# Signals Alerting **URL:** https://forum.search-guard.com/c/alerting-signals/12.md [Latest](https://forum.search-guard.com/latest.md) · [Categories](https://forum.search-guard.com/categories.md) · [Tags](https://forum.search-guard.com/tags.md) --- ## [About the Signals Alerting category](https://forum.search-guard.com/t/about-the-signals-alerting-category/1660)
**Author:** [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Replies:** 0
Signals provides Alerting capabilities for Elasticsearch. It is bundled with Search Guard and perfectly integrated with all security features Search Guard offers. All questions, issues and feature requests go here, --- ## [Signals watch are skipping](https://forum.search-guard.com/t/signals-watch-are-skipping/2476)
**Author:** [@Raj.Jikadra](https://forum.search-guard.com/u/Raj.Jikadra)\ **Replies:** 26\ **Last updated:** [January 28, 2025, 5:52am UTC](https://forum.search-guard.com/t/signals-watch-are-skipping/2476 "2025-01-28T05:52:56Z")
Elasticsearch version: 8.7.1 Server OS version: Ubuntu 22.04 LTS Describe the issue: Sometimes Signals watch are skipping, and there are no error log or any logs for that skip. It only logs when watch starts it run and… --- ## [Assess CVE-2023-44487 for Search Guard](https://forum.search-guard.com/t/assess-cve-2023-44487-for-search-guard/2469)
**Author:** [@jgarcia](https://forum.search-guard.com/u/jgarcia)\ **Replies:** 1\ **Last updated:** [November 10, 2023, 11:32am UTC](https://forum.search-guard.com/t/assess-cve-2023-44487-for-search-guard/2469 "2023-11-10T11:32:35Z")
Hi Team Search Guard plugin contains references to Netty codec which has been reported as affected by CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancella… --- ## [Search guard alerting system display](https://forum.search-guard.com/t/search-guard-alerting-system-display/2388)
**Author:** [@micou12](https://forum.search-guard.com/u/micou12)\ **Replies:** 0\ **Last updated:** [December 19, 2022, 12:18pm UTC](https://forum.search-guard.com/t/search-guard-alerting-system-display/2388 "2022-12-19T12:18:54Z")
Hello Search guard team, Want to ask the team if you configure search guard on Elasticsearch and Kibana you can get alerts on the monitor (poping up alerts on the monitor screen), is it possible for community version? i… --- ## [Integrating elasticsearch with search guard (alerting purpose)](https://forum.search-guard.com/t/integrating-elasticsearch-with-search-guard-alerting-purpose/2381)
**Author:** [@micou12](https://forum.search-guard.com/u/micou12)\ **Replies:** 4\ **Last updated:** [December 15, 2022, 10:48am UTC](https://forum.search-guard.com/t/integrating-elasticsearch-with-search-guard-alerting-purpose/2381 "2022-12-15T10:48:45Z")
Hi team, This is my first time with Search Guard, I am interested to use it for alerting system . can anyone guide how to proceed ? how to integrate it with my running elasticsearch cluster accessible using kibana? Your… --- ## [How to search .signals index during alerts](https://forum.search-guard.com/t/how-to-search-signals-index-during-alerts/2357)
**Author:** [@ankita1596](https://forum.search-guard.com/u/ankita1596)\ **Replies:** 9\ **Last updated:** [November 3, 2022, 5:00pm UTC](https://forum.search-guard.com/t/how-to-search-signals-index-during-alerts/2357 "2022-11-03T17:00:15Z")
Hi Team, I need to send the alert id along with the alert to Netcool, however there is no way to apply search query in alerts on .signals index. Kindly suggest some workaround. //Ankita --- ## [Resolve without severity option selected](https://forum.search-guard.com/t/resolve-without-severity-option-selected/2371)
**Author:** [@ankita1596](https://forum.search-guard.com/u/ankita1596)\ **Replies:** 9\ **Last updated:** [November 24, 2022, 11:54am UTC](https://forum.search-guard.com/t/resolve-without-severity-option-selected/2371 "2022-11-24T11:54:02Z")
Hi Team, Is there any option to select the resolve option without clicking on the severity selected? --- ## [Signals Alerting through Webhook](https://forum.search-guard.com/t/signals-alerting-through-webhook/2368)
