How to Create an Event-Based Job
This guide assumes that you have already installed Resoto.
Define the action you would like to automate. For example, let's say we want to create a PagerDuty alert if a publicly accessible database is detected:
> search is(database) and db_publicly_accessible==true | pagerduty summary="Databases found that are publicly accessible" dedup_key="dbs_publicly_accessible"tip
See Search How-To Guides for guidance on how to write search queries.
Now that we've defined the action and decided on the trigger, create the job using the
jobs addcommand (replace the value of the
--idparameter with a unique job identifier):
> jobs add --id alert_public_dbs --wait-for-event post_collect 'search is(database) and db_publicly_accessible==true | pagerduty summary="Databases found that are public to the internet" dedup_key="dbs_publicly_accessible"'