vania-janet/multiturn-rag-retrieval-data huggingface dataset:
SMS You can send an SMS to notify of an alert either through the PagerDuty channel or through the IBM Cloud Monitoring channel. For more information, see [Integrating with SMS](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-sms). 
 Slack You can configure a slack channel. 
 Webhook You can configure a web hook URL. 
 PagerDuty You can configure connection details to your PagerDuty system, and select a service. Use this channel when you require call times and escalation management processes. For more information, see [Integrating with PagerDuty](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-pagerduty). 
 IBM Cloud Monitoring You can configure the API key to connect to an IBM Cloud Monitoring instance. 







 Creating alerts 

You can choose any of the following options to create an alert:



* Create a preset and attach the preset to the view
* Create a specific alert on a view.



You can configure alerts graphically through the Activity Tracker UI, or programmatically.



* For more information on how to configure an alert, see [Creating alerts through the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-create_alert_ui).
* For more information on how to create alerts programmatically, see [Managing views and alerts programmatically](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-config-api).







 Deleting alerts 

You can delete alerts graphically through the Activity Tracker UI, or programmatically.



* For more information on how to delete an alert, see [Removing alerts through the UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-remove_alert_ui).
In the Events section of the Monitoring UI, configure an event that send an SMS notification based on the alert that youd defined previously:



1. Select an alert. Then select Create Alert from Event.
2. Enter a name, a description, a group, and the severity level. The group default is set unless you specify a custom one.
3. Define the condition that triggers the SMS notification.

Specify events that match the alerts being sent to Monitoring from Activity Tracker. For example, you can indicate LogDNA or the name of the alert.

Set the Scope to everywhere.

If you want Monitoring to send alerts to IBM Cloud Event Notifications to be sent on as SMS message as soon as possible, specify Trigger values in the Monitoring alert definition to be as low as possible.
4. Select 1 or more notification channels. Make sure you select the IBM Cloud Event Notifications channel that you configured to notify thorugh the IBM Cloud Event Notifications service.









 Step 3. Configure the IBM Cloud Event Notifications service 

Complete the following steps:



1. [Provision an IBM Cloud Event Notifications instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-eventnotif_smseventnotif_sms_step1).
2. [Configure an authorization that grants IBM Cloud Monitoring access to IBM Cloud Event Notifications](https://cloud.ibm.com/docs/monitoring?topic=monitoring-eventnotif_smseventnotif_sms_step2).
3. [Configure the IBM Cloud Event Notifications instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-eventnotif_smseventnotif_sms_step3).









 Send an SMS notification by using the PagerDuty On Call Service 

When the Activity Tracker service sends a notification (event) to PagerDuty, an alert incident is created in PagerDuty and an SMS is sent if the escalation policy and on-call responder details include the rule to send to an SMS number.



* An incident is the issue that needs to be resolved.
<-- </section "id="section-list-alert-webhooks-examples" "> --><-- </section "id="section-list-alert-webhooks" "> --><-- <section "id="section-show-alert-webhook" "> --> ibmcloud cis alert-webhook Show the details of a given webhook. ibmcloud cis alert-webhook WEBHOOK_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-show-alert-webhook-options" "> --> Command options WEBHOOK_ID: The ID of alert webhook. Required.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-show-alert-webhook-options" "> --><-- <section "id="section-show-alert-webhook-examples" "> --> Examples Show the details of alert webhook b2633e68-9a64-4519-b361-a64a67c8db8e. ibmcloud cis alert-webhook b2633e68-9a64-4519-b361-a64a67c8db8e -i "cis-demo"
<-- </section "id="section-show-alert-webhook-examples" "> --><-- </section "id="section-show-alert-webhook" "> --><-- <section "id="section-create-alert-webhook" "> --> ibmcloud cis alert-webhook-create Create an alert webhook for a given instance.
"description": "Send an email on spike in firewall events for any service",
"enabled": true,
"alert_type": "clickhouse_alert_fw_anomaly",
"mechanisms": {
"email": [
{
"id": "sreteam@techcompany.com"
}
]
},
"filters": {
"zones": [
"123456ab7d8e9f0g12h2j34l5mn6op78"
]
}
}'

Where:



* -d is the array of attributes that are required to create the alert.



* name is the name of the alert.
* description (optional) is the description of the alert.
* enabled is the state of the alert (one of true, false).
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms are at least one of email, webhooks.
* filters are the list of all zones for the WAF alert.









