vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For example: --webhook webhookID1,webhookID2--enabled: Whether or not the alert policy is enabled.--pools: The IDs of origin pool, if set to all, the all pool IDs will be used.--include-future-pools: Whether or not include the future pools. (default "false")--health-status-trigger: The trigger condition to fire the notification. Valid values: "healthy", "unhealthy", "either". (default "either")--event-source-trigger: The event source of trigger to fire the notification. Valid values: "pool", "origin", "either". (default "either")-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-opt-update-glb-healthcheck-alert" "> --><-- <section "id="section-update-glb-healthcheck-alert-examples" "> --> Examples Update a certificate alert policy a2633e68-1a64-2512-a321-b64a17c7db7a. ibmcloud cis alert-policy glb-healthcheck-alert-update a2633e68-1a64-2512-a321-b64a17c7db7a --name test1 --emails test1@cn.ibm.com --enabled true --pools all --include-future-pools true -i "cis-demo"
<-- </section "id="section-update-glb-healthcheck-alert-examples" "> --><-- </section "id="section-update-glb-healthcheck-alert" "> --><-- <section "id="section-delete-alert-policy" "> --> ibmcloud cis alert-policy delete Delete an alert policy.
: Information about the alert.

--type <TYPE>
: Type of alert. Valid values are MANUAL, BASELINE, and HOST_COMPARISON.

--timespan <TIMESPAN>
: Minimum time interval, in microseconds, for which the alert condition must be met before the alert is triggered. The default value is 60,000,000 microseconds.

--condition <CONDITION>
: Threshold of the alert. This parameter is required for manual alerts, and does not apply to other alert types.

--severity <SEVERITY> | -s <SEVERITY>
: Level of severity. Valid values range from 0 to 7. 0 means emergency and 7 means debug. By default, severity is set to 4.

--severity-label <LOW | MEDIUM | HIGH>
: Criticality of an alert. Valid values are HIGH, MEDIUM, LOW. A lower severity value indicates a higher severity.

--disable
: State of the alert. By default, an alert is enabled when it is created. You must set this parameter to disable the alert when it is created.

--segment <SEGMENT>
: Additional segmentation criteria. For example, you can segment an alert by ['host.mac', 'proc.name'].

--segment-condition <SEGMENT_CONDITION>
: Defines when the alert is triggered for each monitored entity that is specified in the --segment parameter. This parameter is required for manual alerts, and does not apply to other alert types. Valid values are ANY and ALL. ANY indicates that the alert is triggered when at least one of the monitored entities satisfies the condition. ALL indicates that the alert is triggered when all of the monitored entities satisfy the condition.

--user-filter <USER_FILTER>
: Boolean expression that you can set to reduce the scope of the alert. Use this parameter to configure segments, such as filters like kubernetes.namespace.name='production' or container.image='nginx'.

--notify <NOTIFY>
: Type of notification that you want this alert to generate.
: List options available for the command.





 Examples 

The following are examples using the ibmcloud monitoring alert get command.

Get details for an alert with ID 1234567 for the IBM Cloud Monitoring abc instance.

ibmcloud monitoring alert get --name "IBM Cloud Monitoring abc" --id 1234567

Get details for an alert with ID 1234567 for the IBM Cloud Monitoring abc instance in the us-south region.

ibmcloud monitoring alert get --name "IBM Cloud Monitoring abc" --id 1234567 --region us-south







 ibmcloud monitoring alert update 

Use this command to modify an alert by using a JSON file.

To update of an alert, you must modify the JSON file that you get by running the ibmcloud monitoring alert get command.

ibmcloud monitoring alert update --name NAME --id ALERT_ID --file JSON_FILE [--region REGION] [--output FORMAT] [--team TEAM_NAME]



 Command options 

--name <NAME> | --n <NAME>
: Name of the instance.

--id <ALERT_ID>
: ID of the alert.

--file <FILE> | -f <JSON_FILE>
: Name of the JSON file that contains the data with the alert definition. Make sure you create or modify the alert.json file before invoking this command.

--region <REGION> | -r <REGION>
: Name of the region, for example, us-south or eu-gb. If not specified, the region logged into or targeted will be used.

--output <TYPE>
: A comma-separated list of output preferences enclosed in double-quotes ("). If only a single preference is specified, the double-quotes can be omitted. Supported options are WIDE and JSON.

If JSON is specified, output will be returned in JSON format. If JSON is not specified, output will be returned in a tabular format.

WIDE returns additional details in the output.

