Manage Triggers
With the use of triggers, Xcitium can send alerts to third-party SIEM (security information and event management) platforms and logging tools like Slack, Splunk, Elastic Search, Cloud Watch, and Jira.
This section allows you to:
Step 1: After choosing specific alert filter from the Alerts Screen, you can either click elements directly from the alert events list, search for elements directly in the filter, or use Search Filters to choose a specific alert filter. Then click on Create Trigger button.
Step 2: Configure the required options:
- Name: Define an alert trigger name.
- When to initiate this trigger: Set the frequency of the trigger. You have four options to select, (1) Runtime as it happens (2) Once a day (3) Once a week (4) Once a month
- Define Threat Level: Define the threat level for the trigger. You have three options (1) High (2) Medium (3) Low
- Selected Filter: The chosen log filter from step 1 is populated here. You can shift to predefined filters from here also.
- Notification channel: Choose the notification channel that should receive the alerts.
Note: Before selecting the notification channel, you should complete the channel integration for this channel. Review the Channel Integration for more context.
Step 3: After giving necessary details, the user can click Save option to save the trigger. Trigger will be saved.
Triggers can be managed individually, or as a group, by using the checkboxes on the left side of the Trigger UI. Select individual/group of triggers and perform actions, such as enabling, disabling, or deleting.
To view Trigger alert details, click the Details of corresponding Tigger alert row. This will give query info of the selected trigger additionally.
Alerts can be enabled or disabled using the slider or the actions drop-down menu.
To edit an existing Tigger alert:
Step 1: click Edit Symbol from the right corner More options icon of the corresponding trigger alert
Step 2: Edit the trigger, and click Save to confirm the changes. Trigger will be updated.
Open the Triggers page and use one of the following methods to delete triggers:
You can perform delete operation on a single trigger or on multiple triggers
Step 1: From the Triggers UI, check the boxes beside the relevant triggers.
Step 2: Click Delete icon from the right corner in the screen to delete the selected triggers. Triggers will be deleted.
