- Anomalies Detected:
In the Anomaly Explorer (PRINT 1), I can see anomalies flagged for specific users (Soledade and Sofia) at 7:45, each with unique details such as:
- Soledade - Unusual hour.
- Sofia - Rare user authentication.
Each has distinct influencers such as hostname, geo-location, and source.ip.
2. Email Alert (PRINT 2):
I configured a rule that checks record result types every 1 minute, with the email connector using the following body:
[{{rule.name}}]:
{{context.message}}
- Job IDs: {{context.jobIds}}
- Time: {{context.timestampIso8601}}
- Anomaly score: {{context.score}}
{{#context.topInfluencers.length}}
Top influencers:
{{#context.topInfluencers}}
- {{influencer_field_name}}: {{influencer_field_value}} [{{score}}] {{/context.topInfluencers}} {{/context.topInfluencers.length}}
{{#context.topRecords.length}}
Top records: {{#context.topRecords}}
- {{function}}({{field_name}}) {{by_field_value}}{{over_field_value}}{{partition_field_value}} [{{score}}].
Typical: {{typical}}.
Actual: {{actual}}.
{{/context.topRecords}} {{/context.topRecords.length}}
The email received (PRINT 3) combines top influencers and top records from multiple anomalies logs in the time range, making it impossible to identify specific flagged records and their related influencers.
For example:
- The top influencers (hostnames, usernames, etc.) from both anomalies are mixed, with no indication of whether they belong to Soledade or Sofia.
- The same happens with top records, which are combined in a single email for anomalies flagged in the same time range (1-minute interval).
This creates confusion as the email does not allow me to clearly associate influencers or anomaly details with specific users (Soledade or Sofia).
3. Webhook Action (PRINT 4):
I also tested with a webhook connector for N8N, using this JSON body:
{ "rule_name": "{{rule.name}}", "message": "{{context.message}}", "job_id": "{{context.jobIds}}", "time": "{{context.timestampIso8601}}", "anomaly_score": "{{context.score}}", "influencers": "{{#context.topInfluencers.length}}{{#context.topInfluencers}} {{influencer_field_name}}={{influencer_field_value}} {{/context.topInfluencers}}{{/context.topInfluencers.length}}", "records": "{{#context.topRecords.length}}{{#context.topRecords}} {{function}}({{field_name}}) {{by_field_value}}{{over_field_value}}{{partition_field_value}}. Typical: {{typical}}. Actual: {{actual}}.{{/context.topRecords}}{{/context.topRecords.length}}", "context": "{{context}}" }
However, the same issue occurs. The response contains aggregated data, combining multiple anomalies flagged within the 1-minute interval, making it hard to act on.
What I Need Help With:
How can I configure the email and webhook action alert to:
- Send one alert per flagged anomaly (record).
- Ensure the influencers and details are tied specifically to that flagged record, without combining unrelated anomalies.
This is critical for teams with multi-functional roles where actionable information is required per anomaly.
Thank you for your assistance!
