Setup Alert rule context queries

Setup Alert rule context queries

Alert rule context queries provide the capability to define queries based Alert metadata. These queries can be used to retrieve additional information related to an alert.


Alert rule context queries can be defined for each alert using the following navigation path

Alert Rules -> Select the Alert rule of interest -> Scroll to the bottom of the page.


Note : Query parameters (including default parameters) must be explicitly added before they can be used as part of a context query.


Following are standard / default parameters available for all alerts. Note :  Default parameters should be explicitly added as well.

  • assetId (Text)
  • alertTime (Date)
  • key (Text)
  • value (Text)
  • lastOccurredAt (Date)

Other parameters can be defined using the names of fields in the alert metadata. 

If using the "pid" field, note it is of type NUMBER. 


To add a context query to an alert rule :

  • Navigate to alert rule details page
  • Scroll down to Context query section
  • Click "Add" button in the Context query section
  • Click "Manage Parameters" button on the top right corner and add standard parameters or alert rule specific metadata parameters (e.g. assetId)
  • Formulate a query based on parameters defined above. e.g. SELECT last_activity_at FROM upt_assets WHERE id = :assetId  
  • Values can be provided for these parameters for testing purposes only. Any values provided are not saved.
  • Click "Save" button and provide a query name.


Tips :

   A upt_day filter on large event tables is always recommended for performance: 

          upt_day = CAST(date_format(:alertTime, '%Y%m%d') AS INTEGER)

   An additional filter can be used to limit returned rows to within several minutes of the alert:

        upt_time BETWEEN (:alertTime - interval '2' minute) AND (:alertTime + interval '2' minute)


Context query related data is displayed on the Alert Detail screen in the tab labeled "Alert Context"


Context queries are saved queries. They can be viewed / edited on the investigate page.


    • Related Articles

    • Sample JSON alert format

      Following fields are generated for all alerts     host_name     severity     description     alert_time     key     value     metadata - contains fields / values generated for the alert rule other than mandatory fields. Sample JSON {     ...

    • Alert to list commands associated with an ssh session to a remote host

      In this article we show how to configure an alert that fires whenever someone starts an ssh session to a remote machine from a Bastion Host using ssh. We then show how to build a context query, to list all the commands run on the remote machine, by ...

    • Monitor files on assets by hash

      This article shows how to create an alert that monitors the presence of the files and configuration items on the assets that need to be there. Create CSV file using the following naming convention: SHA-256 hash as indicator SHA-256 as indicator_type ...

    • Working mechanism of Cloud Rules

      Generally, we will have 3 types of rules(either in alert/event rules) in cloud they are builder rule, SQL rule, placeholder rules. In SQL type rules, when ever there is a data match to particular query , that rule gets triggered & hence we will be ...