Create a rule without a query

Elastic Security
1

Hello, is it possible to create a rule that does not have a query? For example, if I want a rule to fire off every 4-6hrs for analyst to perform a specific task, is that possible?

2

I know you can create a watcher that uses a simple input, then add a trigger that schedules the watcher for every 4-6 hours. For instance, the watcher below schedules a reminder email to be sent to a specific recipient everyday at noon.

{
  "trigger" : {
    "schedule" : {
      "daily" : { "at" : "noon" }
    }
  },
  "input" : {
    "simple" : {
      "name" : "John"
    }
  },
  "actions" : {
    "reminder_email" : {
      "email" : {
        "to" : "to@host.domain",
        "subject" : "Reminder",
        "body" : "Dear {{ctx.payload.name}}, by the time you read these lines, I'll be gone"
      }
    }
  }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.