Web Application Firewall:Best practices for pushing API security alerts

Configure notification objects

Configure the recipients for your notifications.

1. On the current page, click the Notification Objects tab.

2. On the Users sub-tab, click Create to open the Add User page.

   The panel includes fields such as Identifier, Name, and Mobile, as well as toggles for Receive Text Message, Receive Phone Call, and Enable.

3. In the Add User panel, enter the user's information and ensure that the toggles for Enable, Receive Text Message, and Receive Phone Call are enabled.

4. Click OK and refresh the page to confirm that the new user has been added.

Configure an alert template

If you want notifications to include details like the instance ID that triggered the alert, the alert rule name, or the alert severity, you can customize the notification content in a content template.

1. On the Alert Center page, select Notification Policy > Alert Template. On the Alert Template tab, click Create.

2. In the pop-up Content Template page, you can customize the Send Content. This will be the content format of the push notifications that you receive.

   For example, on the SMS tab, you can enter the following template variables in the Content field: detail:{{ alert.aliuid }}, {{ alert.alert_name }}, {{ alert.severity }}, {{ alert.annotations.title }}, {{ alert.fire_time }}, {{ alert.alert_time }}.

   Note

   This example shows only a few template variables for reference. For more variables, see the full list of alert template variables.

3. After clicking Confirm, refresh the page to confirm that the content template was added successfully.

Select a destination

1. Find the rule you just created and click Edit in the Actions column.

2. Scroll to the bottom of the page. For the destination, select SLS Notification and turn on the Enable toggle.

3. After you enable SLS notifications, you must select an Alert Policy. Typically, in Minimalist mode, you only need to configure the push channel, select static recipients, add alert notification contacts, and select an appropriate content template. In this example, select Minimalist mode, the recipients, and a content template to complete a basic alert policy configuration.

   Note

   Simple Mode allows you to send alerts by editing channels, alert recipients, content templates, and sending periods.

   Standard Mode allows you to push alerts by selecting a system-defined action policy or creating a new custom action policy.

   Advanced Mode sends alerts by selecting an Action Policy and an Alert Policy.

   Important

   To learn about the notification channels supported by SLS, see Notification channels. If you select SMS or voice calls as a channel, additional fees apply. For billing details, see Pay-by-feature billable items.

4. Click OK to save the changes.

Enable SLS push

1. Log on to the Simple Log Service console.

2. In the Projects section, click the target project.

3. On the left side of the console, click the alert icon . On the Alert Center tab, click the Alert Rules sub-tab and confirm that the rule status is Starting.

1. Set the destination for SLS alerts

1. Find the rule you just created and click Edit in the Actions column.

2. Scroll to the bottom of the page. Under Destination, select CloudMonitor Event Center and turn on the switch. Click Confirm to save the changes.

2. Create alert contacts and groups

CloudMonitor can only push notifications to contact groups. Therefore, you must add the desired recipients to a contact group.

2.1 Create an alert contact

1. Log on to the CloudMonitor console.

2. In the left navigation bar, select Alerts > Alert Contacts.

3. On the Alert Contacts tab, click Create Alert Contact.

4. In the Set Alert Contact panel, enter the alert contact's name, mobile number, email address, and Webhook URL, and leave the other parameters at their default values.

5. After you click Confirm, you are returned to the Alert Contacts panel, where you can confirm that the alert contact was created successfully.

2.2 Create an alert contact group

1. Click the Alert Contact Group tab.

2. On the Alert Contact Group tab, click Add Contact Group.

3. In the Add Contact Group panel, enter a name for the alert contact group, and select existing alert contacts.

4. Click OK.

3. Create a notification configuration

Prerequisites: You have already created an alert contact and an alert contact group.

1. Return to the CloudMonitor console.

2. In the left navigation bar, select Event Center > Upgrade strategy.

3. On the Upgrade strategy page, click the Create policy panel, and enter the Name and select the Contact Group.

4. Click OK.

4. Create an event subscription

1. Return to the CloudMonitor console.

2. In the left navigation bar, select Event Center > Event Subscription.

3. On the Subscription Policy tab, click Create Subscription Policy.

4. On the Create Subscription Policy page, set the parameters for the subscription policy.

   Parameter	Description
   Basic information	Enter a name for the subscription policy.
   Alert Subscription	For Subscription Type, select System Event.
   	For Product, select Simple Log Service.
   	Event Type multiple selection (Firing, Resolve) Note Firing indicates that an alert is in the triggered state and corresponds to specific event names. CRITICAL alert event INFO alert event WARN alert event Resolved indicates that the alert has been resolved and corresponds to a specific event name. Alert recovery event
   	Event name: Select one or more of the following: AlertEvent:CRITICAL, AlertEvent:INFO, AlertEvent:RESOLVED, or AlertEvent:WARN.
   	For Event Level, select Critical. Note Since the trigger condition in Step 2 was set to High, the corresponding Event Level is Critical. If you set a different trigger condition severity, you must also select the corresponding event level based on the following mapping: A trigger condition with a severity of Critical or High maps to an Event Level of Critical. A trigger condition with a severity of Low or Medium maps to an Event Level of Warning. A trigger condition with a severity of Report maps to an Event Level of Info.
   	For Event Content, enter the name of the alert rule that you created in Step 2: Create an SLS alert rule.
   	Neither Application grouping nor Event Resources is set
   Combined Noise Reduction	Use the default value.
   Notification	Select your target notification configuration, and for Custom Notification Method, use the default notification method. Important CloudMonitor provides a free quota that includes SMS alerts. If you require voice call notifications, go to the CloudMonitor console and activate the pay-as-you-go service in the Basic CloudMonitor module. For billing details, see Pay-as-you-go for Basic CloudMonitor.
   Push and Integration	No configuration is required.

   For the Alert Subscription settings, see the parameter descriptions above.

   Note

   The steps provided are an example of one way to implement push notifications. You can adjust the configuration based on your business requirements. For more information, see Create a subscription policy.

5. At the bottom of the Create Subscription Policy page, click the Submit button. You are automatically redirected to the Event Subscription page. The policy that you just submitted is successfully created, and its status is Starting.