Skip to main content

Custom Query Rules

(1) Define Rule​

  1. Source: Select the data source(s) that the query will be ran against. The default index patterns can be left as-is, but making the data source as specific as possible will make the rule more efficient when the query is run. For example cvah-winlogbeat.sysmon* is more efficient than cvah-*.

  2. Custom query: The KQL query that will filter for the specific logs that you want to alert on:

    tip
    • Saved searches may also be selected for use as the query
    • The query language can be swapped between KQL and Lucene
    • Filters can also be added to the query

  3. Optional - To test the rule logic, you can use the Rule Preview feature on the top of the page – this is not very useful if there isn’t any data to support your tests

  4. Optional - Timeline Template: Adding a timeline template will create an alert timeline with its search fields dynamically populated with fields from the alert. This is only effective if the timeline template's fields match the fields that will be present in the alerting log.

  5. Continue to the Rule Finalization section to complete the rule