Add ASSET_NAME field to GraylogThresholdEventFields and update alert route documentation (#491)
taylor_socfortress committed
Aug 16, 2025 at 10:47 UTC
008a62c5db10b54b65405fa8d1a1d1113ef0d491
2 files changed
+5
-1
backend/app/active_response/schema/graylog.py
+1
@@ -33,6 +33,7 @@ class GraylogThresholdEventFields(BaseModel):
33
CUSTOMER_CODE: str
34
SOURCE: str
35
ALERT_DESCRIPTION: str
36
+ ASSET_NAME: str
37
# Allow additional fields
38
additional_fields: Dict[str, Any] = Field(default_factory=dict, alias="__extra__")
39
backend/app/incidents/routes/incident_alert.py
+4
-1
@@ -223,10 +223,13 @@ async def invoke_alert_threshold_graylog_route(
223
1. CUSTOMER_CODE: str - the customer code
224
2. SOURCE: str - the source of the alert
225
3. ALERT_DESCRIPTION: str - the description of the alert
226
+ 4. ASSET_NAME: str - the name of the asset
227
228
# ! IMPORTANT: DO NOT ADD THE "COPILOT_ALERT_ID": "NONE" AS A CUSTOM FIELD WHEN CREATING THE ALERT IN GRAYLOG # !
229
# ! THIS WILL BREAK THE AUTO-ALERT CREATION FUNCTIONALITY # !
230
231
+ # ! Make sure the Graylog Notification is just the standard HTTP Notification Type and not the Custom HTTP Notification Type !
232
+
233
Args:
234
request (InvokeActiveResponseRequest): The request object containing the command, custom, arguments, and alert.
235
@@ -238,7 +241,7 @@ async def invoke_alert_threshold_graylog_route(
241
alert_id = await create_alert_full(
242
alert_payload=CreatedAlertPayload(
243
alert_context_payload=request.event.fields.dict(),
241
- asset_payload=request.event.source,
244
+ asset_payload=request.event.fields.ASSET_NAME,
245
timefield_payload=str(request.event.timestamp),
246
alert_title_payload=request.event.message,
247
source=request.event.fields.SOURCE,