Manage Event Definitions

When an event definition exists, you can enable, disable, edit or duplicate it, customize how its events are summarized, manage Illuminate-generated events, manage saved Sigma Git repositories, and replay the search that triggered a specific event.

This article explains how to manage existing event definitions.

Manage Defined Events

All defined events are available on the Event Definitions tab of the Alerts page. You can find details about each entity, such as the priority, status, scheduling, attached notifications, tags, and tactics/techniques. Click the information icon in the Scheduling column to view information about status, last execution, next execution, next time range, and queued notifications.

The Event Definitions page includes the Bulk actions menu, which lets you enable, disable and delete multiple event definitions simultaneously. By clicking the More dropdown button, you can edit, duplicate, enable, disable, replay search and manage collections. Use the Manage collections option to add an event to existing collections.

To find specific events in the list, enter keywords in the search box. The list updates to show only matching items.

To narrow the list further, select Filters (+) next to the search box, then select a filter from the Create Filter menu. The following filters are available:

• Event Definition Type: Show event definitions of the selected condition type, for example Filter & Aggregation or Sigma Rules.

• Source: Show system, user-defined or Illuminate-generated event definitions.

• Status: Show enabled or disabled event definitions.

• Tactics/Techniques: Show event definitions mapped to the selected MITRE ATT&CK® tactics or techniques.

• Tags: Show event definitions that have the selected tags.

You can combine a filter with a keyword search to further limit the returned list.

Manage Sigma Repos

Saved Git repository connections used for importing Sigma rules are managed under Alerts > Sigma Repos. This tab is available with a Graylog Security license to users who have permission to read Sigma repositories. That tab opens the Sigma Rules Git Repos page, which lists every repository you've added.

From that list, click the ellipsis next to a repository to:

• Edit: Update the branch or directories rules are sourced from.

• Refresh: Pull the latest list of available rules. For example, after rules are added or changed in the Git repository.

• Delete: Remove the repository's metadata from Graylog. Rules sourced from it are no longer available to import, but any event definitions already created from rules you previously imported remain. To delete several repositories at once, select their checkboxes, click Bulk Actions, then select Delete.

See Sigma Rules Event Definition for how an imported Sigma rule becomes an event definition.

Customize the Event Summary Template

The Event Summary Template field allows you to customize how events appear in the Alerts page. When the Event Summary Template is populated, Graylog uses this field to generate event-specific data in the summary Description column.

This functionality enables you to provide context-rich summaries for each event using dynamic values.

The Event Summary Template supports Java Minimal Template Engine (JMTE) syntax, allowing you to insert dynamic variables into the summary.

You can reference fields from the event and its associated data, similar to how templates are used in email notifications.

Example:

Event triggered for user ${fields.username} on host ${source.source}

This renders a descriptive summary using values from the event at runtime. If the template renders as an empty string, the event description shows (empty message after event summary template transformation).

Manage Illuminate Events

Illuminate events are delivered in several Illuminate Spotlight packs with additional packs added over time. These packs provide predefined events that you can run in your environment. When you enable any of these packs, the events are added to the Event Definitions page automatically. You can choose which of the events to enable.

To enable or disable an Illuminate event, you have two options from the Event Definitions page:

1. In the Status column, click the Enabled/Disabled icon to toggle the status.

2. From the More menu, select Enable/Disable to toggle the status.

Illuminate events include two customizable settings. Select More > Edit to open the event definition wizard where you can make the following changes:

• Search filters: You can add search filters to include or exclude properties from the results. Search filters you add are preserved through future Illuminate updates. Illuminate-provided search filters display a lock icon and can't be edited or removed. See Apply a Search Filter for information.

• Notifications: On the Notifications page, add or update alerts you want to send if this event is triggered. See the Alerts article for information on how to set up an alert and the alert types available.

The remaining settings in the wizard are read-only for Illuminate events. Click Update event definition on the Summary page to save your changes.

Replay a Search

You can replay the specific search that triggered an event. On the Alerts & Events page, click More next to an event, then select Replay search. The option is available only if you have read access to the event's event definition.

You can review the search results and messages to gather important details in investigating the event. Note that the event and the replayed search can be added to investigations for further research.