--team <TEAM_NAME>
: The name of the IBM Cloud Monitoring team to be used for authorization.
* UI
* CLI
* API







 Configuring alert policies 

IBM Cloud® Internet Services has alerts that you can configure through the API to warn you when events occur.

See [Configuring webhooks](https://cloud.ibm.com/docs/cis?topic=cis-configuring-webhooks) for detailed instructions on using webhooks.

Alerts are available only to Enterprise plans.



 Types of alerts 

CIS offers the following alert types:



* DDoS attack layer 7 alerts are intended for WAF and CDN customers who want to receive a notification when an attack is mitigated.

No action is necessary if you receive a DDoS attack layer 7 alert. Each alert includes a short description, the time the attack was detected and mitigated, the attack type, its maximum rate of attack, and the target.
* Pool toggle alerts notify when the pool is enabled or disabled manually.

No action is necessary if you receive a pool toggle alert. Each alert includes the state that the pool was toggled to, the time it occurred, and which user made the change.
* Security alerts include WAF alerts and Advanced WAF alerts.



* WAF alerts look for spikes across all services that generate log entries in firewall events. The mean time to detection is 2 hours.
* Advanced WAF alerts. You can select the services to monitor, and each selected service is monitored separately. The mean time to detection is 5 minutes.



* Certificate alerts include alerts that your Universal SSL and Dedicated/Advanced certificates need to be renewed.



* Universal SSL certificates are automatically refreshed and no user action is required.
* Dedicated/Advanced receive notification for validation, issuance renewal, and expiration of Dedicated/Advanced certificates.



* Load-balancing health check alerts are sent when a change occurs in the health status of a load-balancing health check.







 Configuring alert policies by using the console 

Use the console to create, update, and delete alerting policies.

To configure alert policies by using the console, navigate to your Account page and select the Alerts tab.
* Alerts are executed in 1 minute or less from receipt, with the option to configure the trigger wait time by hour or day.
* For PromQL alerts only, you can optionally configure a 0 minute wait time.



You can enable predefined alerts, modify alerts, and create custom alerts in the web UI and by using the IBM Cloud Monitoring API.

You manage alerts in the Alerts view of the web UI. You can configure the table columns that are displayed in the Alerts view. Valid column options are Name, Scope, Alert When, Segment By, Notifications, Enabled, Modified, Captures, Channels, Created, Description, Email recipients, For at least, OpsGenie, PagerDuty, Severity, Slack, WebHook, Type, and VictorOps.



 Types of alerts 

The IBM Cloud Monitoring service includes pre-defined alerts that you can enable. In addition, you can configure custom alerts from panels in a dashboard, by using the REST API, or in the Alerts section of the web UI.

In the IBM Cloud Monitoring service, you can define any of the following types of alerts:



* Downtime: Use this type of alert to monitor sources and alert when they are down, for example, a bare metal.
* Metric: Use this type of alert to monitor time-series metrics and alert when they reach the thresholds defined.
* PromQL: Use this type of metric to monitor metrics by using a PromQL query.
* Event: Use this type of alert to monitor occurrences of specific events and alert when they reach the thresholds defined. For example, you can use this alert to monitor when a number of unauthorize access requests are reported.
* Anomaly Detection: Use this type of alert to monitor hosts based on historical behaviors and alert when they deviate from the expected pattern.

This type of alert is deprecated. You can only manage existing alerts of this type.
* Group Outlier: Use this type of alert to monitor hosts and be notified when 1 acts differently from the rest.

This type of alert is deprecated. You can only manage existing alerts of this type.







 Notification channels
For example: --emails test1@cn.ibm.com,test2@cn.ibm.com
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* -i, --instance is the instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.
* --output specifies the output format; only JSON is supported.







 Load balancing health check alert command 

Create an alert policy for changes in health status for global load balancer, pools, and origins.

ibmcloud cis alert-policy glb-healthcheck-alert-create --name NAME (--emails EMAILS | --webhooks WEBHOOKS) --enabled (true | false) --pools POOLS [--include-future-pools (true | false)] [--health-status-trigger (healthy | unhealthy | either)] [--event-source-trigger (pool | origin | either)] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name is the name of the alert policy.
* --description is the description for the alert policy.
* --emails is the email addresses for dispatching an alert notification. For example: --emails test1@cn.ibm.com,test2@cn.ibm.com
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* --pools are the IDs of origin pool. If set to all, all the pool IDs are used.
* --include-future-pools sets whether or not include the future pools (default "false").
* --health-status-trigger is the trigger condition to fire the notification.
* You can [define presets](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-alertsalerts_step3). A preset is an alert template that users can attach to any number of views. Service administrators define presets. Notice that when you delete a preset, any alerts that are defined by using this preset are automatically deleted.
* You can enable or disable the feature on alerts that allows a user to mute an alert for a period of time. This feature only applies to email notification channels.
* You can [detach an alert](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-alertsalerts_delete_view) from a view.
* The timestamp that you see in a notification is set to UTC. For email notifications, you can set the Timezone to define a different timestamp value such as local time.





