vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* Smarts SAM Notification – sends alert notifications to EMC Smarts Server Assurance Manager.
* Network Share – sends reports to a shared location, supports SMB version 2.0.



Notifications are alert notifications that meet the filter criteria in the notification rules before they are sent northbound to external systems. Notification rules are configured for the required outbound alerts so that they can be filtered before they are sent to the selected external system. The notifications list is used to manage these rules.



 Integration use case 

This example use case is based on an existing generic service management layer that is used by an enterprise. The client provisioned a vCenter Server instance with the Operations Management option, and they want to integrate this platform into their service management platform. They use an event aggregation system to integrate the alerts generated from the domain-specific monitoring tools:



* A tool set to monitor the OS, middleware and applications across their UNIX®, Linux®, and Windows® workloads, but this tool does not monitor the infrastructure components like VMware®, networking devices, or storage.
* An SNMP manager to receive SNMP traps from their network infrastructure. This tool also collects SNMP metrics to enable performance and capacity alerts.
* A backup management tool to manage their backups.
* Storage management tools to manage their storage arrays.
* An availability tool that uses ping to test the devices reachability.



Their service management layer also consists of:



* A server capacity and performance tool to collect metrics to provide reports.
* A patching and compliance server to update OS, middleware, and applications and measure compliance on these platforms.
* A ticketing tool used to manage tickets for, incidents, problems, and changes. This tool is also the enterprise’s Configuration Management Database (CMDB). The tool is able to send emails to the operations teams and SMS messages.
* An enterprise logging system that captures logs from all systems and managed by the security team.



Now that they have VMware Aria Operations they can integrate this tool by using northbound notification that uses the SNMP Trap plug in.
Integrating with webhooks 

You can send alerts using webhooks.



 Configuring webhooks 

When you [configure an alert](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-alerts) you can have that alert sent to a webhook for use in another application.



1. When configuring your alert, click ![Webhook icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/alerts//images/webhook.png).
2. Select if you want the alert to be sent when the condition exists (Presence) or does not exist (Absence).
3. Indicate the logging criteria when an alert should be sent. For example, when 100 lines matching in the view are logged in an hour. A graph will help you determine the number of log lines matching your specified criteria.
4. Select if the alert should be sent at the end of the selected period or immediately when the number of lines are logged.
5. Optionally you can specify a Custom schedule with alerting limited to a specified timezone, days of the week, or timeframe. To configure a Custom schedule:



1. Select on for Custom schedule.
2. Select the Timezone for the log entries.
3. Select the days of the week when alerts should be generated.
4. Optionally specify a time range for the selected days. A graph will help you determine the number of log entries for the timezone and time range.



6. Specify the Method & URL for the webhook.
7. If your webhook requires specific header information, specify that in Headers. Multiple headers can be added by clicking Add.

Headers must be specified in all lower-case characters.
8.
'{"title":"Hello Firefox", "en_data":{"alert":"Hello firefox Notification","title":"firefox New Title","iconUrl":"https://","timeToLive":100,"payload":{"key":"value"}}}'
* The following example shows the format of apns/chrome/fireox custom headers.

{
"test": "test header",
"new": "newmessage"
}
* The following example shows the format of APNS message body to send notification to FCM devices.

{"data":{"alert":"alert","url":"https","badge":9,"sound":"bingbong.aiff","payload":"{\"fcm_devices\": \"cc75e4a6-edd8-3bec-a7c3-dfca6572a03b\"]}","type":"DEFAULT","subtitle":"dummy","title":"dummy1","body":"body","ios_action_key":"key","interactive_category":"interactiveCategory","title_loc_key":"titleLocKey","loc_key":"GAME_PLAY_REQUEST_FORMAT","launch_image":"image.png","title_loc_args":"Shelly","Rick"],"loc_args":"Shelly","Rick"]!,"attachment_url":"some url","apns_collapse_id":"12","apns_thread_id":"1","apns_group_summary_arg":"apnsGroupSummaryArg","apns_group_summary_arg_count":1}}
* The following example shows the format of body to send notification to slack destination.
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms is at least one of email, webhooks.
* description (optional) is the description of the alert.









 Load balancing health check alert command 

To configure a load balancing health check alert, use the following command:

curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Policy","enabled":true,"alert_type":"load_balancing_health_alert","mechanisms":{"email":[{"id":"cistestemail@ibm.com"}],"webhooks":[]},
“filters”: {
“event_source”: [
“pool”,
“origin”
],
“new_health”: [
“Healthy”,
“Unhealthy”
],
“pool_id”: [
“6e67c08e3bae7eb398101d08def8a68a”,
“df2d9d70fcb194ea60d2e58397cb35a6”
]
}}'

Where:



* -d is the array of attributes required to create the alert.



