alertTypeId: .es-query

consumer: alerts

createdBy: elastic

status: pending

notifyWhen: onActionGroupChange

timeWindowUnit: m

type: alert


title: Alert - Title

title: Alert - Title

type: markdown

markdown: ## Alert Dashboard

type: visualization


title: Navigation

title: Navigation

markdown:
**Navigation :**

[Auth dashboard](/app/dashboards#/view/56fefdb0-11d5-11eb-864d-19d138b60b32)
     |
[Session dashboard](/app/dashboards#/view/6f97e070-11d6-11eb-864d-19d138b60b32)
     |
[Alert dashboard](/app/dashboards#/view/c975c9d0-a8cb-11ec-896b-bf2323ac011b)
     |
[Visualizations](/app/visualize)
     |
[Index Management](/app/management/data/index_management/indices)
     |
[Discover](/app/discover)
     |
[Logout](/logout)

type: tag


type: long

title: wso2-iam-alert-session*

type: index-pattern


dataType: number

label: Abnormal long sessions

operationType: formula

formula: count(kql='is_long : 1')

scale: ratio

query: is_long : 1

label: Part of Abnormal long sessions

operationType: count

layerType: data

title: Alert - Long Sessions Count

visualizationType: lnsMetric

type: lens


dataType: string

label: Filters

operationType: filters

query: is_long : 1

scale: ordinal

label: Average Duration (mins)

operationType: range

maxBars: auto

type: histogram

scale: interval

dataType: date

label: Timestamp

interval: auto

label: Username

operationType: terms

type: column

orderDirection: desc

sourceField: username

label: Maximum of is_long

operationType: max

label: Duration (mins)

label: Tenant domain

alignment: left

title: Alert - Long Session Details

visualizationType: lnsDatatable


type: keyword

source:
if (doc['is_sus'].value > 0) {
    emit('Successful login attempt after multiple login failures with same username detected');
} else {
    emit('N/A')
}

title: wso2-iam-alert-auth*


label: Suspicious logins

operationType: sum

title: Alert - Suspicious login count


query: not message : "N/A"

label: Top values of is_sus

type: alphabetical

orderDirection: asc

label: Message

sourceField: message

title: Alert - Suspicious login table


title: Long Sessions Count

title: Long session details

title: Suspicious login count

title: Suspicious login details

title: Alert Dashboard

type: dashboard