Create Event Definitions

There are three ways to create an event definition:

• Event definition wizard

• Within search results

• Sigma Rules

This article walks through all three ways. For an overview of what an event definition is and what it is made of, see Event Definitions.

Create an Event Definition Through the Wizard

The wizard steps through six screens: Event Details, Condition, Additional Details, Notifications, Share, and Summary. To create an event definition through the wizard in the Graylog interface:

1. Navigate to Alerts.

2. Click the Event Definitions tab.

3. Click Create event definition in the upper right corner.

4. On the first screen, enter the required details:
   Event Details

   • Title: A unique name for the event definition.

   • Priority: A user-defined classification of the event's relative importance, from Informational (1) to Critical (5); defaults to Medium. See priority for what each level represents.

   • Event Summary Template (optional): The template used to generate event-specific, context-rich summaries in the Alerts page's description column. See Event Summary Template for its syntax and an example.

   • Description (optional): A longer description of the event definition.

   • Event Procedure Summary (optional): Shows any event procedures already attached (none, until you add one). Event procedures are specific, actionable instructions for resolving an identified issue. Click Add Event Procedure to create a new procedure or attach a pre-defined one from your library. See Event Procedures for complete information.

5. Select an event condition type from the Condition Type drop-down menu and complete its specific fields. The Available Conditions panel on the right summarizes each type as a reference. See Condition for the full list of types and links to each one's configuration details.

6. Optional: under Additional Details, add tags, MITRE ATT&CK tactics/techniques, or custom event fields. See Additional Details for what each field does.

7. Optional: in the Notifications menu, attach an alert. See the Alerts article for information on how to set one up and the alert types available.

8. Optional: in the Share menu, set collaboration and sharing options. See Share a New Entity for details.

9. Review the summary and select Create event definition.

Create an Event Definition Directly From Search Results

You can select any value in your search results to create an event definition. This event definition generates tailored alerts that include only the specific part of the query that you want to be alerted on. To do so:

1. Go to your search results.

2. Click any value in an aggregation widget, log view, or message widget.

3. Select Create event definition from the drop down menu.

4. Pick one of the Strategy by options in the dialog box that appears. You can select any of these options:

   • Exactly this value: Displays parameters related to your current search. You may add or remove any of these.

   • Any in widget: Displays parameters related to the selected value.

   • Custom: Allows you to include any part of the search query.

5. Click Show strategy details to select or deselect any parameters you would like to add to the event definition. The parameters you select here populate in your event definition under Filter & Aggregation.

   Hint: In addition to the three options displayed above, you might be presented with other options depending on the value you select. For example, if you select an aggregation widget metric value, you are presented with additional Any in row and Any in column options.

6. Click Continue Configuration. You are redirected to the Event Definitions page. Start by giving your event definition a unique title and filling in other details in Event Details. The selections you made in steps 4 and 5 are populated in Filter & Aggregation. You can add search filters, custom fields, alerts, and collaboration in this menu.

7. After reviewing the summary of your new event definition, click Create event definition. A new event definition is created, and Graylog generates events for the given condition. If you attached a notification, you also receive alerts.

Create an Event Definition by Importing a Sigma Rule

Importing a Sigma rule requires a Graylog Security license. You don't create a Sigma rule from scratch inside Graylog, you import a Sigma rule, and Graylog converts its detection logic into an event definition. There is no built-in editor for writing or editing Sigma Rules.

To create an event definition from a Sigma rule:

1. Navigate to Alerts > Event Definitions and select Create Event Definition.

2. Choose one of the two Sigma import options:

   • Import from Sigma Git Repository: Connect a public or private repository, or a self-hosted server over HTTPS (SSH URLs aren't supported), and select one or more to import. This includes the SigmaHQ repository directly.

   • Import from Sigma File: Upload a single Sigma rule file, or a .zip archive of several, from your local system.

3. Configure the event definition as you would any other, by providing values for target streams, search window, execution schedule, notifications, and search filters.

4. Select Create Event Definition to finish.