Turning Graylog searches into alerts: event definitions, aggregation conditions, notifications, priorities and Sigma rules, with the edition each option needs.
Building Filter and Aggregation event definitions: search query and stream, lookback and interval, counting or math on fields, grouping by user or host, and the fields you lose when you aggregate.
Sending Graylog alerts where responders work: Slack, Teams, PagerDuty, email, HTTP and Custom HTTP notifications, which need Enterprise, and limiting the event fields that leave Graylog.
Using HTTP and Custom HTTP notifications to open tickets or trigger playbooks in tools such as TheHive or Shuffle: payload design, event fields, authentication and avoiding duplicate tickets.
Making Graylog alerts easy to triage: choosing priority levels, event fields that carry the user, host and source, custom titles, tags and the All Events stream as the triage queue.
Triggering local scripts from Graylog events with the Enterprise Script notification: what the script receives, security of the script host, timeouts and when a webhook to an automation tool is safer.
Importing community Sigma detection rules into Graylog Security: GitHub repositories and uploads, mapping each rule to the right stream, SigmaHQ to GIM field translation and testing rules against real data.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.