vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* For more information on how to create alerts programmatically, see [Managing views and alerts programmatically](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-config-api).







 Deleting alerts 

You can delete alerts graphically through the Activity Tracker UI, or programmatically.



* For more information on how to delete an alert, see [Removing alerts through the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-remove_alert_ui).
* For more information on how to delete alerts programmatically, see [Managing views and alerts programmatically](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-config-apiconfig-api-create-view-alert).







 Managing presets (alert templates) 

To reuse an alert configuration, a service administrator can configure an alert preset (alert template).



* For more information on how to create a preset, see [Create a preset](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-preset_uipreset_ui_create).
* For more information on how to delete a preset, see [Delete a preset](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-preset_uipreset_ui_delete).







 Muting alert notifications 

By default, the feature that controls the ability of a user to mute notifications is enabled when you configure an alert on a custom view. The Mutable feature applies to email notifications only.

When the mutable feature is enabled on an alert, a user can pause notifications for a period of time. A user can choose to mute an alert for a period of 1 hour, 6 hours, 12 hours, or 1 day.
You can then refine your alerting based on your needs.







 Launch the index rate alert page 

The index rate alert page offers an overview of your account's current rate of ingestion and indexing of searchable data. Through this page, you can see the ratio between the log lines that are ingested versus the number of log lines that are being stored.

To use the index rate feature on an instance, an administrator of the service must turn on the feature.

Complete the following steps to view the index rate dashboard and enable the feature:



1. [Navigating to the web UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2. Select the settings icon.
3. In the section Usage, select Index Rate Alerts.
4. Enable the feature.



When the feature is enabled, the index rate alert page is displayed.



* You can use the index rate alerts page to monitor the daily average index rates or the standard deviation from the past 30 days.
* You can toggle between viewing index rates or standard deviations for the past 30 days, the past 7 days, or the past 1 day.
* If no log lines are ingested in a 60 minute period, Check Later will be displayed instead of the index rate value. Since measurements are taken every five minutes, the first measurement of ingested log lines for that five minutes will be averaged for the first hour. Wait at least an hour before using the index rate value for analysis any time there has been an ingestion interruption.







 Activate the index rate alert feature 

You must set at least 1 threshold to activate the index rate alert feature.

By default the index rate alert feature is disabled.





 Configure index rate alerts 

When you configure index rate alerts, you can gain insight into which applications, sources, or tags produce data spikes, as well as any recently added sources. The alert message that is sent includes the following information:



* The top 20 sources and apps that have had the largest index rate growth in the past 2 hours.
* The list of the 20 newest sources added.
* A link to download generated lists of all applications and sources.
Create an Event Notifications topic 

Create an Event Notifications topic. Topics are based on a publish and subscription model. You can send notifications or alerts to multiple destination types, (for example, email, SMS, and others that are subscribed to a particular topic. Configure topics as needed and Event Notifications handles the routing and delivering of alerts reliably to the right destinations.



*  Each topic is created under a registered source.
*  Each topic can have its own set of rules, which routes the incoming payload to the respective topic.





  Step 1: Select topics in the Event Notifications console 

Select Topics in the Event Notifications console.

Click Create, and enter the following topic details:



*  Name: enter a name for the topic.
*  Description: add an optional description for the topic.
*  Source: select a source from the list.







  Step 2: Add rules to your topic 

Step 1 created a topic, step 2 provisions optional custom rules for the topic.

Add the following rules to your topic:



*  Event type: select event type from the list.
*  Event subtype: select event sub type from the event sub type list.
*  Severity: select severity from the severity list.
*  Advanced conditions: create your own custom conditions, which must follow [jsonpath specifications](https://github.com/spyzhov/ajson). In the jsonpath specifications, many operators support is provided but currently support for == operator enabled. Example:



{
"data": {
"findings": [
{
"severity": "LOW",
"provider": "cert-mgr"
},
{
"severity": "HIGH",
"provider": "secrets-mgr"
}
],
"severity": "LOW",
"payloadType": "findings",
"issuer": "IBM Cloud Security Advisor",
}
}
Show more

Based on the above input JSON following valid JSONPaths can be constructed:

1. $.data.severity=='LOW'
Output: True

2. $.data.findings[1].severity == 'HIGH'
Output: True





  Step 3: Finish adding rules to your topic 

Click Add a condition.

If you do not select any rules, a default rule is added, which means all notifications route to the topic by default.