 Presence alert 

Configure a presence alert to notify when the number of events that show in a view is more than what you expect.

For example, you might have a view that shows events that report the deletion of service instances in your account. You are not expecting the deletion of service instances. You can configure a presence alert that triggers an alert when 1 or more events show in the view.





 Absence alert 

Configure an absence alert to notify when the number of events that show in a view is less than what you expect, or none.

An absence alert is triggered when the view that has an absence alert attached to it is active. A view is active when the view receives events within the last 24 hours.

For example, you might have a view that does not get any events for 2 days. Therefore, this view is not active. You have an absence alert attached to this view that is configured to send a notification after 30 minutes. Because the view is not active, the absence alert is muted and you do not get notifications. To make the view active and get notifications for the absence condition, events need to start flowing into the view.





 Alert conditions
* A time range specified an interval of time, such as yesterday 10am to yesterday 11am.







 Configuring alerts 

There are scenarios where you might want to be notified if specific events are generated in your account. For example, you might want to be notified if the number of actions that fail goes over a specified threshold.

Through the IBM Cloud Activity Tracker web UI, you can apply search queries to define the events that are displayed through a custom view. Then, you can attach an alert to that view to be notified when a condition occurs. A bell icon is displayed with the view to indicate that this view has an alert attached to it.

When you configure alerts:



* You can [attach one alert](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-alerts) per custom view. There are 2 types of alerts: presence alert and absence alert.
* You can configure conditions that are based on the number of event lines that meet the search query in the view, on a time frequency, or both. The time frequency that is specified as part of the condition defines the reset time of an alert after it is triggered.
* You can define multiple notification channels for an alert. For information about the supported channels, see [Alert notification channels](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-channels).
* You can [define presets](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-alertsalerts_step3). A preset is an alert template that users can attach to any number of views. Service administrators define presets. Notice that when you delete a preset, any alerts that are defined by using this preset are automatically deleted.
* You can enable or disable the feature on alerts that allows a user to mute an alert for a period of time. This feature only applies to email notification channels.
SI-4 (5) - System-generated Alerts 



  Control requirements 

SI-4 (5) - 0
:   The information system alerts [Assignment: organization-defined personnel or roles] when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].





  NIST supplemental guidance 

Alerts may be generated from a variety of sources, including, for example, audit records or inputs from malicious code protection mechanisms, intrusion detection or prevention mechanisms, or boundary protection devices such as firewalls, gateways, and routers. Alerts can be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. Organizational personnel on the notification list can include, for example, system administrators, mission/business owners, system owners, or information system security officers.
“6e67c08e3bae7eb398101d08def8a68a”,
“df2d9d70fcb194ea60d2e58397cb35a6”
]
}}'

Where:



* -d is the array of attributes required to create the alert.



* name is the name of the alert.
* enabled is the state of the alert (one of true, false).
* alert_type is the type of the alert (one of dos_attack_l7, load_balancing_pool_enablement_alert, clickhouse_alert_fw_anomaly, clickhouse_alert_fw_ent_anomaly, dedicated_ssl_certificate_event_type, universal_ssl_event_type, or load_balancing_health_alert).
* mechanisms is at least one of email, webhooks.
* description (optional) is the description of the alert.
* filter is the list of all sources, pools, health status for the load balancing health alert.











 Creating webhook alerts using the API 

Creating a webhook alert is a two-step process.



1. Send the following request to create a webhook:

curl -X POST https://api.cis.cloud.ibm.com/v1/:crn/alerting/destinations/webhooks -H 'content-type: application/json' -H 'x-auth-user-token: Bearer xxxxxx' -d '{"name":"Example Webhook","url":"https://hooks.slack.com/services/Ds3fdBFbV/456464Gdd"}'

The following response is returned:

