Alert Logic Log Manager alert rules

Alert Logic provides two types of alert rules in Log Manager to protect you operationally and improve security:

• Collection alert rules assist with operations monitoring and trigger when Alert Logic does not collect log messages from a log source in the time window you provide. For example, you can configure a collection alert to send an email if a firewall that sends log messages often does not send any after an hour.
• Correlation alert rules can improve your security posture. They trigger when Alert Logic detects log messages that match criteria you give, including the message type. For example, you can configure a correlation alert to send an email if a correlation policy detects more than five failed logins to a server in 15 minutes.

Access Log Management alert rules

To access the Log Manager Alert Rules page, click CONFIGURATION, click Log Management, and then click Alert Rules.

Work with collection alert rules

Create and apply a collection alert rule

You can create a collection alert in Alert Logic Log Manager to notify you if Alert Logic does not receive log messages for some log sources for a period of time.

First you create the alert, which defines the email addresses that receive alerts and the conditions that trigger the alert. Then you associate the alert rule with specific log sources to monitor.

To create a collection alert rule:

1. Navigate to the Log Management Alert Rules page, and then click Collection.
2. Click the Add icon ().
3. In Collection Alert Name, type a descriptive name.
4. In Time Before Alert is Triggered, type a number of minutes. If Alert Logic collects no logs in this time, an alert is triggered.
5. In Time Between Alert Occurrences, type a number of minutes. This time period specifies how frequently Alert Logic sends the collection alert again when collection of log messages is interrupted for a long period of time.

6. In Email Addresses, type an email address. To add multiple email addresses, separate each entry with a comma. You can also search for an email address in the drop-down menu.
7. Select Send Alert Once to receive alerts only once.
8. Click Save

After you create the collection alert, you must apply the alert to a log source.

To apply the collection alert to a log source:

1. In the Alert Logic console, click CONFIGURATION, and then click Deployments.
2. Click the deployment tile you want to modify.
3. In the left navigation area, click Log Sources
4. In Select Filters, type or select a Source Type (you may need to scroll down the list to find the source types).

5. Click the gear icon ().
6. Select Mass Edit.
7. In Apply changes to, select All Sources for all sources or Only Filtered Sources to choose an individual log source from the table.
8. In Replace Collection Alerts, select your collection alert.
9. Click Save.

Update a collection alert rule

To update a collection alert rule:

1. Navigate to the Log Management Alert Rules page, and then click Collection.
2. Click the pencil icon ( ) on the alert rule you want to update.
3. In Collection Alert Name, type a descriptive name.
4. In Time Before Alert is Triggered, type a number of minutes. If Alert Logic collects no logs in this time, an alert is triggered.
5. In Time Between Alert Occurrences, type a number of minutes. This time period specifies how frequently Alert Logic sends the collection alert again when collection of log messages is interrupted for a long period of time.

6. In Email Addresses, type an email address. To add multiple email addresses, separate each entry with a comma. You can also search for an email address in the drop-down menu.
7. Select Send Alert Once to receive alerts only once.
8. Click Update.

Delete a collection alert rule

To delete a collection alert rule:

1. Navigate to the Log Management Alert Rules page, and then click Collection.
2. Click the trash icon ( ) on the alert rule you want to delete.
3. Click Delete.

Work with Correlation alert rules

Create a correlation alert rule

To create a correlation alert rule:

1. Navigate to the Log Management Alert Rules page, and then click Correlation.
2. Click the Add icon ().
3. In Correlation Name, type a descriptive name.
4. In Time Between Alert Occurrences, type a number of minutes. This time period specifies how frequently Alert Logic sends the correlation alert.

5. Select an option for Trigger an alert when the message type is.
   • To trigger an alert when the message type is in the select message types, select in the selected message types.
   • To trigger an alert when the message type is not in the select message types, select NOT in the selected message types.
6. Select Include message text to include the message text, and then in Message Types, select one or more options.
7. In the Email Addresses field, select from the list of contacts you want to receive alerts.
8. Click Save.

Update a correlation alert rule

To update a correlation alert rule:

1. Navigate to the Log Management Alert Rules page, and then click Correlation.
2. Click the pencil icon ( ) on the alert rule you want to update.
3. In Name, type a descriptive name.
4. In Time Between Alert Occurrences, type a number of minutes. This time period specifies how frequently Alert Logic sends the correlation alert.

5. Select an option for Trigger an alert when the message type is.

   • To trigger an alert when the message type is in the select message types, select in the selected message types.
   • To trigger an alert when the message type is not in the select message types, select NOT in the selected message types.

6. Select Include message text to include the message text, and then in Message Types, select one or more options.
7. In the Email Addresses field, select from the list of contacts you want to receive alerts.
8. Click Update.

Delete a correlation alert rule

To delete a correlation alert rule:

1. Navigate to the Log Management Alert Rules page, and then click Correlation.
2. Click the trash icon ( ) on the correlation rule you want to delete.
3. Click Delete.

Related topics