vania-janet/multiturn-rag-retrieval-data huggingface dataset:
ALL indicates that the alert is triggered when all of the monitored entities satisfy the condition.

--user-filter <USER_FILTER>
: Boolean expression that you can set to reduce the scope of the alert. Use this parameter to configure segments, such as filters like kubernetes.namespace.name='production' or container.image='nginx'.

--notify <NOTIFY>
: Type of notification that you want this alert to generate. Options are EMAIL, SNS, PAGER_DUTY, and SYSDIG_DUMP.

--file <FILE> | -f <JSON_FILE>
: Name of the JSON file that contains the data set for a new alert creation. Make sure you create the alert.json file before invoking this command.

--region <REGION> | -r <REGION>
: Name of the region, for example, us-south or eu-gb. If not specified, the region logged into or targeted will be used.

--output <FORMAT>
: A comma-separated list of output preferences enclosed in double-quotes ("). If only a single preference is specified, the double-quotes can be omitted. Supported options are WIDE and JSON.

If JSON is specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

WIDE returns additional details in the output.

--team <TEAM_NAME>
: The name of the IBM Cloud Monitoring team to be used for authorization. If no team is specified, the default team will be used.

--help | -h
: List options available for the command.





 Examples 

The following are examples using the ibmcloud monitoring alert add command.

Add an alert for the IBM Cloud Monitoring abc instance to detect a CrashLoopBackOff in the last 5 minutes.
For example, you could define this entry if you want to receive a notification only if the name of the process meets the condition.
* [notify]: You can define the type of notifications that you want the alert to generate. Set this entry to the notification IDs of the channels that you have defined.
* [enabled]: You can configure the status of the alert when it is created. By default, alerts are enabled and the entry is set to true. Set to false if you do not want it enabled when you create it.
* [annotations]: You can add custom properties that you can associate with the alert.
* [alert_obj]: You can attach an alert object instead of specifying the individual parameters.







 Updating an alert (PUT) 

To update an existing alert, you need the ID of that alert.

The following code shows the structure of a Python script that you can use to update an alert:

 Reference the Python client
from sdcclient import IbmAuthHelper, SdMonitorClient

 Add the monitoring instance information that is required for authentication
URL = <MONITORING-ENDPOINT>
APIKEY = <IAM_APIKEY>
GUID = <GUID>
ibm_headers = IbmAuthHelper.get_headers(URL, APIKEY, GUID)

 Instantiate the Python client
sdclient = SdMonitorClient(sdc_url=URL, custom_headers=ibm_headers)

res = sdclient.get_alerts()
if not res[0]:
print("Failed to fetch existing alerts")

alert_found = False

for alert in res['alerts']:
if alert['name'] == alert_name:
alert_found = True
if 'notificationChannelIds' in alert:
alert['notificationChannelIds'] = alert['notificationChannelIds']
update_txt = '(changed by update_alert)'
if alert['description'] != update_txt:
* Anomaly Detection: Use this type of alert to monitor hosts based on historical behaviors and alert when they deviate from the expected pattern.

This type of alert is deprecated. You can only manage existing alerts of this type.
* Group Outlier: Use this type of alert to monitor hosts and be notified when 1 acts differently from the rest.

This type of alert is deprecated. You can only manage existing alerts of this type.







 Notification channels 

A notification channel defines where you want to receive information when an alert is triggered.

When you configure an alert, you can specify 1 or more notification channels.

By default, when an alert is triggered, you get a notification in the Events section.

You can configure any of the following notification channels:



* Email
* IBM Cloud Functions
* IBM Event Notifications
* Microsoft Teams
* OpsGenie
* PagerDuty
* Slack
* Teams Email
* VictorOps
* WebHook







 Events 

An event is a notification that informs about something that occurs in any of the nodes that forward data to your Monitoring instance. Use events to review, track, and resolve issues.