* name is the name of the alert.
* enabled is the state of the alert (one of true, false).
* --description value is the description for the alert policy.
* --emails value is the email addresses for dispatching an alert notification. For example, --emails test1@cn.ibm.com,test2@cn.ibm.com.
* --webhooks value is the webhook IDs for dispatching an alert notification. For example, --webhooks webhookID1,webhookID2.
* --enabled value determines whether the alert policy is enabled.
* --pools value is the IDs of origin pool. If set to all, all pool IDs are used.
* --trigger-condition value is the condition of pool toggle status.
* --include-future-pools value determines whether to include the future pools.
* -i, --instance value is the instance name or ID.
* --output value specifies the output format; only JSON is supported.







 Creating a security alert by using the CLI 

To create a security alert by using the CLI, run the following command:

ibmcloud cis alert-policy firewall-events-alert-create --name NAME (--emails EMAILS | --webhooks WEBHOOKS) --enabled (true | false) --domains DOMAINS [--services SERVICES] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name value is the name of the alert policy.
* --description value is the description for the alert policy.
* --emails value is the email addresses for dispatching an alert notification. For example, --emails test1@cn.ibm.com,test2@cn.ibm.com.
* --webhooks value is the webhook IDs for dispatching an alert notification. For example, --webhooks webhookID1,webhookID2.
* --domains value is the domain IDs for the alert policy. For example, --domains domainID1,domainID2.
* --services value specifies which services the alert monitors (for advanced security alerts).
The alert definition must be saved for alerts to be sent to your webhook.







 How to add additional fields to the webhook body 

If you need additional fields to be included in your webhook body and the JSON tokens that are provided are not enough, try the following:



1. Set the line template of the view where you configure a webhook notification so that it includes the additional data that you need in your webhook body. For more information, see [Guidelines defining line templates](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-view_logsviews_line).
2. Add to your webhook body the JSON token {{ line }} so that the information is included.
Integrating with email 

You can send alerts to 1 or more email addresses.



 Configuring email 

When you [configure an alert](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-alerts) you can have that alert sent to 1 or more email addresses.



1. When configuring your alert, click ![email icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/alerts/images/email.png).
2. Select if you want the alert to be sent when the condition exists (Presence) or does not exist (Absence).
3. Indicate the logging criteria when an alert should be sent. For example, when 100 lines matching in the view are logged in an hour. A graph will help you determine the number of log lines matching your specified criteria.
4. Select if the alert should be sent at the end of the selected period or immediately when the number of lines are logged.
5. Optionally you can specify a Custom schedule with alerting limited to a specified timezone, days of the week, or timeframe. To configure a Custom schedule:



1. Select on for Custom schedule.
2. Select the Timezone for the log entries.
3. Select the days of the week when alerts should be generated.
4. Optionally specify a time range for the selected days. A graph will help you determine the number of log entries for the timezone and time range.



6. Specify 1 or more email addresses.
7. Optional: You can click Test to test that your alert configuration is correct.
8. Click Save Alert.







 Muting an alert 

This section only applies to email alerts.

After you configure an alert on a view and receive a notification email, complete the following steps to mute the alert a period of time:



1.
This alert will show all thresholds that have been exceeded during the period. If index rate alerts are configured on each separate threshold, an alert will be sent indicating the first threshold crossed (either Max lines/s, Max z-score, or both).





 Types of index rate alerts 

There are two types of index rate alerts:



* Max lines/s alerts: Use this alert to monitor and control the number of log lines per second that are indexed and stored for search.



* To monitor high flow rates, set an index rate threshold by configuring the max lines alert field so that you can get an alert when the value of lines per second is exceeded.
* When the average index rate changes over time, you must review and configure the threshold accordingly.



* Max z-score alerts: Use this alert to monitor and control anomalous flow rates.



* To monitor for spikes on logs and anomalous flow rates, set a threshold value by configuring the max z-score field so that you can get an alert when the hourly index rate is significantly higher than the monthly mean.
* The baseline value is calculated using data from the last 30 days.



After you provision an instance, you must wait a minimum of 30 days of data that has been indexed to use this feature.



* Each z-score represents 1 standard deviation that is based on the distribution of index rates as seen over the past 30 days.