  Step 4: Create a topic 

Click Create in the topic wizard.
4. Specify options for case sensitivity, token range, and special character handling. If, while designing a regular expression, you see false positives, provide more context by extending the pattern in the regular expression or adding context through a sequence pattern. For example, if your postal code expression matches additional terms, incorporate rules for which letters are permitted in specific positions.





 Regular expression examples 

The following are examples of regular Java expressions that might be used in specific instances. In the pattern descriptions, A represents a character and 9, a digit. For more information about Java syntax, see [Class Pattern](https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html) Javadoc.



* To select text that includes any ordinal number of one or more digits followed by th, st, nd, or rd (21st, 2nd, 3rd, and so forth), specify:

d+(st|nd|rd|th)
* To select text that includes US Social Security numbers formatted as 999-99-9999, specify:

d{3}-d{2}-d{4}
* To select all text that includes a Canadian postal code formatted as A9A-9A9, A9A 9A9 or A9A9A9 (for example, K1G 3K9, V5g-4X3, and x2H3m5), specify:

[a-zA-Z][a-zA-Z](-|)[0-9][0-9]
* To select all text that includes a United Kingdom postal code formatted as A9 9AA, A99 9AA, AA99 9AA, A9A 9AA, or a9d AA9A 9AA (for example, M1 1AE, B33 8TH, DN55 1PT, W1A 0AX, CR2 6XH, and SW1A 2AA), specify:

[A-Z]{1,2}[1-9]?[A-Z]?s[0-9]{2,}|GIR 0AA
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 
 Multi-channel Alerting ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 
 Exporting events !
"alternatives":
{
"transcript": "thunderstorms could produc "
}
]
}
]
}{
"result_index": 0,
"results": [
{
"final": true,
"alternatives":
{
"transcript": "thunderstorms could produce ",
"confidence": 0.94
}
]
}
]
}{
"result_index": 1,
"results": [
{
"final": false,
"alternatives":
{
"transcript": "large "
}
]
}
]
}{
"result_index": 1,
"results": [
{
"final": true,
"alternatives":
{
"transcript": "large hail ",
"confidence": 0.91
}
]
}
]
}{
"result_index": 2,
"results": [
{
"final": false,
"alternatives":
{
"transcript": "and hea "
}
]
}
]
}{
"result_index": 2,
"results": [
{
"final": true,
"alternatives":
{
"transcript": "and heavy rain ",
"confidence": 0.86
}
]
}
]
}
Show more
* A feed is a convenient way to configure an external event source to fire trigger events that can be consumed by Cloud Functions. A feed is a stream of events that all belong to some trigger. Pre-installed packages, installable packages, and your own custom packages might contain feeds. A feed is controlled by a feed action, which handles creating, deleting, pausing, and resuming the stream of events that comprise a feed. The feed action typically interacts with external services that produce the events, by using a REST API that manages notifications.



Examples of feeds:



* An IBM Cloudant data change feed that fires a trigger event each time a document in a database is added or modified.
* A Git feed that fires a trigger event for every commit to a Git repository.







 Creating a trigger for a feed 

This example shows how to use a feed in the Alarms package to fire a trigger once a minute, and how to use a rule to invoke an action once a minute.



1. Get a description list of the entities in the /whisk.system/alarms package.

ibmcloud fn package get --summary /whisk.system/alarms

The following example shows possible output from the previous command.

package /whisk.system/alarms
feed /whisk.system/alarms/alarm
2. Get a description of the feed in the /whisk.system/alarms package to see the parameters that you can use.

ibmcloud fn action get --summary /whisk.system/alarms/alarm

The following example shows possible output from the previous command.

action /whisk.system/alarms/alarm: Fire trigger when alarm occurs
(params: cron trigger_payload)

The /whisk.system/alarms/alarm feed takes two parameters:



* cron: A crontab specification of when to fire the trigger.
* trigger_payload: The payload parameter value to set in each trigger event.



3. Create a trigger that fires every minute.
"id": "crn:v1:staging:public:logdna:us-south:a/9bb3ea01633c4d828080de16ce34ea70:d8ba830f-b0e0-4c42-9345-8981d4a94b31:streaming-logs:",
"typeURI": "logdna/account/streaming-notification"



 Query to monitor failures 

In Activity Tracker, you can create a view with the following query to filter for event stream failure notifications:

action:logdnaat.streaming-logs.send reason.reasonCode:500 severity:critical target.typeURI:"logdna/account/streaming-notification"

You can define a presence alert on this view to notify you as soon as 1 event reporting failure comes in.