The following list outlines different types of events:



* Alert events are events that are triggered by user-configured alerts.
* Infrastructure-based events are events that are collected from Docker and Kubernetes nodes. By default, the monitoring agent automatically discovers and collects data from a select group of events. You can edit the agent configuration file to enable more events.
* Custom events that you configure through any of the following integrations: Slackbot, pre-built Python scripts, custom user-created Python scripts, or cURL requests.



By default, an event has a state:



* Active: This state indicates that the circumstances that triggered the event remain in place, for example, a node continues to be down.
* OK: This state indicates that the situation is back to normal, for example, a node is up and running.



You manage events in the Events section of the web UI.



* You can view alert events through the Alert Events tab.
* You can view infrastructure-based events through the Custom events tab.
Alert notification channels 

The following table lists the notification channels that you can configure when an alert is triggered:



Notification channels

 Channel       Configuration details                                                                 

 email         You can configure one or more email addresses.                                        
 Slack         You can configure a slack channel.                                                    
 Webhook       You can configure a web hook URL.                                                     
 PagerDuty     You can configure connection details to your PagerDuty system, and select a service.  
 Monitoring    You can configure a IBM Cloud Monitoring instance to collect notifications.
* Alert – red.







 Alarm definition 

Alarm definitions are associated with the object that is selected in the inventory and monitors the type of inventory objects that are specified in its definition.

An alarm definition consists of the following elements.



* Name and description - Provides an identifying label and description.
* Alarm type - Defines the type of object that is monitored.
* Triggers - Defines the event, condition, or state that triggers the alarm and defines the notification severity.
* Tolerance thresholds (Reporting) - Provides more restrictions on condition and state triggers thresholds that must be exceeded before the alarm is triggered.
* Actions - Defines operations that occur in response to triggered alarms. VMware provides sets of predefined actions that are specific to inventory object types.
* Alarm Actions - Alarm actions are operations that occur in response to the trigger. For example, you can send an email notification to one or more administrators when an alarm is triggered.
* Acknowledge triggered alarms - After you acknowledge an alarm, the alarm actions are discontinued. Alarms are not cleared, or reset when acknowledged. Acknowledging an alarm signals to other users know that you are taking ownership of the issue.
* Reset triggered alarms - An alarm that is triggered by an event might not reset to a normal state if vCenter does not retrieve the event that identifies the normal condition. In such cases, reset the alarm manually.
* Preconfigured vSphere alarms - The vSphere event and alarm subsystem has a number of default alarms, which monitor the operations of vSphere inventory objects. You must set up actions only for these alarms.









 Alarm setup workflow 

VMware provides preconfigured vCenter alarms that are described in the following tables, but they are set with an action to display within the vCenter web client only. Configure the SMTP server details and then set the alert actions to send an email to the system administrators for the following alarms only initially so not to inundate the system administrator team.
"id": "sreteam@techcompany.com"
}
]
},
"filters": {
"services": [
"waf",
"bic"
],
"zones": [
"123456ab7d8e9f0g12h2j34l5mn6op78"
]
}
}'

Where:



* -d is the array of attributes required to create the alert.



* name is the name of the alert.
* description (optional) is the description of the alert.
* enabled is the state of the alert (one of true, false).
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms is at least one of email, webhooks.
* filters is the list of all services to monitor for security events and zones for the Advanced WAF alert.





You can monitor the following services:



Table 1. Services that can be monitored by Advanced WAF alerts

 Services Log value 

 Country IP access rules country 
 WAF waf 
 Firewall rules firewallrules 
 Rate limiting ratelimit 
 Security level securitylevel 
 IP access rules ip 
 Validation validation 
 Browser integrity check bic 
 Hot link protection hot 
 User agent block uablock 
 Zone lockdown zonelockdown 
 IP range access rules iprange 
 ASN IP access rules asn 
 Custom firewall firewallCustom 
 Managed firewall firewallManaged 
 Data loss prevention dlp 







 Universal SSL alert command 

To configure a Universal SSL alert, use the following command:
You can choose to be notified by using a presence alert that is triggered when more log lines than expected are present.

You will want to define a presence alert to be notified of exceptional situations in your applications and services that require immediate attention.

