topic Re: Wondering if Policy Push can be alerted with the help of Skyline? in OpenTelemetry/Skyline

Wondering if Policy Push can be alerted with the help of Skyline?

Blason_R — Sun, 23 Apr 2023 18:01:54 GMT

Hi Folks,

I am now good with Skyline alerts and have created a bunch of of those. Now I am wondering if policy pushed can be tracked and alerted with the help of opentelemetry or skyline?

Here is my query

(firewall_policy_time{host_name="Firewall", environment=~"Default", service_namespace="vs_id_0"}>100000)*1000

@Arik_Ovtracht - Can you please help?

TIA

Blason R

Re: Wondering if Policy Push can be alerted with the help of Skyline?

Elad_Chomsky — Mon, 24 Apr 2023 13:07:00 GMT

Hi @Blason_R ,

Try to experiment by doing something like this -

(firewall_policy_time { host_name="Firewall", environment=~"Default", service_namespace="vs_id_0"} - firewall_policy_time{ host_name="Firewall", environment=~"Default", service_namespace="vs_id_0"} offset 15s) != bool 0

I used the offset instruction to get the last sample ( 15s before ), then I compared the difference and checked if it is not 0.

In general the use case that you are referring to is classified as an 'event'.

We are aiming to support events in the future, and it is currently part of our plans and roadmap.

Re: Wondering if Policy Push can be alerted with the help of Skyline?

Blason_R — Mon, 24 Apr 2023 12:54:40 GMT

That is great and thanks for the input. However that query is not working for me.

Re: Wondering if Policy Push can be alerted with the help of Skyline?

Blason_R — Mon, 24 Apr 2023 12:59:45 GMT

This is correct and then I can define Last of $A != 0

(firewall_policy_time { host_name="Firewall", environment=~"Default", service_namespace="vs_id_0" } - firewall_policy_time { host_name="Firewall", environment=~"Default", service_namespace="vs_id_0"} offset 15s)

Re: Wondering if Policy Push can be alerted with the help of Skyline?

Elad_Chomsky — Mon, 24 Apr 2023 13:09:27 GMT

I have fixed the query on the original post, please retry -

1 - policy has changed

0 - policy has not changed

Please contact me privately on eladch@checkpoint.com, so I can try to assist you with any further issues.