To define the format and a set of fields for syslog messages that PT ISIM proView Sensor sends for incidents, templates are used. The templates are stored in the following directory: /opt/ptisim/lib/ptisim-httpapi/templates/alerts/notify
. For each message type, there is a corresponding template in the directory:
alert_create_message/syslog
is for notifying of a new incident.alert_status_message/syslog
is for notifying that an incident state changed.alert_progress_message/syslog
is for notifying that a new step of an incident is detected (for incidents that consist of several steps, such as "Possible disconnection of PT ISIM").
Besides the fields specified in the templates, you can add other fields to the message text by enclosing them in double braces: {{ … }}
—for example, {{ incident.status }}
. The following table contains a list of basic incident parameters that you can use as fields for syslog messages. All available fields are listed in the file /opt/ptisim/etc/fullview/httpapi.conf.d/incidents-notify-fields.yaml
.
Field | Data type | Description |
---|---|---|
| UInt32 | Incident ID |
| String | Incident type |
| String | Current incident state: |
| UInt32 | Current incident step (for incidents that consist of several steps) |
| UInt32 | Total number of possible incident steps |
| String | List of incident events |
| Timestamp | Incident creation time |
| Timestamp | Time of the most recent incident event (may coincide with |
| Timestamp | Time of the most recent change in incident properties. Changes include the following: an incident state changes; an incident is starred; a new event is created; a new step begins |
| String | ID of the incident source node |
| String | ID of the incident target node |
| UInt32 | ID of the model state at the time of incident detection |
| String | IP address of the incident source |
| String | MAC address of the incident source |
| String | IP address of the incident target |
| String | MAC address of the incident target |
| String | Incident group |
| String | Incident severity level: |
| String | Link to the incident in the web interface |
| String | |
| String | Current time |
| String | ISIM node IP address |
| String | IP address of the event source |
| String | IP address of the event recipient |
| String | MAC address of the event source |
| String | MAC address of the event recipient |
| String | Incident type |
| String | Incident name in Russian |
| String | Incident name in English |