{"id":37027976,"url":"https://github.com/airbus-cyber/graylog-plugin-alert-wizard","last_synced_at":"2026-01-14T03:19:58.803Z","repository":{"id":37458162,"uuid":"162173813","full_name":"airbus-cyber/graylog-plugin-alert-wizard","owner":"airbus-cyber","description":"Alert Wizard plugin for Graylog to manage the alert rules","archived":false,"fork":false,"pushed_at":"2026-01-12T13:30:32.000Z","size":5095,"stargazers_count":49,"open_issues_count":26,"forks_count":8,"subscribers_count":4,"default_branch":"master","last_synced_at":"2026-01-12T20:04:56.468Z","etag":null,"topics":["alert-rules","alerting","graylog","graylog-plugin","wizard"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/airbus-cyber.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2018-12-17T18:33:00.000Z","updated_at":"2026-01-12T13:30:36.000Z","dependencies_parsed_at":"2024-02-02T09:31:13.181Z","dependency_job_id":"398e2c3b-2352-43f2-b825-0ba4f6e90625","html_url":"https://github.com/airbus-cyber/graylog-plugin-alert-wizard","commit_stats":null,"previous_names":[],"tags_count":46,"template":false,"template_full_name":null,"purl":"pkg:github/airbus-cyber/graylog-plugin-alert-wizard","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/airbus-cyber%2Fgraylog-plugin-alert-wizard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/airbus-cyber%2Fgraylog-plugin-alert-wizard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/airbus-cyber%2Fgraylog-plugin-alert-wizard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/airbus-cyber%2Fgraylog-plugin-alert-wizard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/airbus-cyber","download_url":"https://codeload.github.com/airbus-cyber/graylog-plugin-alert-wizard/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/airbus-cyber%2Fgraylog-plugin-alert-wizard/sbom","scorecard":{"id":173467,"data":{"date":"2025-08-11","repo":{"name":"github.com/airbus-cyber/graylog-plugin-alert-wizard","commit":"4d2481753d2a0274f405bacb8b04a76d76f579c9"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":3.6,"checks":[{"name":"Maintained","score":10,"reason":"22 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":0,"reason":"Found 0/30 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:144: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:151: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:158: update your workflow using https://app.stepsecurity.io/secureworkflow/airbus-cyber/graylog-plugin-alert-wizard/ci.yml/master?enable=pin","Warn: pipCommand not pinned by hash: .github/workflows/ci.yml:71","Info:   0 out of   8 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned","Info:   0 out of   1 pipCommand dependencies pinned","Info:   1 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact 6.1.4 not signed: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/229479852","Warn: release artifact 6.1.3 not signed: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/227343410","Warn: release artifact 6.1.2 not signed: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/220975670","Warn: release artifact 6.1.1 not signed: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/194134491","Warn: release artifact 6.1.0 not signed: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/191863887","Warn: release artifact 6.1.4 does not have provenance: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/229479852","Warn: release artifact 6.1.3 does not have provenance: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/227343410","Warn: release artifact 6.1.2 does not have provenance: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/220975670","Warn: release artifact 6.1.1 does not have provenance: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/194134491","Warn: release artifact 6.1.0 does not have provenance: https://api.github.com/repos/airbus-cyber/graylog-plugin-alert-wizard/releases/191863887"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/ci.yml:9"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Vulnerabilities","score":0,"reason":"27 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-5mg8-w23w-74h3","Warn: Project is vulnerable to: GHSA-7g45-4rm6-3mm3","Warn: Project is vulnerable to: GHSA-wxr5-93ph-8wr9","Warn: Project is