IPs are matched against a trie.
Attributes are matched in numerical order of the rule
ip: 206.108.255.0/24: # any alarm with an IP in this range will be treated as impact 4, no matter the alarm type. fido_impact: reason: MICE peering value: '4' 2001:504:27::/64: same_as: 206.108.255.0/24
---
attributes: # some time of day examples. these would be uncommented to actually do something # this rule is only in affect a few hours a day from 2018/12/10 3pm to 2018/12/12 3pm # you can use time OR valid, you don't need to use both.
#time: 2pm-4pm,6pm-8pm #valid: # start: 2018/12/10 3pm # end: 2018/12/12 3pm
'1000':
fido_help_files:
value: BanVAHospital
matches:
'10':
key_match:
___infohash___Descr: ''
descr: ''
device: ''
match: s-vahosp-101-1-access
'1040':
fido_help_files:
value: BAN Support Process
matches:
'10':
key_match:
___infohash___Descr: ''
descr: ''
device: ''
match: ^fa-.*-ban
match_re: 'true'
'1050': # this keeps alarms that match in a 15 minute holddown # the 'absolute_time' tidbit forces the comment to take place automatically fido_holddown: comment: $reason reason: Juniper Fan # one year time: 525960 # item will stay auto commented absolute_time: never fido_impact: reason: Juniper Fan value: '4' # different ways to match on the management network. You need seperate rules since 'matches' are a logical AND, not an OR, but the use of 'same_as' helps reduce errs.
'1200':
fido_help_files:
value: management network
fido_impact:
reason: management network
value: '3'
matches:
'20':
key_match: ___infohash___Descr
# note, this will match even if the descr is :RMI: for example
portTags:
RI: ''
'1210':
same_as: 1200
matches:
'10':
key_match:
device: ''
___infohash___Descr: ''
match:
^t-: ''
^s-.+-mgmt: ''
match_re: '1'
'1220':
same_as: 1200
matches:
'10':
key_match: interface
match:
fxp0: ''
# if this interface is so unimportant that it doesn't have a description, don't escalate it 100000: fido_impact: reason: interface has no description value: '3' matches: '10': key_match: test equal: ifOperStatus '20': key_match: ___infohash___Descr undefined: ''
101000: # this keeps alarms that match in a 15 minute holddown fido_holddown: reason: impact escalation holddown time: 15 matches: 10: key_match: ___impact___value match: 3: '' 4: ''