In addition, you can create views for each type of notification. For example, to monitor for a failure to authenticate with Event Streams, you can use the following query:

action:logdnaat.streaming-logs.send reason.reasonCode:500 severity:critical target.typeURI:"logdna/account/streaming-notification" requestData.notificationType:"authentication_failure"
ibmcloud cis alert-policy pool-toggle-alert-update POLICY_ID [--name NAME] [--emails EMAILS] [--webhooks WEBHOOKS] [--enabled (true | false)] [--pools POOLS] [--trigger-condition (enabled | disabled | either)] [--include-future-pools (true | false)] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name value is the name of the alert policy.
* --description value is the description for the alert policy.
* --emails value is the email addresses for dispatching an alert notification. For example, --emails test1@cn.ibm.com,test2@cn.ibm.com.
* --webhooks value is the webhook IDs for dispatching an alert notification. For example, --webhooks webhookID1,webhookID2.
* --enabled value determines whether the alert policy is enabled.
* --pools value is the IDs of origin pool. If set to all, all pool IDs are used.
* --trigger-condition value is the condition of pool toggle status.
* --include-future-pools value determines whether to include the future pools.
* -i, --instance value is the instance name or ID.
* --output value specifies the output format; only JSON is supported.







 Updating a security alert policy by using the CLI 

To update a security alert policy by using the CLI, run the following command:

ibmcloud cis alert-policy firewall-events-alert-update POLICY_ID [--name NAME] [--emails EMAILS] [--webhooks WEBHOOKS] [--enabled (true | false)] [--domains DOMAINS] [--services SERVICES] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name value is the name of the alert policy.
* --description value is the description for the alert policy.
When you configure index rate alerts, you can gain insight into which applications, sources, or tags produce data spikes, as well as any recently added sources. The alert message that is sent includes the following information:



* The top 20 sources and apps that have had the largest index rate growth in the past 2 hours.
* The list of the 20 newest sources added.
* A link to download generated lists of all applications and sources. You can view the “Manage Usage” Dashboard to download these lists at any time.



Complete the following steps:



 Step 1. Configure 1 or more rules 

Choose 1 or more of the following options to activate the index rate alert feature:



* Max lines/s: Set an index rate threshold by configuring the max lines alert field so that you can get an alert when the value of lines per second is exceeded.
* Max z-score: Set a threshold value by configuring the max z-score field so that you can get an alert when the hourly index rate is significantly higher than the monthly mean.







 Step 2. Configure the notification channels 

Choose 1 or more notification channels to receive an alert when the threshold of a rule is exceeded:



* Configure the email notification channel by selecting Add email and entering 1 or more emails.
* Configure the Slack notification channel by selecting Add slack and configuring the channel details.
* Configure the PagerDuty notification channel by selecting Add PagerDuty and entering the credentials.
* Configure the Webhook notification channel by selecting Add Webhook and entering the credentials.







 Step 3. Configure the notification frequency 

Choose the notification frequency. Valid options are:



* Hourly notifications
* Daily notifications at midnight UTC



Notifications are sent until the index rate repo-rts a value that is below the thresholds that you have configured.

Individual recipients may mute alert emails.

You can also configure a custom schedule to set the days and hours that you want alerts to be send if the thresholds are exceeded.
Managing views and alerts programmatically 

You can use the Configuration REST API to manage programmatically views and alerts.



* You can use the POST method to create a view, or create a view and attach an alert to it.
* You can use the GET method to get all existing views and alerts.
* You can use the PUT method to modify an existing view, and alerts that are attached to views.
* You can use the DELETE method to delete a view and associated alerts.



Before you run any automated tasks, consider doing a back up of your account configuration resources. You can use the back up to restore the resources, to the state before any change is applied, if you encounter problems. See [Export the configuration of resources in an auditing instance](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-reuse_resource_definitionsrrd_export_config).



 Before you begin 



 Creating views 

When you create a view, consider the following information:



* You can create a view with no alerts.
* You can create a view with 1 or more notification channels. Valid alert notification channels that are supported by the Configuration API are: email, webhook, or PagerDuty.
* The response to an API request to create a view includes the ID of the view.
* The name body parameter, that defines the name of the view, is always required.
* A category must exist before you create a view. The request fails if a category is not valid or is not specified.
* You can define body parameters to refine the data that is displayed through the view. You must specify 1 or more of the following body parameters: query, apps, levels, hosts, or tags.



When you create a PagerDuty notification channel, consider the following information:



* You must manually configure the integration with PagerDuty.
* You must provide the PagerDuty API key.



After you create a view, check the view in the UI.



