Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Legacy notification system, actions side car
# Get the alert type of "siem-notifications" which is part of the legacy system.
GET .kibana-hassanabad22/_search
{
"query": {
"term": {
"alert.alertTypeId": "siem.notifications"
}
}
}
# Get the tasks of siem notifications to ensure and see it is running
GET .task-manager-hassanabad22/_search
{
"query": {
"term": {
"task.taskType": "alerting:siem.notifications"
}
}
}
# See the actions "side car" which are part of the legacy notifiction system.
GET .kibana-hassanabad22/_search
{
"query": {
"term": {
"type": {
"value": "siem-detection-engine-rule-actions"
}
}
}
}
# See all your siem.signals alert type
GET .kibana-hassanabad22/_search
{
"query": {
"term": {
"alert.alertTypeId": "siem.signals"
}
}
}
# See all your alerts
GET .kibana-hassanabad22/_search
{
"query": {
"term": {
"type": "alert"
}
}
}
# See all your actions
GET .kibana-hassanabad22/_search
{
"query": {
"term": {
"type": "action"
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment