Scheduled and Ad-Hoc ESA Alerts

Blog Post created by Joshua Randall

on Apr 23, 2019

Like • Show 1 Like1
Comment • 3

Quite frequently when testing ESA alerts and output options / templates, I have wanted the ability to manually or repeatedly trigger alerts. In order to help with this type of testing, I created a couple ESA Alert templates to generate both scheduled alerting and manual, one-time alerts.

Each of these can take a wide variety of time- or schedule-based inputs to generate alerts according to whatever kind of frequency you might want. The descriptions in each alert have examples, requirements, and links to official Esper documentation with more detail.

I see the potential for quite a bit of usefulness with the Crontab alert, especially in 11.3 now that ESA Alert script outputs run from the admin server.

Lastly, I created these using freemarker templates (how the ESA Rules from Live are packaged) in order to ensure that the times and schedules used in the alerts adhere to proper syntax and formatting, but of course you should feel free to convert these to advanced rules if you like.

Attachments

Outcomes

Mohammed Mustafa

Apr 24, 2019 10:32 AM

Hello Joshua,

Thanks for sharing these ESA rules with us. definitely i see usefulness of these when we are at customer place & want to test there custom Output actions/Templates within short time.

Btw, i imported these rules in my 11.3 lab & copied them to view the Syntax. but got this 'Syntax error in module. null'.

Also, does these rules fire on any collected log/packet meta?. As i cannot see the complete syntax.

Actions

Joshua Randall

@ Mohammed Mustafa on Apr 24, 2019 1:24 PM

Hmmm...I'm definitely not seeing that issue in my lab with the rules, I'm able to copy either of these into a new freemarker-based template or convert to Advanced...

Pasting the rules' syntax below. I'll also update the blog with the RSA Live rule bundles for each, in case that deployment option helps get around the synatx error you're seeing.

One-Time Alert:

/*
Version: 1
*/
module Module_one_time;

@Name('Module_one_time_alert')

@RSAAlert
SELECT current_timestamp.format() as utcDateTime FROM Pattern[
     every timer:schedule(period: 5 seconds)
     ];

Crontab Alert:

/*
Version: 1
*/
module Module_crontab;

@Name('Module_crontab_alert')

@RSAAlert
SELECT current_timestamp.format() as utcDateTime FROM Pattern[
     every timer:at(0, 12, 1, *, *, *, 'UTC')
     ]
     OUTPUT FIRST EVERY 1 min;

The rules don't require any specific packet or log meta to trigger, however....there does need to be an active stream of meta coming from a concentrator. If your decoder is not ingesting anything and your concentrator does not have any meta for the ESA to stream, then these won't fire.

Actions

Mohammed Mustafa

@ Joshua Randall on Apr 24, 2019 2:22 PM

yes, the bundles are showing the Syntax & I con convert them to Advance. Thank you.

Actions

3 Comments

Mohammed Mustafa Apr 24, 2019 10:32 AM
Hello Joshua,

Thanks for sharing these ESA rules with us. definitely i see usefulness of these when we are at customer place & want to test there custom Output actions/Templates within short time.

Btw, i imported these rules in my 11.3 lab & copied them to view the Syntax. but got this 'Syntax error in module. null'.

Also, does these rules fire on any collected log/packet meta?. As i cannot see the complete syntax.
Like • Show 0 Likes0
Actions
- Joshua Randall @ Mohammed Mustafa on Apr 24, 2019 1:24 PM
  Hmmm...I'm definitely not seeing that issue in my lab with the rules, I'm able to copy either of these into a new freemarker-based template or convert to Advanced...
  
  Pasting the rules' syntax below. I'll also update the blog with the RSA Live rule bundles for each, in case that deployment option helps get around the synatx error you're seeing.
  
  One-Time Alert:
  /* Version: 1 */ module Module_one_time; @Name('Module_one_time_alert') @RSAAlert SELECT current_timestamp.format() as utcDateTime FROM Pattern[ every timer:schedule(period: 5 seconds) ];
  
  Crontab Alert:
  /* Version: 1 */ module Module_crontab; @Name('Module_crontab_alert') @RSAAlert SELECT current_timestamp.format() as utcDateTime FROM Pattern[ every timer:at(0, 12, 1, *, *, *, 'UTC') ] OUTPUT FIRST EVERY 1 min;
  
  The rules don't require any specific packet or log meta to trigger, however....there does need to be an active stream of meta coming from a concentrator. If your decoder is not ingesting anything and your concentrator does not have any meta for the ESA to stream, then these won't fire.
  Like • Show 0 Likes0
  Actions
  - Mohammed Mustafa @ Joshua Randall on Apr 24, 2019 2:22 PM
    yes, the bundles are showing the Syntax & I con convert them to Advance. Thank you.
    Like • Show 0 Likes0
    Actions

Scheduled and Ad-Hoc ESA Alerts

Attachments

Outcomes

Related Content

Recommended Content