Create a CIM non-compliance alert

Create an alert that monitors field coverage and CIM value compliance for a selected data model, dataset, and source type.

Use the Ingest Monitoring CIM non-compliance template to monitor field coverage and CIM value compliance. The alert can monitor whether events contain selected CIM fields and whether field values match expected CIM values. Only accelerated data models are supported.

  1. Configure the alert details.
    1. On the Alerts page, select Create alert.
    2. Select the CIM non-compliance template.
    3. Enter a name for the alert, such as Authentication CIM Compliance - firewall.
    4. Optionally, enter a description.
    5. Choose the CIM data model and dataset to monitor, such as Authentication.Authentication or Network_Traffic.All_Traffic.
    6. Select the source type to monitor. The list contains source types mapped to the selected data model.
      Note: Only accelerated data models are supported. If the selected data model isn't accelerated, no source types appear.
    7. In the table of required and suggested CIM fields for the selected dataset, deselect any fields you don't want to monitor. All fields are selected by default.
    8. Select Next.
  2. Set the alert trigger rules.
    1. Set the field coverage threshold. The alert triggers when the percentage of events that contain a monitored field falls below this value. The default is 80%.
    2. Set the CIM value compliance threshold. The alert triggers when the percentage of field values that match expected CIM values falls below this value. The default is 80%.
    3. Set the alert schedule by selecting every 4 hours, daily, or weekly.
    4. To skip weekend evaluations, select Exclude weekends (Saturdays and Sundays).
    5. Set how long the triggered alert remains active in the Expires after section. The default is 24 hours.
    6. Select Throttle to suppress duplicate alerts within a time window. The default throttle period for CIM alerts is 60 minutes.
    7. Select Next.
  3. Set the alert severity and continue.
    1. Select a severity level: Info, Low, Medium, High, or Critical.
    2. Select Next.
  4. Review and create the alert.
    1. Review the data model and dataset, source type, field coverage and CIM value compliance thresholds, schedule, expiry, throttle, and severity.
    2. Select Create to save the alert.

The alert runs on the configured schedule. When the field coverage or CIM value compliance condition falls below its threshold, the alert appears in the Triggered alerts tab.