1. Refresh the browser to see the view listed in the Views section.
2. Select the view to display it.
3.
Removing alerts through the UI 

You can detach alerts graphically by detaching an alert from a view or by deleting a preset.



  Detaching all alerts from a view 

Complete the following steps to detach all the alerts that are configured for a view:



1.  [Navigate to the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2.  Identify the view with the alert.
3.  Select Detach alert.
4.  Confirm that you want to remove all the alerts. Click Yes, detach.







  Detaching 1 alert from a view 

Complete the following steps to detach 1 alert that is configured for a view:



1.  [Navigate to the web UI through the IBM Cloud UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2.  Identify the view with the alert.
3.  Select Edit alert.
4.  Select the alert definition that you want to delete.
5.  Click Delete alert channel.







  Deleting a preset (alert template) 

When you delete a preset, any alerts that are defined by using this preset are automatically deleted.

For more inform ation on how to delete a preset, see [Delete a preset](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-preset_uipreset_ui_delete).
Monitor incidents Provide notifications for planned maintenance, security bulletins, or unplanned outages. <br><br> * Set preferences to [receive emails about platform notifications](https://cloud.ibm.com/docs/overview?topic=overview-uiemail-prefsl).<br> * Monitor the [IBM Cloud status page](https://cloud.ibm.com/status?selected=announcement) for general announcements.<br><br><br> 
 Maintain IBM Cloud high availability SLA for Activity Tracker Event Routing <br><br> * Provide Activity Tracker Event Routing functionality across availability zones in a Multi-Zone Region (MZR).<br> * Provide replication, fail-over features, and infrastructure maintenance and updates.<br><br><br> <br><br> * Keep your Activity Tracker Event Routing configuration in a version control system so that you can reconfigure a region if needed.<br> * Comply with [Operational responsibilities when using IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-responsibilitiesresponsibilities-operational).<br> * Comply with [Operational responsibilities when using Activity Tracker hosted event search](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-shared-responsibilities).<br> * Comply with [Operational responsibilities when using IBM® Event Streams for IBM Cloud®](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-event_streams_responsibilities).<br><br><br> 
 Monitor events for Activity Tracker Event Routing [Participating Cloud services](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-cloud_service) publish relevant event data to their subscribing clients. Clients have the ability to receive this data once their account is configured. [Configure your account](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started) where Cloud service subscriptions publish events to receive the published events.
curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Policy","enabled":true,"alert_type":"dos_attack_l7","mechanisms":{"email":[{"id":"cistestemail@ibm.com"}],"webhooks":[]}}'

Where:



* -d is the array of attributes required to create the alert.



* name is the name of the alert.
* enabled is the state of the alert (one of true, false).
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms is at least one of email, webhooks.
* description (optional) is the description of the alert.









 Pool toggle alert command 

curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Policy","enabled":true,"alert_type":"load_balancing_pool_enablement_alert","mechanisms":{"email":[{"id":"cistestemail@ibm.com"}],"webhooks":[]},
“filters”: {
“enabled”: [
“false”,
“true”
],
“pool_id”: [
ibmcloud cis alert-policy firewall-events-alert-update POLICY_ID [--name NAME] [--emails EMAILS] [--webhooks WEBHOOKS] [--enabled (true | false)] [--domains DOMAINS] [--services SERVICES] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name value is the name of the alert policy.
* --description value is the description for the alert policy.
* --emails value is the email addresses for dispatching an alert notification. For example, --emails test1@cn.ibm.com,test2@cn.ibm.com.
* --webhooks value is the webhook IDs for dispatching an alert notification. For example, --webhooks webhookID1,webhookID2.
* --domains value is the domain IDs for the alert policy. For example, --domains domainID1,domainID2.
* --services value specifies which services the alert monitors (Enterprise plan only). Valid services: country-access-rules, waf, firewall-rules, ratelimit, securitylevel, ip-access-rules, browser-integrity-check, ua-rules, lockdowns, iprange-access-rules, asn-access-rules, managed-firewall, hotlink, ssl-validation.
* --enabled value determines whether the alert policy is enabled.
* -i, --instance value is the instance name or ID.
* --output value specifies the output format; only JSON is supported.







 Deleting an alert policy by using the CLI 

To delete an alert policy by using the CLI, run the following command:

ibmcloud cis alert-policy delete POLICY_ID [-i, --instance INSTANCE] [-f, --force]

Where:



* POLICY_ID is the id of alert policy.
* -f, --force attempts to delete alert policy without prompting for confirmation.
* -i, --instance value is the instance name or ID.