You can configure multiple notification channels. Valid channels are: email, Slack, PagerDuty, Webhook



Table 4. Guidance for notification channel

 Channel Guidance 

 email Email is a traditional communication method that you can use to notify 1 or more users. This notification channel requires users to be monitoring proactively their emails to detect an alert. Define an email alert to verify that the alert on a view is working, and to inform users of situations they may have requested information. 
 Slack Slack is a collaborative tool that you can use to communicate and share information across 1 or more teams. Define a Slack alert to inform about routine scenarios that you might want to monitor. 
 PagerDuty PagerDuty is an incident management tool that you can use to automate incident resolution and escalation, define on-call schedules and more. Define a PagerDuty alert to be notified immediately so that you can take action promptly. 
 Webhook A webhook is another method that you can configure to provide other applications information. Define a webhook alert if you have a third party tool that you can configure with a logging instance via a webhook, and where you plan to manage notifications. 



Configure PagerDuty alerts to be notified immediately so that you can take action promptly on problems and automate their resolution. In addition, configure Slack alerts to share alerts and information.

In IBM Log Analysis, you can also define a preset. A preset is an alert template that you can attach to any number of views.

To reuse an alert configuration with different views and enforce notification channels across users that analyze data through that instance, configure alert presets.

When you send a notification, you can include log data as part of the notification.

Customize the data that is included in a notification for situations where the receiver of the notification does not have access to the log data.





 Define the archive strategy
curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'Content-Type: application/json' -H 'X-Auth-User-Token: Bearer xxxxxx' -d '{
"name": "WAF Alerter",
"description": "Send an email on spike in firewall events for WAF or browser integrity check",
"enabled": true,
"alert_type": "clickhouse_alert_fw_ent_anomaly",
"mechanisms": {
"email": [
{
"id": "sreteam@techcompany.com"
}
]
},
"filters": {
"services": [
"waf",
"bic"
],
"zones": [
"123456ab7d8e9f0g12h2j34l5mn6op78"
]
}
}'

Where:



* -d is the array of attributes that are required to create the alert.



* name is the name of the alert.
* description (optional) is the description of the alert.
* enabled is the state of the alert (one of true, false).
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms are at least one of email, webhooks.
* filters are the list of all services to monitor for security events and zones for the Advanced WAF alert.





You can monitor the following services:



Table 1. Services that can be monitored by Advanced WAF alerts

 Services Log value 

 Country IP access rules country 
 WAF waf 
 Firewall rules firewallrules 
 Rate limiting ratelimit
You can define different triggering conditions to each notification channel.



 Create an alert by using a preset 

Complete the following steps to attach a preset to a view:



1. [Configure a preset (alert template)](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-preset_uipreset_ui_create).
2. Click the Views icon ![Views icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/views.png). Select the view name. Then, select Attach an alert.
3. In the section Choose preset, select a preset.
4. Click Save alert.







 Create an alert on a view 

Complete the following steps to attach an alert to a view:



1. In the web UI, click the Views icon ![Views icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/alerts/images/views.png).
2. Click the view name. Then, select Attach an alert.
3. Select View-specific alert.
4. Select the type of alert (Slack, Email, Webhook, or PagerDuty). If you selected the wrong alert type and you want to change it, click Delete Alert Channel.
5. Configure when you want the alert to be sent.

Select if you want the alert to be sent when the condition exists (Presence) or does not exist (Absence).

Indicate the logging criteria when an alert should be sent. For example, when 100 lines matching in the view are logged in an hour.
* You can use the POST method to create an alert.
* You can use the PUT method to modify an existing alert. You can use the DELETE method to delete a view and associated alerts.
* You can use the DELETE method to delete an alert.



For more information, see [Managing views and alerts programmatically](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-config-api).

