Alarm for silent log source

Elastic Security
1

Hi,

I'd like to create an alarm for every log source that used to log frequently.
How can I do this?

Best regards
Kai

--
Version: 8.15.1

1 Like
2

Hi @KaWa, my understanding is that you are trying to get alerted when a data source shows significant drops in average logging volume (please correct me if I'm wrong). Please take a look at the Log Threshold rule type, as it looks like it might meet your needs. This rule type is available through Kibana -> Stack Management -> Rules.

3

Thank you, @Pedro_Jaramillo.
I'll have a look.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.