 Advanced security (WAF) alert command 

To configure an Advanced WAF alert, use the following command:

curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'Content-Type: application/json' -H 'X-Auth-User-Token: Bearer xxxxxx' -d '{
"name": "WAF Alerter",
"description": "Send an email on spike in firewall events for WAF or browser integrity check",
"enabled": true,
"alert_type": "clickhouse_alert_fw_ent_anomaly",
"mechanisms": {
"email": [
{
In the Events section of the Monitoring UI, configure an event that send an SMS notification based on the alert that youd defined previously:



1. Select an alert. Then select Create Alert from Event.
2. Enter a name, a description, a group, and the severity level. The group default is set unless you specify a custom one.
3. Define the condition that triggers the SMS notification.

Specify events that match the alerts being sent to Monitoring from Log Analysis. For example, you can indicate LogDNA or the name of the alert.

Set the Scope to everywhere.

If you want Monitoring to send alerts to IBM Cloud Event Notifications to be sent on as SMS message as soon as possible, specify Trigger values in the Monitoring alert definition to be as low as possible.
4. Select 1 or more notification channels. Make sure you select the IBM Cloud Event Notifications channel that you configured to notify thorugh the IBM Cloud Event Notifications service.









 Step 3. Configure the IBM Cloud Event Notifications service 

Complete the following steps:



1. [Provision an IBM Cloud Event Notifications instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-eventnotif_smseventnotif_sms_step1).
2. [Configure an authorization that grants IBM Cloud Monitoring access to IBM Cloud Event Notifications](https://cloud.ibm.com/docs/monitoring?topic=monitoring-eventnotif_smseventnotif_sms_step2).
3. [Configure the IBM Cloud Event Notifications instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-eventnotif_smseventnotif_sms_step3).









 Send an SMS notification by using the PagerDuty On Call Service 

When the Log Analysis service sends a notification (event) to PagerDuty, an alert incident is created in PagerDuty and an SMS is sent if the escalation policy and on-call responder details include the rule to send to an SMS number.



* An incident is the issue that needs to be resolved.
Integrating with email 

You can send alerts to 1 or more email addresses.



 Configuring email 

When you [configure an alert](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-alertsconfigure-an-alert), you can have that alert sent to 1 or more email addresses.



1. When configuring your alert, click ![email icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/alerts/images/email.png).
2. Select if you want the alert to be sent when the condition exists (Presence) or does not exist (Absence).
3. Indicate the logging criteria when an alert should be sent. For example, when 100 lines matching in the view are logged in an hour. A graph will help you determine the number of log lines matching your specified criteria.
4. Select if the alert should be sent at the end of the selected period or immediately when the number of lines are logged.
5. Optionally you can specify a Custom schedule with alerting limited to a specified timezone, days of the week, or timeframe. To configure a Custom schedule:



1. Select on for Custom schedule.
2. Select the Timezone for the log entries.
3. Select the days of the week when alerts should be generated.
4. Optionally specify a time range for the selected days. A graph will help you determine the number of log entries for the timezone and time range.



6. Specify 1 or more email addresses.
7. Optional: You can click Test to test that your alert configuration is correct.
8. Click Save Alert.







 Muting an alert 

This section only applies to email alerts.

After you configure an alert on a view and receive a notification email, complete the following steps to mute the alert a period of time:
<-- </section "id="section-delete-alert-policy-examples" "> --><-- </section "id="section-delete-alert-policy" "> --><-- </section "id="section-alert-policy" "> --><-- <section "id="section-alert-webhook" "> --> Alert Webhook <-- <section "id="section-list-alert-webhooks" "> --> ibmcloud cis alert-webhooks List all alert webhooks. ibmcloud cis alert-webhooks -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-opt-list-alert-webhooks" "> --> Command options -i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-opt-list-alert-webhooks" "> --><-- <section "id="section-list-alert-webhooks-examples" "> --> Examples List all webhooks for instance cis-demo ibmcloud cis alert-webhooks -i "cis-demo"
<-- </section "id="section-list-alert-webhooks-examples" "> --><-- </section "id="section-list-alert-webhooks" "> --><-- <section "id="section-show-alert-webhook" "> --> ibmcloud cis alert-webhook Show the details of a given webhook. ibmcloud cis alert-webhook WEBHOOK_ID -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
Severity Severity status 

 0 HIGH 
 1 HIGH 
 2 MEDIUM 
 3 MEDIUM 
 4 LOW 
 5 LOW 
 6 INFO 
 7 INFO 







 segmentBy (array of strings) 

Defines additional segmentation criteria.

For example, you can segment a CPU alert by ['host.mac', 'proc.name'] so the alert can report on any process in any machine for which you get data in the monitoring instance.





 segmentCondition (string) 

Defines when the alert is triggered for each monitored entity that is specified in the segmentBy parameter. This parameter is required for MANUAL alerts only.