For example, the following sample will create an email alert of type presence that sends a notification when 1 event reporting thr creation, deletion, or change of a service instance occurs in the account:

curl https://api.eu-de.logging.cloud.ibm.com/v1/config/view 
-H 'content-type: application/json' 
-H 'servicekey: <SERVICE_KEY>' 
-d '{
"name": "Configuration Changes",
"query": "instance.create OR instance.delete OR instance.update",
"category": [],
"channels": [{
"integration": "email",
"immediate": false,
"terminal": true,
"triggerlimit": 1,
"triggerinterval": "30",
"operator": "presence",
"emails": "user@mycompany.com"]
}]}'
Show more

You will create a view as well as an alert, even when using the API.





 Sample queries to notify on account configuration changes 



 Notify when services are created, modified, and deleted 

The following table outlines queries that you can use to alert on configuraton changes that report when services are created, modified, and deleted:



Table 1. Query samples when services are created, modified, and deleted

 Notify on Query UI Source API hosts 

 Create a service instance instance.create N/A N/A
notification_channel_ids = res

 Create and define the alert details
res = sdclient.create_alert(
name=<ALERT_NAME>,
description=<ALERT_DESCRIPTION>,
severity=<SEVERITY>,
for_atleast_s=<FOR_ATLEAST_S>,
condition=<CONDITION>,
segmentby=<SEGMENTBY>,
segment_condition=<SEGMENT_CONDITION>,
user_filter=<USER_FILTER>,
notify=<NOTIFICATION_CHANNEL_IDS>,
enabled=<ENABLED>,
annotations=<ANNOTATIONS>,
alert_obj=<ALERT_OBJ>
)

if not res[0]:
print("Alert creation failed")
Show more

Consider the following information when you create a Python script:



* You must include the following information: <MONITORING-ENDPOINT>, <IAM_APIKEY>, and <GUID> These data is required to authenticate the request with the monitoring instance. To get the monitoring instance information, see [Authenticate your user or service ID by using IAM](https://cloud.ibm.com/docs/monitoring?topic=monitoring-python-clientpython-client-iam-auth).
* You must define the notification channels through which you want to be notified when the alert is triggered.

Valid notification channel types are SLACK, PAGER_DUTY, VICTOROPS, WEBHOOK, and EMAIL.

When you define the notification channels, the channels must be configured in the monitoring instance.

When you add an email notification channel, you can add multiple recipients. You separate values by using a comma.

When you define a Slack channel, replace <SLACK_CHANNEL_NAME> with the name of your channel. You must include the symbol with the name of the channel, for example, my_monitoring_alert_channel.



When you configure the alert, complete the following sections:



* [name and description]: You must define a unique name for the alert name by replacing <ALERT_NAME>, and optionally, add a description by replacing <ALERT_DESCRIPTION>.
Required.--name: The name of the alert policy.--description: The description for the alert policy.--emails: The email addresses for dispatching an alert notification. For example: --emails test1@cn.ibm.com,test2@cn.ibm.com--webhooks: The webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2--enabled: Whether or not the alert policy is enabled.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-opt-update-certificate-alert" "> --><-- <section "id="section-update-certificate-alert-examples" "> --> Examples Update a certificate alert policy a2633e68-1a64-2512-a321-b64a17c7db7a. ibmcloud cis alert-policy certificate-alert-update a2633e68-1a64-2512-a321-b64a17c7db7a --name test1 --emails test1@cn.ibm.com --webhooks b2633e68-9a64-4519-b361-a64a67c8db8e --enabled true -i "cis-demo"
<-- </section "id="section-update-certificate-alert-examples" "> --><-- </section "id="section-update-certificate-alert" "> --><-- <section "id="section-update-glb-healthcheck-alert" "> --> ibmcloud cis alert-policy glb-healthcheck-alert-update Update an alert policy for changes in health status for global load balancer, pools, and origins.
alert_found = False

for alert in res['alerts']:
if alert['name'] == alert_name:
alert_found = True
if 'notificationChannelIds' in alert:
alert['notificationChannelIds'] = alert['notificationChannelIds']
update_txt = '(changed by update_alert)'
if alert['description'] != update_txt:
alert['description'] = alert['description'] + update_txt
alert['timespan'] = alert['timespan'] * 2 Note: Expressed in seconds * 1000000
res_update = sdclient.update_alert(alert)

if not res_update:
print("Alert update failed")

if not alert_found:
print('Alert to be updated not found')
Show more





 Deleting an alert (DELETE) 

To delete an existing alert, you need the ID of that alert.

