Release PR

alert-policies/aws-network-firewall/HighRejectedPackets.yml

@@ -0,0 +1,34 @@
+name: High Rejected Packets
+
+description: |+
+  This alert is triggered if the number of Rejected Packets exceeds 200 for 10 minutes.
+
+type: STATIC
+nrql:
+  query: "SELECT sum(`aws.networkfirewall.RejectedPackets`) as 'Query' FROM Metric"
+
+# Function used to aggregate the NRQL query value(s) for comparison to the terms.threshold (Default: SINGLE_VALUE)
+valueFunction: SINGLE_VALUE
+
+# List of Critical and Warning thresholds for the condition
+terms:
+  - priority: CRITICAL
+    # Operator used to compare against the threshold.
+    operator: ABOVE
+    # Value that triggers a violation
+    threshold: 200
+    # Time in seconds; 120 - 3600
+    thresholdDuration: 600
+    # How many data points must be in violation for the duration
+    thresholdOccurrences: ALL
+
+  # Adding a Warning threshold is optional
+  - priority: WARNING
+    operator: ABOVE
+    threshold: 100
+    thresholdDuration: 600
+    thresholdOccurrences: ALL
+
+# Duration after which a violation automatically closes
+# Time in seconds; 300 - 2592000 (Default: 86400 [1 day])
+violationTimeLimitSeconds: 86400

alert-policies/aws-network-firewall/HighTLSErrors.yml

@@ -0,0 +1,34 @@
+name: High TLS Errors
+
+description: |+
+  This alert is triggered if the number of TLS Errors exceeds 200 for 10 minutes.
+
+type: STATIC
+nrql:
+  query: "SELECT sum(`aws.networkfirewall.TLSErrors`) as 'Query' FROM Metric"
+
+# Function used to aggregate the NRQL query value(s) for comparison to the terms.threshold (Default: SINGLE_VALUE)
+valueFunction: SINGLE_VALUE
+
+# List of Critical and Warning thresholds for the condition
+terms:
+  - priority: CRITICAL
+    # Operator used to compare against the threshold.
+    operator: ABOVE
+    # Value that triggers a violation
+    threshold: 200
+    # Time in seconds; 120 - 3600
+    thresholdDuration: 600
+    # How many data points must be in violation for the duration
+    thresholdOccurrences: ALL
+
+  # Adding a Warning threshold is optional
+  - priority: WARNING
+    operator: ABOVE
+    threshold: 100
+    thresholdDuration: 600
+    thresholdOccurrences: ALL
+
+# Duration after which a violation automatically closes
+# Time in seconds; 300 - 2592000 (Default: 86400 [1 day])
+violationTimeLimitSeconds: 86400