vulnerable to: GHSA-j288-q9x7-2f5v","Warn: Project is vulnerable to: GHSA-76vf-mpmx-777j","Warn: Project is vulnerable to: GHSA-q7g5-jq6p-6wvx","Warn: Project is vulnerable to: GHSA-q9q2-3ppx-mwqf","Warn: Project is vulnerable to: PYSEC-2014-14 / GHSA-652x-xj99-gmcc","Warn: Project is vulnerable to: GHSA-9hjg-9r4m-mvj7","Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56","Warn: Project is vulnerable to: PYSEC-2014-13 / GHSA-cfj3-7x9c-4p3h","Warn: Project is vulnerable to: PYSEC-2018-28 / GHSA-x84v-xcm2-53pg","Warn: Project is vulnerable to: PYSEC-2015-17","Warn: Project is vulnerable to: PYSEC-2023-74","Warn: Project is vulnerable to: GHSA-prr3-c3m5-p7q2","Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8","Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg","Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv","Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55","Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6","Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5","Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3","Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-16T17:08:32.803Z","repository_id":37458162,"created_at":"2025-08-16T17:08:32.804Z","updated_at":"2025-08-16T17:08:32.804Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28408824,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T01:52:23.358Z","status":"online","status_checked_at":"2026-01-14T02:00:06.678Z","response_time":107,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["alert-rules","alerting","graylog","graylog-plugin","wizard"],"created_at":"2026-01-14T03:19:57.944Z","updated_at":"2026-01-14T03:19:58.797Z","avatar_url":"https://github.com/airbus-cyber.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Alert Wizard Plugin for Graylog\n\n[![Continuous Integration](https://github.com/airbus-cyber/graylog-plugin-alert-wizard/actions/workflows/ci.yml/badge.svg)](https://github.com/airbus-cyber/graylog-plugin-alert-wizard/actions/workflows/ci.yml)\n[![License](https://img.shields.io/badge/license-SSPL-green)](https://www.mongodb.com/licensing/server-side-public-license)\n[![GitHub Release](https://img.shields.io/github/v/release/airbus-cyber/graylog-plugin-alert-wizard)](https://github.com/airbus-cyber/graylog-plugin-alert-wizard/releases)\n\n#### Alert Wizard plugin for Graylog to manage the alert rules\n\nAn alert wizard for configuring alert rules on Graylog.\n \nPerfect for example to configure together and at the same time a stream, an alert condition and a logging alert notification.\n\n**Required Graylog version:** see compatibility table below for required version\n\n**Packaged Graylog plugins:**\n* [graylog-plugin-logging-alert](https://github.com/airbus-cyber/graylog-plugin-logging-alert)\n* [graylog-plugin-correlation-count](https://github.com/airbus-cyber/graylog-plugin-correlation-count)\n\n## Graylog Version Compatibility\n\n| Wizard Plugin Version | Graylog Version                                                    |\n|-----------------------|--------------------------------------------------------------------|\n| 7.0.0                 | 7.0.1+                                                             |\n| 6.3.x                 | 6.3.7                                                              |\n| 6.1.4+                | 6.1.4+                                                             |\n| 6.1.0 to 6.1.3        | 6.1.0+                                                             |\n| 6.0.x                 | 6.0.x                                                              |\n| 5.2.x                 | 5.1.x\u003cbr\u003e(\u003e=5.1.13 for Wizard 5.2.0)\u003cbr\u003e(\u003e=5.1.9 for Wizard 5.2.1) |\n| 5.1.x                 | 5.1.x                                                              |\n| 5.0.x                 | 5.0.x                                                              |\n| 4.5.x                 | 4.3.x                                                              |\n| 4.4.x                 | 4.3.x                                                              |\n| 4.3.x                 | 4.2.x                                                              |\n| 4.2.x                 | 