The following code shows the structure of a Python script that you can use to delete an alert:

 Reference the Python client
from sdcclient import IbmAuthHelper, SdMonitorClient

 Add the monitoring instance information that is required for authentication
URL = <MONITORING-ENDPOINT>
APIKEY = <IAM_APIKEY>
GUID = <GUID>
ibm_headers = IbmAuthHelper.get_headers(URL, APIKEY, GUID)

 Instantiate the Python client
sdclient = SdMonitorClient(sdc_url=URL, custom_headers=ibm_headers)

res = sdclient.get_alerts()
if not res[0]:
print("Failed to fetch existing alerts")

for alert in res['alerts']:
if alert['name'] == alert_name:
print("Deleting alert")
res = sdclient.delete_alert(alert)
if not res:
print("Alert deletion failed")
Show more
Managing alerts by using the Alerts API 

You can manage alerts in a IBM Cloud Monitoring instance by using the Monitoring API.

To learn how to use cURL, see [cURL command](https://cloud.ibm.com/docs/monitoring?topic=monitoring-mon-curl).



 Get details about a user alert 

You can use the following cURL command to get information about an alert:

curl -X GET <REST_API_ENDPOINT>/api/alerts/<ALERT_ID> -H "Authorization: $AUTH_TOKEN" -H "IBMInstanceID: $GUID" -H "TeamID: $TEAM_ID" -H "content-type: application/json"

Where



* <REST_API_ENDPOINT> indicates the endpoint targetted by the REST API call. For more information, see [Monitoring REST API endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_rest_api). For example, the public endpoint for an instance that is available in us-south is the following: https://us-south.monitoring.cloud.ibm.com/api
* You can pass multiple headers by using -H.

Authorization and IBMInstanceID are headers that are required for authentication.

TeamID is optional. When you specify this header, you limit the request to the data and resources available for the team specified.

To get an AUTH_TOKEN and the GUID see, [Headers for IAM Tokens](https://cloud.ibm.com/docs/monitoring?topic=monitoring-mon-curlmon-curl-headers-iam).
* <ALERT_ID> defines the ID of the alert that you want to modify.



For example, the response body for an alert looks as follows:

{
"alert": {
"autoCreated": false,
"condition": "min(min(dallas_prod)) = 0",
"createdOn": 1551358413000,
"enabled": false,
"id": 23211,
Select the type of alert (Slack, Email, Webhook, or PagerDuty). If you selected the wrong alert type and you want to change it, click Delete Alert Channel.
5. Configure when you want the alert to be sent.

Select if you want the alert to be sent when the condition exists (Presence) or does not exist (Absence).

Indicate the logging criteria when an alert should be sent. For example, when 100 lines matching in the view are logged in an hour. A graph will help you determine the number of log lines matching your specified criteria.

Select if the alert should be sent at the end of the selected period or immediately when the number of lines are logged.

Optionally you can specify a Custom schedule with alerting limited to a specified timezone, days of the week, or timeframe. To configure a Custom schedule:



1. Select on for Custom schedule.
2. Select the Timezone for the log entries.
3. Select the days of the week when alerts should be generated.
4. Optionally specify a time range for the selected days. A graph will help you determine the number of log entries for the timezone and time range.



6. Depending on the type of alert you will also need to configure additional settings:

Slack: Specify your Webhook URL and the desired Message color.

Email: Specify the Recipients of the email and a Timezone. The timezone defines the timestamp value of each event that is included in the email. To see UTC timestamps, you can select (GMT +00:00) UTC.

PagerDuty: Specify the Service. If required, you will be prompted to connect to PagerDuty.

Webhook: Specify the Method & URL, and the Headers and Body of the JSON used to interact with your webhook. You can use Validate JSON to make sure your JSON is correct before creating the alert.
7. You can click Test to test that your alert configuration is correct.

!