**Author:** [@amalk12](https://forum.search-guard.com/u/amalk12)\ **Replies:** 8\ **Last updated:** [November 23, 2022, 6:19pm UTC](https://forum.search-guard.com/t/signals-alerting-through-webhook/2368 "2022-11-23T18:19:37Z")
If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions. Elasticsearch version: 7.17.3 Server OS version: Windows 2019… --- ## [CPU Percentage Alert](https://forum.search-guard.com/t/cpu-percentage-alert/2370)
**Author:** [@ankita1596](https://forum.search-guard.com/u/ankita1596)\ **Replies:** 0\ **Last updated:** [November 10, 2022, 6:24am UTC](https://forum.search-guard.com/t/cpu-percentage-alert/2370 "2022-11-10T06:24:54Z")
Hi Team, I want to send the alerts if in my infrastructure any device’s cpu pct is greater than 80%. I have written the below query. { “size”: 0, “query”: { “bool”: { “filter”: { “range”: { “@timestamp”: { “gt… --- ## [Webhook Integration](https://forum.search-guard.com/t/webhook-integration/2352)
**Author:** [@ankita1596](https://forum.search-guard.com/u/ankita1596)\ **Replies:** 7\ **Last updated:** [November 7, 2022, 7:55am UTC](https://forum.search-guard.com/t/webhook-integration/2352 "2022-11-07T07:55:20Z")
Hi Team, I have integrated ES-7.17.6 with Searchguard. However, during webhook integration, I am getting the below error. Web hook returned error: HTTP/1.1 400 Bad Request\\n\\n My alert is as follows: Match condition … --- ## [Searchguard Resolve Action](https://forum.search-guard.com/t/searchguard-resolve-action/2358)
**Author:** [@ankita1596](https://forum.search-guard.com/u/ankita1596)\ **Replies:** 2\ **Last updated:** [October 19, 2022, 5:39pm UTC](https://forum.search-guard.com/t/searchguard-resolve-action/2358 "2022-10-19T17:39:58Z")
Hi Team, How does resolve option works in searchguard? --- ## [Is it possible to disable auth/roles and enable only signals](https://forum.search-guard.com/t/is-it-possible-to-disable-auth-roles-and-enable-only-signals/2356)
**Author:** [@keety](https://forum.search-guard.com/u/keety)\ **Replies:** 1\ **Last updated:** [October 4, 2022, 11:11am UTC](https://forum.search-guard.com/t/is-it-possible-to-disable-auth-roles-and-enable-only-signals/2356 "2022-10-04T11:11:00Z")
For elasticsearch 7.17.6 is it possible to disable all auth and just use the signals feature of SearchGaurd. --- ## [Not able to retrieve run time data from watcher(signals)](https://forum.search-guard.com/t/not-able-to-retrieve-run-time-data-from-watcher-signals/2336)
**Author:** [@veldichandipriya](https://forum.search-guard.com/u/veldichandipriya)\ **Replies:** 1\ **Last updated:** [July 25, 2022, 2:11pm UTC](https://forum.search-guard.com/t/not-able-to-retrieve-run-time-data-from-watcher-signals/2336 "2022-07-25T14:11:57Z")
Hi , I am trying to write script in actions section where i have to add that attached runtime data of fields(app, env, ip etccc) into an index, but somehow I am not able to retrieve runtime data for those fields. Any su… --- ## [Add csv files to email from Kibana](https://forum.search-guard.com/t/add-csv-files-to-email-from-kibana/2329)
**Author:** [@johngatsu1991](https://forum.search-guard.com/u/johngatsu1991)\ **Replies:** 0\ **Last updated:** [June 19, 2022, 10:15pm UTC](https://forum.search-guard.com/t/add-csv-files-to-email-from-kibana/2329 "2022-06-19T22:15:27Z")
is it possible to add reports(CSV files) from Kibana to Signals when sending alerts via email? if so, how can we achieve this? --- ## [Attachments option](https://forum.search-guard.com/t/attachments-option/2311)
**Author:** [@johngatsu1991](https://forum.search-guard.com/u/johngatsu1991)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 4:27pm UTC](https://forum.search-guard.com/t/attachments-option/2311 "2022-05-26T16:27:44Z")
Current version 7.16.2 SG: 52.6.0 SG Kibana: 52.1.0 CentOS 7 All bare metal Linux on physical hardware I was looking at the “Attachments” feature But for some reason, I can’t find that option within my “Action” … --- ## [Error executing alerting apiKey](https://forum.search-guard.com/t/error-executing-alerting-apikey/2253)