4.2.x                                                              |\n| 4.1.x                 | 4.2.x                                                              |\n| 4.0.x                 | 4.1.x                                                              |\n| 3.3.x                 | 3.3.x                                                              |\n| 3.2.x                 | 3.2.x                                                              |\n| 3.1.x                 | 3.0.x                                                              |\n| 3.0.x                 | 3.0.x                                                              |\n| 2.0.x                 | 2.5.x                                                              |\n| 1.1.x                 | 2.5.x                                                              |\n| 1.0.0                 | 2.4.x                                                              |\n\n\n## Upgrading\n\n### Upgrading to 6.1.6\n\nThe aggregation feature has changed and requires a rules update. The following migration procedure must be followed:\n1. Export rules from the preceding version,\n2. Delete all rules,\n3. Install version 6.1.6,\n4. Delete the web browser's cache\n5. Go to the Wizard Alert Configuration Page and update the Notification aggregation time range value. Even if you leave the value at 0, you must Save the configuration. \n6. Import rules.\n\n### Upgrading to 6.1.0\n\nThe internal representation of alert rules has slightly changed and is not backward-compatible. The following migration procedure must be followed:\n1. Export rules from the preceding version,\n2. Delete all rules,\n3. Install version 6.1.0,\n4. Import rules.\n\n### Upgrading to 6.0.0 and greater\n\nWith Graylog 6.0 and greater the Airbus plugin classes need to be allowed within the server configuration:\n```\nsafe_classes = org.graylog.,org.graylog2.,com.airbus_cyber_security.graylog.\n```\n\n### Upgrading to 5.2.1\n\nThe 'search query' parameter of alert rules has been added. The following migration procedure must be followed:\n1. Export rules from the preceding version,\n2. Delete all rules,\n3. Install version 5.2.1,\n4. Import rules.\n\n### Upgrading to 5.2.0\n\nThe internal representation of alert rules has been drastically changed. The following migration procedure must be followed:\n1. Export rules from the preceding version,\n2. Delete all rules,\n3. Install version 5.2.0,\n4. Import rules.\n\n### Upgrading to 5.0.0\nColumn `Alerts` on the page displaying rules. This field should be removed from the configuration.\nWhen updating from a previous version, this field should be removed from the configuration. This can be done with the REST API\n(plugins/com.airbus_cyber_security.graylog.wizard/config endpoint)\nTo give a concrete example, for the following configuration, entry `{ \"enabled\": true, \"name\": \"Alerts\" },` should be removed from the `field_order` values.\n```diff\n{\n  \"default_values\": {\n    \"severity\": \"info\",\n    \"matching_type\": \"AND\",\n    \"threshold_type\": \"\u003e\",\n    \"threshold\": 0,\n    \"time\": 1,\n    \"time_type\": 1,\n    \"grace\": 1,\n    \"backlog\": 500,\n    \"title\": \"\"\n  },\n  \"field_order\": [\n    { \"enabled\": true, \"name\": \"Severity\" },\n    { \"enabled\": true, \"name\": \"Description\" },\n    { \"enabled\": true, \"name\": \"Created\" },\n    { \"enabled\": true, \"name\": \"Last Modified\" },\n    { \"enabled\": true, \"name\": \"User\" },\n-    { \"enabled\": true, \"name\": \"Alerts\" },\n    { \"enabled\": true, \"name\": \"Status\" },\n    { \"enabled\": false, \"name\": \"Rule\" }\n  ],\n  \"import_policy\": \"DONOTHING\"\n}\n```\n\n### Upgrading to 4.5.0\n\nThe alert rule description field is now mapped to the Event Definition description field.\nTo avoid losing the content of the description field when upgrading, you may follow the migration procedure:\n1. Export rules from the preceding version,\n2. Delete all rules,\n3. Install version 4.5.0,\n4. Import rules.\n\nAlternatively, for each alert rule, you may, before the upgrade, set the description field of its corresponding\nEvent Definition with the value of the rule's description. This may be done manually or automatically via the REST API.