Change resolve message
This commit is contained in:
parent
4110d865dd
commit
10fd555fa9
2 changed files with 4 additions and 4 deletions
|
|
@ -956,7 +956,7 @@ func buildWAFBlockAlertRule(client ClientData, domain DomainInfo, tmpl AlertRule
|
||||||
|
|
||||||
clientDomain := fmt.Sprintf("%s / %s (SID:%s)", client.ClientTitle, domain.DomainName, domain.SID)
|
clientDomain := fmt.Sprintf("%s / %s (SID:%s)", client.ClientTitle, domain.DomainName, domain.SID)
|
||||||
summary := fmt.Sprintf("🟡 %s — %s ошибка WAF - кол-во штук за 1 минуту.", clientDomain, client.PtafFallbackCode)
|
summary := fmt.Sprintf("🟡 %s — %s ошибка WAF - кол-во штук за 1 минуту.", clientDomain, client.PtafFallbackCode)
|
||||||
thresholdAnnotation := fmt.Sprintf(">%d штук(и) для response_status_code (ответ от PTAF, не от origin)", domain.PtafFallbackCodeAlertCount)
|
thresholdAnnotation := fmt.Sprintf(">%d штук(и) для response_status_code (ответ от PTAF)", domain.PtafFallbackCodeAlertCount)
|
||||||
thresholdCountAnnotation := fmt.Sprintf("%d шт.", domain.PtafFallbackCodeAlertCount)
|
thresholdCountAnnotation := fmt.Sprintf("%d шт.", domain.PtafFallbackCodeAlertCount)
|
||||||
|
|
||||||
sidQuery := "SID:" + domain.SID
|
sidQuery := "SID:" + domain.SID
|
||||||
|
|
@ -981,7 +981,7 @@ func buildWAFBlockAlertRule(client ClientData, domain DomainInfo, tmpl AlertRule
|
||||||
"code_field": fmt.Sprintf("%s WAF", client.PtafFallbackCode),
|
"code_field": fmt.Sprintf("%s WAF", client.PtafFallbackCode),
|
||||||
"for_duration": "1m",
|
"for_duration": "1m",
|
||||||
"threshold": thresholdAnnotation,
|
"threshold": thresholdAnnotation,
|
||||||
"field_info": "для response_status_code (ответ от PTAF, не от origin)",
|
"field_info": "для response_status_code (ответ от PTAF)",
|
||||||
"runbook": "проверить логи docker и эскалировать на аналитика.",
|
"runbook": "проверить логи docker и эскалировать на аналитика.",
|
||||||
"severity": "warning",
|
"severity": "warning",
|
||||||
"value_unit": "шт.",
|
"value_unit": "шт.",
|
||||||
|
|
|
||||||
|
|
@ -463,7 +463,7 @@ func buildWAFBlockAlertRuleVL(client ClientData, domain DomainInfo, tmpl AlertRu
|
||||||
|
|
||||||
clientDomain := fmt.Sprintf("%s / %s (SID:%s)", client.ClientTitle, domain.DomainName, domain.SID)
|
clientDomain := fmt.Sprintf("%s / %s (SID:%s)", client.ClientTitle, domain.DomainName, domain.SID)
|
||||||
summary := fmt.Sprintf("🟡 %s — %s ошибка WAF - кол-во штук за 1 минуту.", clientDomain, client.PtafFallbackCode)
|
summary := fmt.Sprintf("🟡 %s — %s ошибка WAF - кол-во штук за 1 минуту.", clientDomain, client.PtafFallbackCode)
|
||||||
thresholdAnnotation := fmt.Sprintf(">%d штук(и) для response_status_code (ответ от PTAF, не от origin)", domain.PtafFallbackCodeAlertCount)
|
thresholdAnnotation := fmt.Sprintf(">%d штук(и) для response_status_code (ответ от PTAF)", domain.PtafFallbackCodeAlertCount)
|
||||||
thresholdCountAnnotation := fmt.Sprintf("%d шт.", domain.PtafFallbackCodeAlertCount)
|
thresholdCountAnnotation := fmt.Sprintf("%d шт.", domain.PtafFallbackCodeAlertCount)
|
||||||
|
|
||||||
expr := fmt.Sprintf("SID:%s log_type:nginx-access-PTAF response_status_code:=%s | stats by (_time:1m) count() hits", domain.SID, client.PtafFallbackCode)
|
expr := fmt.Sprintf("SID:%s log_type:nginx-access-PTAF response_status_code:=%s | stats by (_time:1m) count() hits", domain.SID, client.PtafFallbackCode)
|
||||||
|
|
@ -489,7 +489,7 @@ func buildWAFBlockAlertRuleVL(client ClientData, domain DomainInfo, tmpl AlertRu
|
||||||
"code_field": fmt.Sprintf("%s WAF", client.PtafFallbackCode),
|
"code_field": fmt.Sprintf("%s WAF", client.PtafFallbackCode),
|
||||||
"for_duration": "1m",
|
"for_duration": "1m",
|
||||||
"threshold": thresholdAnnotation,
|
"threshold": thresholdAnnotation,
|
||||||
"field_info": "для response_status_code (ответ от PTAF, не от origin)",
|
"field_info": "для response_status_code (ответ от PTAF)",
|
||||||
"runbook": "проверить логи docker и эскалировать на аналитика.",
|
"runbook": "проверить логи docker и эскалировать на аналитика.",
|
||||||
"severity": "warning",
|
"severity": "warning",
|
||||||
"value_unit": "шт.",
|
"value_unit": "шт.",
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue