Skip to content

General Information

Pointers for Troubleshooting

  • This alert will get triggered if any user principal or service principal is granted access to a SCI tagged kafka topic.
  • This alert will also be triggered in scenarios where the access has been granted through the centrally managed access management pipeline. Once it has been established (beyond any doubt) that the alert was generated due to such a scenario, it can be ignored.

KaaS - Access grants to SCI tagged Topics

Search Query

KaaS - Access grants to SCI tagged Topics.txt

Alert Configurations

Owner : KaaSOpsAdmin

Settings - Alert Type : Scheduled - Schedule : Run on Cron Schedule - Cron Expression : */5 * * * * (every 5 minutes) - Time Range : Last 30 minutes - Expires : 90 days

Trigger Conditions - Trigger alert when : Number of Results - is greater than '0' - Trigger : Once - Throttle : Yes - Suppress triggering for : 60 minutes

Trigger Actions - Add to Triggered Alerts - Severity : High - Send email - To : KAASOPS@novonordisk.com - Priority : Highest - Subject : Splunk Alert: $name$ - Message : The alert condition for '$name$' was triggered. KaaS Wiki - Platform Alerts : https://dev.azure.com/novonordiskit/KaaS%20(Kafka%20as%20a%20Service)/_wiki/wikis/Kafka-as-a-Service-Wiki-Homepage/210414/Platform-Alerts - Include : - Link to Alert - Link to Results - Allow Empty Attachments - Type : HTML & Plain Text