0, 1 indicates a small spike of data.

3 indicates a spike of data that requires troubleshooting and control.

5 indicates a spike of data that requires quick action such as defining exclusion rules while you find out what source and app are causing a spike of data.



Setting a maximum of 3 standard deviations is a good starting point for alert triggering. You can then refine your alerting based on your needs.







 Launch the index rate alert page 

The index rate alert page offers an overview of your account's current rate of ingestion and indexing of searchable data. Through this page, you can see the ratio between the log lines that are ingested versus the number of log lines that are being stored.

To use the index rate feature on an instance, an administrator of the service must turn on the feature.
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* --domains are the domain IDs for the alert policy. For example: --domains domainID1,domainID2
* --services (Advanced WAF) specifies which services the alert monitors. Valid values: "country-access-rules", "waf", "firewall-rules", "ratelimit", "securitylevel", "ip-access-rules", "browser-integrity-check", "ua-rules", "lockdowns", "iprange-access-rules", "asn-access-rules", "Managed-firewall".
* -i, --instance is the instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.
* --output specifies the output format; only JSON is supported.







 Universal SSL alert command 

Create an alert policy for certificate events.

ibmcloud cis alert-policy certificate-alert-create --type (universal | dedicated) --name NAME (--emails EMAILS | --webhooks WEBHOOKS) --enabled (true | false) [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --type is the type of the certificate.
* --name is the name of the alert policy.
* --description is the description for the alert policy.
* --emails is the email addresses for dispatching an alert notification. For example: --emails test1@cn.ibm.com,test2@cn.ibm.com
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* -i, --instance is the instance name or ID.
Creating alerts through the UI 

You can create alerts graphically through the UI.

Complete the following steps to create an alert:



 Prereqs 

You must grant permissions to users in your account to be able to launch the web UI and create alerts.

You must be an administrator of the IBM Cloud Activity Tracker service, an administrator of the IBM Cloud Activity Tracker instance, or have account IAM permissions to grant other users policies.

The following table lists the minimum policies that a user must have to be able to launch the IBM Cloud Activity Tracker Web UI, and view events:



Table 1. IAM policies

 Service Role Permission granted 

 IBM Cloud Activity Tracker Platform role: Viewer Allows the user to view the list of service instances in the Observability Logging dashboard. 
 IBM Cloud Activity Tracker Service role: Manager or Standard-member Allows the user to launch the Web UI and create alerts. 



For more information on how to configure these policies for a user, see [Granting permissions to a user to view events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam_view_events).





 Step 1. Define the rule 

You must define the rule that specifies the scope of the data and save the rule as a view.

Complete the following steps to create a rule:



1. [Launch the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launch).
2. Filter event data by using pre-defined filters.

You can filter events by event source, and event level.

Complete the following steps to filter events:



1. Click the Views icon ![Views icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/alerts/images/views.png).
2. Select Everything or a view.
3. Expand Sources to see the list of event sources that are identified in the events.
* <ALERT_ID> defines the ID of the alert that you want to modify.



For example, the response body for an alert looks as follows:

{
"alert": {
"autoCreated": false,
"condition": "min(min(dallas_prod)) = 0",
"createdOn": 1551358413000,
"enabled": false,
"id": 23211,
"modifiedOn": 1551634372000,
"name": "Monitoring Uptime Alert",
"filter": "env in ("prod")",
"notificationChannelIds": [
4
],
"segmentBy": [
"host.hostname"
],
"segmentCondition": {
"type": "ANY"
},
"notificationCount": 60,
"rateOfChange": false,
"reNotify": false,
"severity": 0,
"severityLabel": "HIGH",
"teamId": 493,
"timespan": 60000000,
"type": "MANUAL",
"version": 9
}
}





 Create an alert 

You can use the following cURL command to create an alert:

curl -X POST <REST_API_ENDPOINT>/api/alerts -H "Authorization: $AUTH_TOKEN" -H "IBMInstanceID: $GUID" -H "TeamID: $TEAM_ID" -H "content-type: application/json" -d @alert.json

Where



* <REST_API_ENDPOINT> indicates the endpoint targetted by the REST API call. For more information, see [Monitoring REST API endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpointsendpoints_rest_api). For example, the public endpoint for an instance that is available in us-south is the following: https://us-south.monitoring.cloud.ibm.com/api
For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* --pools are the IDs of origin pool. If set to all, all the pool IDs are used.
* --include-future-pools sets whether or not include the future pools (default "false").
* --health-status-trigger is the trigger condition to fire the notification. Valid values: "healthy", "unhealthy", "either" (default "either").
* --event-source-trigger is the event source of trigger to fire the notification. Valid values: "pool", "origin", "either" (default "either").
* -i, --instance is the instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.
* --output specifies the output format; only JSON is supported.









