Reference: alert template schema

This section documents the alert schema for use with alert templates.

The types defined in the Type column are either native Go types or are custom types that Sophos defined. This document uses lowercase names for native Go types and capitalized names for custom types. Every custom type defined below has its own section. The Usage Example column provides a template example that can be copied and pasted into your template for certain use cases. In the case of nested fields, the example inclides the names of the parent fields required for access (for example {{.ProcessInfo.Program}}). In the case of slices, data is accessible through either the range action or the index function (for example {{range .Lineage}} {{.Program.Path}} {{end}}). Remember that the provided usage examples aren't the only way to use the alert fields in an Alert Template. The alert schema differs between the JSON and Alert Template formats. For that reason, it's important to consult this documentation. See Alert configuration templates.

Alert

Alert is the top-level Sophos Linux Sensor Alert type.

AlertLocation

AlertLocation is accessible through the Alert Location field.

AlertNotification

AlertNotification is accessible through the Alert Notifications field which is a slice.

AlertMessageFields

AlertMessageFields are accessible through the Alert Notification's MessageFields.

ModifiedElement

ModifiedElement is accessible through the Alert Notification's MessageFields.ModifiedElements field which is a slice.

AlertFilterMatch

AlertFilterMatch is accessible through the Alert MatchedObjects field which is a slice.

ProcessInfo

ProcessInfo is accessible through the Alert ProcessInfo field and the Alert Lineage field which is a slice.

The usage examples below illustrate the simpler path through the Alert ProcessInfo field.

For access through the Alert Lineage field do the following:

{{range .Lineage}} {{.$FIELD}} {{end}}

Replace $FIELD with your field name of choice (for example Uuid).

ThreadGroupInfo

ThreadGroupInfo is accessible through the Alert ThreadGroupInfo field and the Alert Lineage's ThreadGroupInfo field.

The usage examples below illustrate the simpler path through the Alert ThreadGroupInfo field.

For access through the Alert Lineage field do the following:

{{range .Lineage}} {{.ThreadGroupInfo.$FIELD}} {{end}}

Replace $FIELD with your field name of choice (for example Parent).

ProgramInfo

ProgramInfo is accessible through the Alert ProcessInfo field and the Alert Lineage's ProcessInfo field.

The usage examples below illustrate the simpler path through the Alert ProcessInfo field.

For access through the Alert Lineage field do the following:

{{range .Lineage}} {{.Program.$FIELD}} {{end}}

Replace $FIELD with your field name of choice (for example Path).

Enum Types

Priority

Confidence

PolicyType

Scope

GroupingScope