**Author:** [@peter82](https://forum.search-guard.com/u/peter82)\ **Replies:** 4\ **Last updated:** [December 13, 2021, 7:59am UTC](https://forum.search-guard.com/t/error-executing-alerting-apikey/2253 "2021-12-13T07:59:05Z")
Please does anyone know how to get rid of this WARNING messages in kibana logs ? It’s being logged every 10 minutes. Elasticsearch version: 7.15.1 Kibana sg plugin version: 52.1.0 {"ecs":{"version":"1.9.0"},"@timest… --- ## [Signals configured but missing events matching watch condition](https://forum.search-guard.com/t/signals-configured-but-missing-events-matching-watch-condition/2247)
**Author:** [@cmosnocsoc](https://forum.search-guard.com/u/cmosnocsoc)\ **Replies:** 3\ **Last updated:** [November 18, 2021, 1:06pm UTC](https://forum.search-guard.com/t/signals-configured-but-missing-events-matching-watch-condition/2247 "2021-11-18T13:06:59Z")
How to receive different alerts using the same “mysearch” of the watch. For example, the main idea is to receive an email alert every time a source IP changes. In other words, how to receive an email alert for every even… --- ## [Problems to configure Email connection on Signals](https://forum.search-guard.com/t/problems-to-configure-email-connection-on-signals/2239)
**Author:** [@sidineycrescencio](https://forum.search-guard.com/u/sidineycrescencio)\ **Replies:** 4\ **Last updated:** [November 12, 2021, 1:17pm UTC](https://forum.search-guard.com/t/problems-to-configure-email-connection-on-signals/2239 "2021-11-12T13:17:30Z")
Hello, I would appreciate some help on how to fix this issue I’m having to setup my SMTP to sending the signals. Using the latest version of Elasticsearch the search guard plugins. I use mailgun as SMTP, and been usin… --- ## ["request \[/\_signals/watch,\_main,\_search\] contains unrecognized parameter: \[scroll\]"](https://forum.search-guard.com/t/request-signals-watch-main-search-contains-unrecognized-parameter-scroll/2238)
**Author:** [@lzukel](https://forum.search-guard.com/u/lzukel)\ **Replies:** 3\ **Last updated:** [November 11, 2021, 8:30am UTC](https://forum.search-guard.com/t/request-signals-watch-main-search-contains-unrecognized-parameter-scroll/2238 "2021-11-11T08:30:29Z")
If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions. Elasticsearch version: 7.10.2 Searchguard version. 49.0.0 S… --- ## [Signals runtime data not accessible](https://forum.search-guard.com/t/signals-runtime-data-not-accessible/2203)
**Author:** [@marwojt](https://forum.search-guard.com/u/marwojt)\ **Replies:** 13\ **Last updated:** [October 4, 2021, 10:59am UTC](https://forum.search-guard.com/t/signals-runtime-data-not-accessible/2203 "2021-10-04T10:59:26Z")
Hi, few days ago we have upgraded/patched cluster with Search Guard 7.x Bugfix Release July 2021. for ELK 7.9.3 I see there is some problem with accessing runtime data in type condition. For example simple watch. wat… --- ## [Signals - Internal auth token does not allow audience](https://forum.search-guard.com/t/signals-internal-auth-token-does-not-allow-audience/2222)
**Author:** [@marwojt](https://forum.search-guard.com/u/marwojt)\ **Replies:** 4\ **Last updated:** [September 30, 2021, 1:20pm UTC](https://forum.search-guard.com/t/signals-internal-auth-token-does-not-allow-audience/2222 "2021-09-30T13:20:06Z")
Hi, we are using ELK 7.9.3 with SG 4.7.3.0 I have some errors from one of signals active tenants. This error is not on all active watches in this tenant. Just on a few. What could be the reason? Error while verifyin… --- ## [Anomaly detection alerts](https://forum.search-guard.com/t/anomaly-detection-alerts/2210)
**Author:** [@lior-fort](https://forum.search-guard.com/u/lior-fort)\ **Replies:** 5\ **Last updated:** [September 9, 2021, 9:09am UTC](https://forum.search-guard.com/t/anomaly-detection-alerts/2210 "2021-09-09T09:09:04Z")
Hello, I’m using Elasticsearch 7.14 (currently on the Elastic cloud) I’m new to Search guard, just found it on the web… I wanted to ask please weather it’s possible to use the Anomalies engine without the security fea… --- ## [Adding data from signals query into message](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200)
**Author:** [@ericl](https://forum.search-guard.com/u/ericl)\ **Replies:** 6\ **Last updated:** [August 19, 2021, 3:26pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200 "2021-08-19T15:26:27Z")
Lets say i get an array of results when firing a signals alert. Is there a way to iterate through all the results and include them in the message that’s being sent out from the alert? --- ## [Watches if Message Contains Text - Please Help](https://forum.search-guard.com/t/watches-if-message-contains-text-please-help/2202)
