Targeted Rule Alerts can deliver events to a webhook. In general, the structure of events will look like this:
{
"event": "budget_alert",
"time": "2019-10-07T01:53:27Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"details": "here"
}
}
The payload of the event depends on the the type of event.
Budget Alerts (budget_alert)
{
"event": "budget_alert",
"time": "2019-10-07T01:53:27Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"current_percentage": 103.65825219813962,
"previous_months_average_spend": 296.9338353384074,
"previous_7_days_average_spend": 307.8394059229423,
"estimated_spend": 8791.539850932151,
"current_budget": 7597.266524324859,
"segment": <segment data>
}
}
If the alert is for a segment, the segment field will have the following structure:
{
"id": 123,
"title": "your-segment",
"view": {
"id": 456,
"name": "your-view"
}
}
Spikes in Daily Spending (run_rate_spike)
Run Rate Spikes detect unexpected spikes in your run rate (the amount spent on a given day) versus the average spend over a period of time.
The structure of this event will look like this:
{
"event": "run_rate_spike",
"time": "2019-10-07T01:53:27Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"normal_run_rate": 400.0,
"current_run_rate": 1000.0,
"variance_percentage": 150.0,
"day": "2019-04-27T00:00:00+00:00",
"comparison_period": {
"starts": "2019-04-20T00:00:00+00:00",
"ends": "2019-04-26T23:59:59+00:00"
},
"last_30_days_total": 16000.0
d}
}
Rules Becoming Non-Compliant (noncompliant_evaluable_rules)
Noncompliant Rules tracks when a previously-passing rule goes from passing to failing. It can contain multiple rules in a batch, and each rule will have an associated set of resources.
The structure of this event will look like this:
{
"event": "noncompliant_evaluable_rules",
"time": "2019-10-05T16:30:48Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"rules": [
{
"rule": {
"id": 123456,
"name": "EC2 instances have IAM instance profiles",
"kind": "Custom"
},
"resources": [
{
"id": "731d05e67c16e96e614440945dec4d763eeace040871b7065de60d63280c9d8c",
"name": "my-ecs-cluster-member",
"resource_type": "ec2-instance",
"aws_region": {
"code": "ap-southeast-2",
"name": "Asia Pacific (Sydney)"
},
"aws_account": {
"name": "my prod env",
"id": "123456789012"
},
"arn": "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0aef123aefaef1230",
"raw_data": {
"id": "i-0aef123aefaef1230",
"name": "my-ecs-cluster-member",
"type": "c3.large",
"image": {
"name": "my-ami-name",
"public": false,
"image_id": "ami-0123456789",
"description": "Test Image"
},
"state": "running",
"region": "ap-southeast-2",
"platform": null,
"availability_zone": "ap-southeast-2b",
"placement_tenancy": "default",
"average_cpu_past_24_hours": 1.98
}
}
]
}
]
}
}
New non-compliant Resources in a Rule (noncompliant_evaluable_resources)
Non-compliant resources tracks when resources start being non-compliant. This occurs when they were passing before but are now failing, or they are newly detected in a failing state.
The payload structure of this event is the same as noncompliant_evaluable_rules, but the semantics are different. In noncompliant_evaluable_rules, the resources are examples, and the rule is the one that has recently become non-compliant. In the case of noncompliant_evaluable_resources, the resources are those that have become non-compliant, and the rules are the ones those resources belong to. The subtle difference is that in this event, the rule could have been non-compliant for a period of time.
The structure of this event will look like this:
{
"event": "noncompliant_evaluable_resources",
"time": "2019-10-05T16:30:48Z",
"client": {
"id": 123,
"name": "Your Organization"
},
"payload": {
"rules": [
{
"rule": {
"id": 123456,
"name": "EC2 instances have IAM instance profiles",
"kind": "Custom"
},
"resources": [
{
"id": "731d05e67c16e96e614440945dec4d763eeace040871b7065de60d63280c9d8c",
"name": "my-ecs-cluster-member",
"resource_type": "ec2-instance",
"aws_region": {
"code": "ap-southeast-2",
"name": "Asia Pacific (Sydney)"
},
"aws_account": {
"name": "my prod env",
"id": "123456789012"
},
"arn": "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0aef123aefaef1230",
"raw_data": {
"id": "i-0aef123aefaef1230",
"name": "my-ecs-cluster-member",
"type": "c3.large",
"image": {
"name": "my-ami-name",
"public": false,
"image_id": "ami-0123456789",
"description": "Test Image"
},
"state": "running",
"region": "ap-southeast-2",
"platform": null,
"availability_zone": "ap-southeast-2b",
"placement_tenancy": "default",
"average_cpu_past_24_hours": 1.98
}
}
]
}
]
}
}