{
"result": {
"id": "6d16fcab3e8044b3b59ba3716237832e"
},
"success": true,
"errors": [],
"messages": []
}
2. Use the ID in the response that you receive to create the alert:
<-- </section "id="section-show-alert-policy-examples" "> --><-- </section "id="section-show-alert-policy" "> --><-- <section "id="section-create-ddos-attack-l7-alert" "> --> ibmcloud cis alert-policy ddos-attack-l7-alert-create Create an alert policy for DDoS attack l7. ibmcloud cis alert-policy ddos-attack-l7-alert-create --name NAME (--emails EMAILS | --webhooks WEBHOOKS) --enabled (true | false) --description DESCRIPTION] -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-opt-create-ddos-attack-l7-alert" "> --> Command options --name: The name of the alert policy.--description: The description for the alert policy.--emails: The email addresses for dispatching an alert notification. For example: --emails test1@cn.ibm.com,test2@cn.ibm.com--webhooks: The webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2--enabled: Whether or not the alert policy is enabled.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-opt-create-ddos-attack-l7-alert" "> --><-- <section "id="section-create-ddos-attack-l7-alert-examples" "> --> Examples Create a ddos attack alert policy for instance cis-demo.
For example: --webhook webhookID1,webhookID2--enabled: Whether or not the alert policy is enabled.--pools: The IDs of origin pool, if set to all, the all pool IDs will be used.--include-future-pools: Whether or not include the future pools. (default "false")--health-status-trigger: The trigger condition to fire the notification. Valid values: "healthy", "unhealthy", "either". (default "either")--event-source-trigger: The event source of trigger to fire the notification. Valid values: "pool", "origin", "either". (default "either")-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-opt-create-glb-healthcheck-alert" "> --><-- <section "id="section-create-glb-healthcheck-alert-examples" "> --> Examples Create a glb healthcheck alert policy for instance cis-demo. ibmcloud cis alert-policy glb-healthcheck-alert-create --name test1 --emails test1@cn.ibm.com --enabled true --pools all --include-future-pools true -i "cis-demo"
<-- </section "id="section-create-glb-healthcheck-alert-examples" "> --><-- </section "id="section-create-glb-healthcheck-alert" "> --><-- <section "id="section-update-ddos-attack-l7-alert" "> --> ibmcloud cis alert-policy ddos-attack-l7-alert-update Update an alert policy for DDos attack l7.
* You can enable or disable the feature on alerts that allow a user to mute an alert for a period of time. This feature only applies to email notification channels.
* You can [detach an alert](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-remove_alert_ui) from a view.
* The timestamp that you see in a notification is set to UTC. For email notifications, you can set the Timezone to define a different timestamp value such as local time, for example.





 Presence alert 

Configure a presence alert to notify when the number of logs that show in a view is more than what you expect.

For example, you might have a view that shows logs that report the deletion of service instances in your account. You are not expecting the deletion of service instances. You can configure a presence alert that triggers an alert when 1 or more logs show in the view.





 Absence alert 

Configure an absence alert to notify when the number of logs that show in a view is less than what you expect, or none.

Consider the following information when you configure an absence alert:



* An absence alert is enabled when the view receives at least 1 log line.
* An absence alert is triggered when the view that has an absence alert attached to it is active. A view is active when the view receives logs within the last 24 hours.



For example, you might have a view that does not get any logs for 2 days. Therefore, this view is not active. You have an absence alert attached to this view that is configured to send a notification after 30 minutes. Because the view is not active, the absence alert is muted and you do not get notifications. To make the view active and get notifications for the absence condition, logs need to start flowing into the view.





 Alert conditions 

You can configure any of the following conditions for an alert:



* Time frequency: You set this condition to specify how often to trigger an alert. Valid values are: 30 seconds, 1 minute, 5 minutes, 15 minutes, 30 minutes, 1 hour, 6 hours, 12 hours, 24 hours
For example: --emails test1@cn.ibm.com,test2@cn.ibm.com
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* -i, --instance is the instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.
* --output specifies the output format; only JSON is supported.







 Pool toggle alert command 

Create an alert policy for pool toogle alerts.

ibmcloud cis alert-policy pool-toggle-alert-create --name NAME (--emails EMAILS | --webhooks WEBHOOKS) --enabled (true | false) --pools POOLS --trigger-condition (enabled | disabled | either) [--include-future-pools (true | false)] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name is the name of the alert policy.
* --description is the description for the alert policy.
* --emails is the email addresses for dispatching an alert notification. For example: --emails test1@cn.ibm.com,test2@cn.ibm.com
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* --pools is the IDs of origin pool, if set to all, the all pool IDs will be used.
* --trigger-condition is the condition of pool toggle status.
* --include-future-pools sets whether or not include the future pools.
* -i, --instance is the instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.
* --output specifies the output format; only JSON is supported.