**Author:** [@Mmatos](https://forum.search-guard.com/u/Mmatos)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 8:15pm UTC](https://forum.search-guard.com/t/watches-if-message-contains-text-please-help/2202 "2021-08-17T20:15:16Z")
Hi I will like to know if it is possible to create an alert based on a number (count ) of text in a message. Example let say I receive 5 messages or more in one hour that contains the word “failed”. Can create an alert… --- ## [Search Guard Signals](https://forum.search-guard.com/t/search-guard-signals/2183)
**Author:** [@michael.mack](https://forum.search-guard.com/u/michael.mack)\ **Replies:** 2\ **Last updated:** [June 24, 2021, 8:03am UTC](https://forum.search-guard.com/t/search-guard-signals/2183 "2021-06-24T08:03:01Z")
Has anyone set up signals while disabling search guard security? The idea is to use x-pack basic for authentication, authorization, and TLS and use search guard signals for alerting to get email alerts, slack, etc. X-p… --- ## [Error while initializing IndexJobStateStore "this.nodeId" is null](https://forum.search-guard.com/t/error-while-initializing-indexjobstatestore-this-nodeid-is-null/2129)
**Author:** [@marwojt](https://forum.search-guard.com/u/marwojt)\ **Replies:** 4\ **Last updated:** [March 15, 2021, 8:49am UTC](https://forum.search-guard.com/t/error-while-initializing-indexjobstatestore-this-nodeid-is-null/2129 "2021-03-15T08:49:52Z")
Hi, i have problem with signals. Everything was working fine until i get this error “Error while initializing IndexJobStateStore”. When i get it watchers are not executed anymore. I also start getting errors about watch… --- ## [Signals Watch getting "Failed to Fetch"](https://forum.search-guard.com/t/signals-watch-getting-failed-to-fetch/2091)
**Author:** [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\ **Replies:** 22\ **Last updated:** [February 23, 2021, 6:43pm UTC](https://forum.search-guard.com/t/signals-watch-getting-failed-to-fetch/2091 "2021-02-23T18:43:45Z")
TL;DR Search Guard Watch doesn’t appear to be executing, receiving “failed to fetch” in Kibana UI. Application Version Elastic Stack 7.10.2 with SG 49.0.0, running in EKS on stock Elastic images, with Search Guard insta… --- ## [Alerting via iLert](https://forum.search-guard.com/t/alerting-via-ilert/2047)
**Author:** [@theodor](https://forum.search-guard.com/u/theodor)\ **Replies:** 3\ **Last updated:** [February 23, 2021, 2:05pm UTC](https://forum.search-guard.com/t/alerting-via-ilert/2047 "2021-02-23T14:05:06Z")
Hi, did anyone manage to integrate with iLert for alerting? They have an API, but because the webhook payload cannot be customised in SG, using the webhook action doesn’t seem to be an option. Thanks, Theo --- ## [Send Text-Only Email Alert from Signals Watch](https://forum.search-guard.com/t/send-text-only-email-alert-from-signals-watch/2098)
**Author:** [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\ **Replies:** 2\ **Last updated:** [February 18, 2021, 6:36pm UTC](https://forum.search-guard.com/t/send-text-only-email-alert-from-signals-watch/2098 "2021-02-18T18:36:00Z")
Title says it all. Is it possible to configure Signals to send a text-only email alert, with no HTML content? I attempted to just leave the HTML content blank, which gave me no text when I attempted to view the email in … --- ## [Receiving signals\_unavailable\_exception](https://forum.search-guard.com/t/receiving-signals-unavailable-exception/2054)
**Author:** [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\ **Replies:** 9\ **Last updated:** [February 15, 2021, 9:07am UTC](https://forum.search-guard.com/t/receiving-signals-unavailable-exception/2054 "2021-02-15T09:07:05Z")
TL;DR Receiving signals\_unavailable\_exception when going to Search Guard Signals in 7.10.1, did not have issue in 7.9.1. Full Issue I’ve recently updated our environment to 7.10.1 from 7.9.1. I’m using the official Elas… [Next page](https://forum.search-guard.com/c/alerting-signals/12.md?page=1)