Customize assertion name and description

You can customize assertion names and descriptions with dynamic field values using string interpolation.

About this task

When saving an assertion, you can use field placeholders in the name and description fields. These placeholders are replaced with actual values from your query results when alerts are generated. This lets you create more descriptive and context-aware assertion names and alert descriptions.

Procedure

  1. In the top navigation bar, select icon > Assertions.
    The Assertions page opens.
  2. In the query field, enter a query.
  3. Select Enter.
  4. Select Save.
    A dialog shows.
  5. In the Name field, enter a name for the assertion. To insert a field value from your query, select the plus icon button next to the field.
    A placeholder {{FIELD_NAME}} is inserted into the field with FIELD_NAME highlighted. Replace it with the actual field name from your query.
    Tip:
    Field names must match the fields returned by your query. For example, if your query returns host, name, or ip fields, you can use {{host}}, {{name}}, or {{ip}}.
  6. In the Description field, enter a description. You can also use field placeholders here by selecting the plus icon button.
    Example: The sensor {{host}} with model {{model}} has been offline for more than 15 minutes
  7. Complete the remaining fields in the dialog and select Save.

Results

When the assertion generates an alert, the placeholders in the name and description are replaced with the actual values from the query results.

Example

If you save an assertion with the following configuration:

  • Name: Sensor offline: {{host}}
  • Description: The sensor {{host}} with model {{model}} has not synchronized in the last 15 minutes
  • Query: sensors | where minutes_ago(last_sync) > 15 | assert_empty

When a sensor with host = nozomi-guardian and model = V-SERIES fails the assertion, the generated alert will display:

  • Name: Sensor offline: nozomi-guardian
  • Description: The sensor nozomi-guardian with model V-SERIES has not synchronized in the last 15 minutes