Events
Overview of various Events and Alerts generated by Haltdos
Overview
Haltdos solutions provides real-time alerts for various types of incidents from attacks to accounting / audit incidents through Events. Events can be generated by the platform and various Apps subscribed in your Stack. You can view all events or filter them based on category, scope and time.
Events Page
All events are listed on the Events Page. Filters are available to view events of a specific App/Zone/ Listener and Category. Each event is identified by a unique Event ID which can also be used for searching a specific event on the Events Page. All events are listed in decreasing chronological order.
Event Details
Depending upon the type of event, clicking on any Event shows details of the incident. For example, a WAF Attack Event will detail the request/response that got dropped along with details of the request and the reason for dropping the request.
Further to detailing the incident through Events, users can perform various actions. For example, virtual patching functionality is implemented through actions in Event Details. Virtual Patching is the ability to create custom WAF rules from the result of a security scan.
Event Types
| Type | Description | App | Actions | |
|---|---|---|---|---|
| Scan Result | Details of security scan results | SCAN | Yes | Create WAF Rule |
| Download | Displays all the file download events | -- | Yes | -- |
| WAF Attack | Details of blocked HTTP request/response | WAF | No | 1. Whitelist Rule |
- Deploy Rule to Staging
- Deploy Rule to Production | | Health Alert | Details of healthy and unhealthy upstream web servers | SLB | No | No | | Audit | Displays the events for Configuration changes | ALL | No | -- | | Server | Displays details of server error observed. | WAF | No | -- | | Alarm | Displays detials of configured alarms triggered | ALL | Yes | -- | | Failed Jobs | Displays the events for failed jobs | ALL | No | -- | | Report | Displays the report generated to be downloaded | ALL | Yes | -- | | Instance | Displays details of any instance notification | -- | No | -- |
Filter
Users can filter out the events based on All, App, Zone, and Listener configured for the specific app.
Download
Users can download the events specifying the event count, start time & date, and category i.e. All, Attack, Health. Upon specifying the fields user will click on the Download button and a spreadsheet will be downloaded.
Auto Refresh
Users can enable auto-refresh in order to refresh the real-time alerts for requests. The details will be displayed in events for the specific type of request.
Events are not notified via email or API. To receive alerts, you have to create Alarms. All alarm triggers are notified to selected authorised users on the platform.