Triggers

A trigger, in an alert or detection, executes an action. For example, in a detection, the trigger section can send an email when the specified activity is detected.

A trigger can:

• Trigger an event: Send an event to Elasicsearch where it is stored as a document. Then, you can see the event as a log in the TeskaLabs LogMan.io app. You can create your own dashboard to display correlation rule detections, or find the logs in Discover.
• Trigger a notification: Send a message via email
• Update a lookup: Add or remove keys used by other detections (for example active VPN users). See Lookups in detections and the lookup trigger reference.

Trigger an event

You can trigger an event. The end result is that the trigger creates a log of the event, which you can see in TeskaLabs LogMan.io.

Item in trigger	How to include
trigger: - event:	In the trigger, event means that the rule will create an event based on this positive detection and send it into the data pipeline via Elasticsearch, where it is stored as a document. Then, the event comes through to TeskaLabs LogMan.io, where you can see this event in Discover and Dashboards.
!DICT type: "{str:any}" with:	!DICT creates a dictionary of keys (fields) and values. type has "st:any" (meaning string) so that any type of value (numbers, words, etc) can be a value in a key-value pair. with begins the list of key-value pairs, which you define. These are the fields and values that the event will be made of.

Following with, make a list of the key-value pairs, or fields and values, that you want in the event.

      !DICT
      type: "{str:any}"
      with:
        key.1: "value"
        key.2: "value"
        key.3: "value"
        key.4: "value"

If you're using Elasticsearch and therefore the Elastic Common Schema (ECS), you can read about standard fields in the ECS reference guide.

Trigger a notification

Notifications send messages. Currently, you can use notifications to send emails.

Learn more about writing notifications and creating email templates.