Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Alerts sink in filaments #243

Open
rabbitstack opened this issue Jan 24, 2024 · 0 comments
Open

Alerts sink in filaments #243

rabbitstack opened this issue Jan 24, 2024 · 0 comments
Labels
needs: docs Indicates that the issue needs documentation updates scope: filaments Anything related to filaments

Comments

@rabbitstack
Copy link
Owner

rabbitstack commented Jan 24, 2024 •
edited

A prominent use case for filaments is alert post-processing. This would allow any filament defining the on_next_alert function to react on alert arrival, either generated by the detection engine or YARA scanner.
If the filament has the definition of the on_next_alert(alert) function, each time an alert is triggered, the filament framework will invoke the former function. The first parameter of this function contains the alert details such as:

  • alert title
  • alert detailed description
  • provenance (detection, yara, etc.)
  • tags
  • alert metadata
@rabbitstack rabbitstack added scope: filaments Anything related to filaments needs: docs Indicates that the issue needs documentation updates labels Jan 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
needs: docs Indicates that the issue needs documentation updates scope: filaments Anything related to filaments
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@rabbitstack