Detect and alert

Detection in Vigilfield has three parts. Each has its own page in the app sidebar.

• Rules are saved VFQL queries that run on a cron schedule. Each run reads only the data that arrived since the rule's last successful run, and writes its rows to a result table.
• Alerts are what a rule's rows become when you turn alerting on for the rule. Vigilfield also raises system alerts of its own, for events such as a failed rule run or a quarantined source.
• Alert destinations are where alerts are sent: an Amazon SNS topic or an HTTPS webhook that your team watches.

The flow is:

1. You write a rule and give it a schedule.
2. On each scheduled run, Vigilfield reads what changed in the rule's source tables and runs the query over it.
3. If the rule alerts, each of the run's first 10 rows opens an alert, or adds a hit to an alert that is already open for the same key.
4. When an alert opens, Vigilfield delivers it once to each of the rule's destinations.
5. You acknowledge and resolve the alert on the Alerts page.

Where to go next

• Rules: create a rule, set its schedule, and read its run history.
• Alerts: turn alerting on, shape each alert from the query, and work the alert lifecycle.
• Alert destinations: set up an SNS topic or a webhook, verify it, and check what it receives.

The query language itself, including exactly what a scheduled run reads and the alert_key, alert_title and alert_description columns, is covered in VFQL, the query language.