 Creating an email alert using the API 

To create an email alert, take the following steps:



1. Log in to your IBM Cloud account.
2. Get a token.
3. Using that token, run one of the following commands:





 DDoS attack layer 7 command 

curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/policies -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Policy","enabled":true,"alert_type":"dos_attack_l7","mechanisms":{"email":[{"id":"cistestemail@ibm.com"}],"webhooks":[]}}'

Where:



* -d is the array of attributes required to create the alert.



* name is the name of the alert.
* enabled is the state of the alert (one of true, false).
Alarms 



 Introduction 

VMware vSphere® includes an events and alarms subsystem, which tracks events that occur in the vSphere environment and makes this information available in vCenter. The following terminology is used in this subsystem.



 Events 

Events are records of system or user actions that occur on objects in vCenter such as hosts and virtual machines (VMs). Event data includes details about the event such as who generated it, when it occurred, and what type of event it is. In the vSphere Web Client, event data is displayed in the Monitor tab.

The following are event classifications.



* Error - Indicates that an unrecoverable problem occurred in the system and ends the process or operation.
* Warning - Indicates a potential risk to the system, which needs to be fixed. This event does not end the process or operation.
* Information - Describes that the user or system operation is completed successfully.
* Audit - The audit log data includes information about what is the action, who did it, when it occurred, and the IP address of the user.







 Alarms 

Alarms are notifications that are activated in response to an event, a set of conditions, or the state of an inventory object.

An alarm definition consists of the following elements in the vSphere Client.



* Name and description - Provides an identifying label and description.
* Targets - Defines the type of object that is monitored.
* Alarm Rules - Defines the event, condition, or state that triggers the alarm and defines the notification severity. It also defines operations that occur in response to triggered alarms.
* Last modified - The last modified date and time of the defined alarm.



Alarms have the following severity levels.



* Normal – green.
* Warning – yellow.
* Alert – red.







 Alarm definition 

Alarm definitions are associated with the object that is selected in the inventory and monitors the type of inventory objects that are specified in its definition.

An alarm definition consists of the following elements.



* Name and description - Provides an identifying label and description.
* Alarm type - Defines the type of object that is monitored.
* Triggers - Defines the event, condition, or state that triggers the alarm and defines the notification severity.
* Multiple email addresses can be specified, separated by comma.
* All announcement categories (Alert, Announcement, Incident, Maintenance, Security) are selected by default. Click the down arrow on the Subscribe to field to uncheck any announcement types you do not wish to receive. For a description of the announcement categories, see the table below. All recipients entered in the Email field will receive the selected types.
* Read the Privacy Policy terms
* Select the Subscribe button
* You can also unsubscribe to notifications by using the Subscription button, clicking the Unsubscribe to Notifications button and entering the email address.





 Category Description 

 Alert Automatically generated system alerts. (Note: Alerts are not currently configured for use, but will be at a later date.) 
 Announcement General announcements regarding the MAS-MS and MAS-Dedicated platform. 
 Incident Communication of a security incident or breach. 
 Maintenance Planned maintenance windows including initial announcement and status of maintenance work in progress. 
 Security Security specific announcements or planned maintenance related to a security issue. 



If you have an environment that is not operational and you have not received a CCC notification regarding an outage, please submit a [support case](https://www.ibm.com/mysupport) with the environment URL and any further details. Production environments can be submitted as a Sev 1. Non-Production environments can be submitted as a Sev 2.



* RSS Feed



Select the RSS feed icon to view feeds and add the URL to your Feed viewer
For example, the following shows a view named "My View" that was created without an assigned category.

![Navigation example](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/uncategorized_myview.png)
4. Click the selected view name. The following example shows the view named "My View".

![My View view](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/myview.png)
5. Click the view name. The menu is displayed. Click Attach an alert

![Edit view properties](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/editviewproperties.png)
6. Click View-specific alert.
7. Click Email.
8. Configure the alert.

![Configure alert](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/configalert.png)



1. Specify when the alert will be triggered, and an email sent. For this example specify When 5 or more matches appear within 30 seconds.
2. Select the email addresses of the Recipients who should receive the alert.
3. Click Save Alert.



9. Check the configured email for an alert.