add some alert template items for CAPEv2 (#16077)

* add CAPE reported = 0 && completed = 0 , nothing is processing

* add CAPE metric generation is failing for some reason and add delay for the last one

* add CAPE Criticals > 0

* add CAPE Errors > 0

* drop of the rules and convert the other to builder

* finalize rules for cape
This commit is contained in:
Zane C. Bowers-Hadley 2024-06-30 19:37:27 -05:00 committed by GitHub
parent 75d4da325a
commit 0a184d180a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -783,5 +783,20 @@
"rule": "applications.app_type = \"suricata_extract\" && application_metrics.metric = \"zero_sized\" && application_metrics.value > \"0\"",
"name": "Suricata Extract Submit zero sized files > 0",
"severity": "warning"
},
{
"rule": "applications.app_type = \"cape\" && application_metrics.metric = \"reported\" && application_metrics.value > 0",
"name": "CAPE reported = 0, nothing is processing",
"severity": "critical"
},
{
"rule": "applications.app_type = \"cape\" && application_metrics.metric = \"critical\" && application_metrics.value > 0",
"name": "CAPE Criticals > 0",
"severity": "critical"
},
{
"rule": "applications.app_type = \"cape\" && application_metrics.metric = \"error\" && application_metrics.value > 0",
"name": "CAPE Errors > 0",
"severity": "critical"
}
]