifications you receive within a given time frame.

   For example, if a monitor checks a trigger condition every minute, you could receive one notification per minute. If you set action throttling to 60 minutes, you receive no more than one notification per hour, even if the trigger condition is met dozens of times in that hour.

5. Choose Create.

After an action sends a message, the content of that message has left the purview of the Security Analytics plugin. Securing access to the message (for example, access to the Slack channel) is your responsibility.

Example message

Monitor {{ctx.monitor.name}} just entered an alert state. Please investigate the issue.
- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}

To use the ctx.results variable in a message, use {{ctx.results.0}} rather than {{ctx.results[0]}}. This difference is due to how Mustache handles bracket notation.

Actions variables