\n\n### Upgrading to 4.3.0\n\nFollow the migration procedure:\n1. Export rules and lists from the preceding version,\n2. Delete all rules and lists,\n3. Install version 4.3.0,\n4. Import rules and lists.\nGroup/Distinct conditions now accept at most only one distinct field. During import of rules, only the first distinct field will be kept.\n\n\u003e **WARNING**: The REST API for rules has changed. See the [README](https://github.com/airbus-cyber/graylog-plugin-alert-wizard/blob/master/CHANGELOG.md).\n\n### Upgrading to 3.2.0\n\n**Possible issues to Import alert rules from version 3.0.0 or 3.1.0:**\n* The field \"grace\" (Now display in Graylog and the Wizard as \"Execute search every\") have to be strictly greater than 0\n* The Log Body of the notification will not be imported, the default one in the general configuration of the plugin \n[Logging Alert](https://github.com/airbus-cyber/graylog-plugin-logging-alert)\nwill be use, and have to follow the [Notification format](https://docs.graylog.org/en/latest/pages/alerts.html#notifications) \n(Same as the Email Notification)\n\n### Upgrading to 3.0.0\n\n\u003e **WARNING**: The REST API for the Wizard Configuration has changed.\n\n### Upgrading to 2.0.0\n\n\u003e **WARNING**: With Wizard plugin in version 2.0.0 and higher you can't import alert rules that have been exported from version 1.X.X.\n\n**Upgrading notice:**\n1. Import your alert rules from version 1.X.X\n2. Upgrade to version 2.0.0\n3. Export your alert rules in the new format\n\n\n## Installation\n\n[Download the plugin](https://github.com/airbus-cyber/graylog-plugin-alert-wizard/releases)\nand place the `.jar` file in your Graylog plugin directory. The plugin directory\nis the `plugins/` folder relative from your `graylog-server` directory by default\nand can be configured in your `graylog.conf` file.\n\n\u003e **WARNING**: With Graylog 6.0 and greater the Airbus plugin classes need to be allowed within the server configuration:\n```\nsafe_classes = org.graylog.,org.graylog2.,com.airbus_cyber_security.graylog.\n```\n\nRestart `graylog-server` and you are done.\n\n## Usage\n\n### Manage the alert rules\n\n![](images/alert_rules.png)\n\n### Create an alert rule\n\n![](images/create_alert_rule.png)\n\n### Use of lists\n\u003e **WARNING**: The first time your create a rule with a list, the Wizard automatically create a lookup with cache and data adapter. But you must manually set up the authorization key with your login:password in base 64 for the data adapter.\n\n![](images/Wizard_List4.png)\n\nThe field \"Name\" should be filled by \"Authorization\"\n\nThe field \"Value\" should be filled by \"Basic\" followed by \"user:password\" in base64 for example \"Basic TXlVc2Vy0k15UGFzc3dvcmQK\" where TXlVc2Vy0k15UGFzc3dvcmQK is the result of \"echo -n 'MyUser:MyPassword'|base64\"\n\nInstead of a user and its password you can also use a token.\nUse the token's value as username and use the word \"token\" as password.\nFor example if the token's value is supertoken1234567890:\n\"echo -n 'supertoken1234567890:token'|base64\"\n\nMyUser must be a user with admin rights\n\n\n\n## Build\n\nThis project requires Java 17 JDK.\n\n* Clone this repository.\n* Clone [graylog2-server](https://github.com/Graylog2/graylog2-server) repository next to this repository.\n* Build Graylog2-server with `./mvnw compile -DskipTests=true` (in graylog2-server folder)\n* Run `./mvnw package` to build a JAR file (in this project folder).\n* Optional: Run `./mvnw org.vafer:jdeb:jdeb` and `./mvnw rpm:rpm` to create a DEB and RPM package respectively.\n* Copy generated JAR file in target directory to your Graylog plugin directory.\n* Restart the Graylog.\n\nA docker to build can be generated from [Dockerfile](https://github.com/airbus-cyber/graylog-plugin-logging-alert/blob/master/build_docker/Dockerfile).\n\n## License\n\nThis plugin is released under version 1 of the [Server Side Public License (SSPL)](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fairbus-cyber%2Fgraylog-plugin-alert-wizard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fairbus-cyber%2Fgraylog-plugin-alert-wizard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fairbus-cyber%2Fgraylog-plugin-alert-wizard/lists"}