Valid values are the following:



* ANY: The alert is triggered when at least one of the monitored entities satisfies the condition.
* ALL: The alert is triggered when all of the monitored entities satisfy the condition.







 teamId (string) 

Defines the GUID of the team that owns the alert.





 type (string) 

Defines the type of alert. Valid values are MANUAL, BASELINE, and HOST_COMPARISON.

Set to MANUAL for alerts that you want to control when a notification is sent. You must define the threshold that determines when the alert is triggered.

Set to BASELINE for alerts that you want to notify when unexpected metric values are detected. New metric data is compared with metric values that are collected over time.

Set to HOST_COMPARISON for alerts that you want to notify when 1 host in a group reports metrics values that are different from the other hosts in the group.





 timespan (integer) 

Minimum time interval, in microseconds, for which the alert condition must be met before the alert is triggered.

The minimum value is 60000000 microseconds, that is, 1 minute.

The value of this parameter must be a multiple of 60000000 microseconds.





 version (integer) 

Version of an alert.

The version changes every time you update an alert.

The version is used for optimistic locking.







 Query parameters 



 alertId (integer) 

ID of an alert.





 from (long) 

Defines the start timestamp, in microseconds, that is used when you request information about alerts that are defined.
* Dedicated/Advanced receive notification for validation, issuance renewal, and expiration of Dedicated/Advanced certificates.



* Load-balancing health check alerts are sent when a change occurs in the health status of a load-balancing health check.







 Configuring alert policies by using the console 

Use the console to create, update, and delete alerting policies.

To configure alert policies by using the console, navigate to your Account page and select the Alerts tab. In the Alerts section, select the Alerting policies tab.



 Creating a security alert policy by using the console 



1. Click Create.
2. Select the type of alert policy that you want to create:



* Security events alert, which alerts you within 2 hours of detecting a spike in all security events.
* Advanced security events alert, which alerts you within 5 minutes of detecting a spike in security events with optional service filter.
* HTTP DDoS attack alert, which detects and mitigates an HTTP DDoS attack against one of your domains.
* Universal SSL alert, which alerts you when Universal certificates are automatically refreshed.
* Dedicated/Advanced alerts, which alert you when dedicated certificates are expired, and when they are renewed.
* Load-balancing health check alerts, which alerts you when the health status changes for a pool health check, or pool origin.



3. Enter a name for your alerting policy, and optionally enter a description.
4. Choose an alerting method. You can select a webhook, enter an email address to send alerts to, or both. Only one notification is required to complete configuration.



* Enter an email address to which Cloud Internet Services (CIS) sends alerts. Click the + to add the address to the alert. Repeat for all email addresses.
* Click Add webhook and select an available webhook. If no webhooks are present, this option is unavailable.



5. Click Create



By default, alert policies are enabled when created. You can disable alerts that you created by switching the toggle in the Enabled column.





 Creating an advanced security alert policy by using the console
<-- </section "id="section-show-alert-webhook-examples" "> --><-- </section "id="section-show-alert-webhook" "> --><-- <section "id="section-create-alert-webhook" "> --> ibmcloud cis alert-webhook-create Create an alert webhook for a given instance. ibmcloud cis alert-webhook-create --name NAME --url URL --secret SECRET] -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-create-alert-webhook-options" "> --> Command options --name: The name of the webhook. Required.--url: The POST endpoint to call when dispatching an alert. Required.--secret: The secret that will be passed in the webhook auth header when dispatching a webhook alert.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-create-alert-webhook-options" "> --><-- <section "id="section-create-alert-webhook-examples" "> --> Examples Create an alert webhook for instance cis-demo. ibmcloud cis alert-webhook-create --name testwebhook --url https://hooks.slack.com/services/Ds3fdBFbV/1234568 --secret 007 -i "cis-demo"
"enabled": false,
"filter": null,
"type": "",
"condition": "",
"timespan": 600000000,
"notificationChannelIds": ],
"reNotify": false,
"reNotifyMinutes": 30,
"segmentBy": ],
"segmentCondition": {
"type": ""
},
"severityLabel": ""
}
}
]
}





 Alerts schema: Response body 

{
"alerts": [
{
"alert": {
"autoCreated": false,
"condition": "",
"createdOn": 1551358413000,
"enabled": false,
"id": 23211,
"modifiedOn": 1551634372000,
"name": "",
"filter": "",
"notificationChannelIds": ],
"segmentBy": ],
"segmentCondition": {
"type": "ANY"
},
"notificationCount": 60,
"rateOfChange": false,
"reNotify": false,
"severity": 0,
"severityLabel": "",
"teamId": 493,
"timespan": 60000000,
"type": "",
"version": 9
}
}
]
}





 Error response codes 

The following table show common error response codes:



Table 1. RC

 RC Description 

 400 The alert configuration is not valid. 
 401 Unauthorized access. 
 404 The alert ID is not recognized. 
 409 There is a version mismatch. 
 422 The alert name is not valid. The name is already used. 







