General Information¶

Pointers for Troubleshooting¶

This alert will get triggered if any user having OrgAdmin role has tried to interact (read/modify) a Kafka topic that is SCI tagged.

Link to the Alert on Splunk¶

Search Query¶

KaaS - OrgAdmin SCI Topic Interaction.txt

Alert Configurations¶

Owner : KaaSOpsAdmin

Settings - Alert Type : Scheduled - Schedule : Run on Cron Schedule - Cron Expression : */5 * * * * (every 5 minutes) - Time Range : Last 30 minutes - Expires : 90 days

Trigger Conditions - Trigger alert when : Number of Results - is greater than '0' - Trigger : Once - Throttle : Yes - Suppress triggering for : 15 minutes

Trigger Actions - Add to Triggered Alerts - Severity : High - Send email - To : KAASOPS@novonordisk.com - Priority : Highest - Subject : Splunk Alert: $name$ - Message : The alert condition for '$name$' was triggered. KaaS Wiki - Platform Alerts : https://dev.azure.com/novonordiskit/KaaS%20(Kafka%20as%20a%20Service)/_wiki/wikis/Kafka-as-a-Service-Wiki-Homepage/210414/Platform-Alerts - Include : - Link to Alert - Link to Results - Allow Empty Attachments - Type : HTML & Plain Text