 Body parameters 



 id (integer) 

ID of an alert.





 condition (string) 

Defines the threshold that is configured for the alert. This parameter is required for MANUAL alerts only.
You can configure your systems to send email alerts, Slack notifications, or both.

To configure notifications when a quota threshold is exceeded, do the following:



1. Under Alert recipients select the desired recipient email addresses. There must be at least one email address configured if Slack notifcations are not configured.
2. If desired, select one or more Slack recipients to receive notifications. If you configure a Slack recipient, you can delete all email recipients if desired.
The name is used to identify the alert in the Alerts section of the monitoring UI, and it is included in notification emails.





 modifiedOn (integer) 

Defines when an alert was last modified in milliseconds.

This parameter defines the Unix-timestamp when the alert was last modified.





 notificationChannelIds (array) 

Lists the notification channels that are configured to notify when an alert is triggered.

Valid options are EMAIL, PAGER_DUTY, WEBHOOK, VICTOROPS, and SLACK.

"notificationChannelIds": [
"EMAIL",
"WEBHOOK"
]





 notificationCount (integer) 

Defines the number of notifications that are sent for the alert during the past 2 weeks.





 reNotify (boolean) 

Defines whether you want to get follow up notifications until the alert condition is acknowledged and resolved.

By default, follow up notifications are not enabled and the field is set to false.





 reNotifyMinutes (integer) 

Defines how often do you want to receive notifications on an alert that is not resolved.

You specify the number of minutes before a reminder is sent.





 severity (integer) 

Defines the syslog-encoded alert severity.

The following table lists the values that you can set:



Table 2. Severity values

 Severity Info 

 0 emergency 
 1 alert 
 2 critical 
 3 error 
 4 warning 
 5 notice 
 6 informational 
 7 debug 







 severityLabel (string) 

Defines the criticality of an alert. Valid values are HIGH, MEDIUM, LOW, and INFO. A lesser value indicates a higher severity.

The following table shows the severity status that must be set depending on the severity parameter value:



Table 3. Severity level values

 Severity Severity status 

 0 HIGH 
 1 HIGH 
 2 MEDIUM 
 3 MEDIUM 
 4 LOW 
 5 LOW 
 6 INFO 
 7 INFO 







 segmentBy (array of strings) 

Defines additional segmentation criteria.

For example, you can segment a CPU alert by ['host.mac', 'proc.name'] so the alert can report on any process in any machine for which you get data in the monitoring instance.
Set the following fields:

Name: Enter a name for the alert.

Description: Add a description that other users can read to get more context. This field is optional.

Group: The alert group this alert will be part of. If not specified, the alert will be part of the default group.

Severity: Set the level of criticality of the alert. Valid values are High, Medium, Low, and Info.

Metric: Configure the metric.

Scope: Configure the scope

Trigger: Define the condition and threshold value that must be evaluated. It also defines whether the alert sends a single alert or multiple alerts. Valid time scales are minute, hour, or day. A single alert fires an alert for the entire scope. Multiple Alerts are sent if 1 or more segments breach the threshold at once. An alert is sent for each segment that you specify.

Notification Channel: Enable 1 or more notification channels.







 Controlling the access to platform metrics for a team 

You can control the data that is visible to all the users that are members of a team.

First navigate to the Settings section.

Zoom

![Settings section](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/platform/images/sysdig-platform-12.png)

Settings

As an administrator of the service, you can create, modify, and delete teams. When you configure a team, you can define the scope of the data in the Visibility section.

To allow a team to view platform metrics, you must select Platform metrics.

Zoom

![Team platform metrics option](https://cloud.ibm.com/docs-content/v1/content/220cdcbf6f4421bd7fee83fd1028048dba3f16c8/monitoring/platform/images/sysdig-platform-10.png)

Team platform metrics

Enabling platform metrics, grants access to all platform metrics.
curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Policy","enabled":true,"alert_type":"load_balancing_pool_enablement_alert","mechanisms":{"email":[{"id":"cistestemail@ibm.com"}],"webhooks":[]},
“filters”: {
“enabled”: [
“false”,
“true”
],
“pool_id”: [
“6e67c08e3bae7eb398101d08def8a68a”,
“df2d9d70fcb194ea60d2e58397cb35a6”
]
}}'

Where:



* -d is the array of attributes required to create the alert.



* name is the name of the alert.
* enabled is the state of the alert (one of true, false).
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms is at least one of email, webhooks.
* description (optional) is the description of the alert.
* filter is the list of all enablement statuses and pool IDs for the pool toggle alert.









 WAF alert command 

To configure a WAF alert, use the following command: