Rules and Alerts
Conditional notifications for risk and anomaly detection
Last updated
Was this helpful?
Conditional notifications for risk and anomaly detection
Last updated
Was this helpful?
Was this helpful?
Veza's rules engine enables active monitoring of authorization changes within your environment. Rules and Alerts offer ways to establish security baselines based on any custom or built-in assessment query, and trigger notifications and Veza Actions when changes occur. For example, you might use Veza rules to:
Identity new or removed accounts with superuser permissions on sensitive resources
Get notifications for storage buckets with incorrect configurations
Watch for changes to roles, IAM policies, or any other entity Veza has discovered.
When a rule is configured for a saved query, actions will trigger when the query results meet the conditions established by the rule. The baseline query, thresholds, and notification settings for these alert events are set when creating the rule. You can create your own queries to define the rule scope, or choose from built-in assessment queries. Alert notifications can use a webhook, email, or an external integration.
Possible rule and query combinations include:
When your environment includes one or more Azure AD groups with no users
When a new AWS IAM policy granting access to * resources is detected
When the number of federated Okta users with AWS DynamoDB access changes
When there are fewer than 2 principles with permissions for critical administrative tasks (in case one becomes unavailable)
To highlight these entities in Search and show risk levels, mark the query as a Risk (in addition to, or instead of, creating an alert rule).
Use the actions dropdown menu to create or edit rules for any assessment in a report. You can create and manage rules when saving a query.
Alert firing logic: Veza's alert system prevents excessive notifications. Once an alert is triggered by a specific condition—such as the result count exceeding 5—it will not re-trigger for the same condition until the metric falls back to or below 5 and then rises above it again.
To create a rule for a saved query, go to Access Search > Saved Queries. You can also create rule directly from the Query Builder or any dashboard.
To add a rule for a saved query:
On the Saved Queries page, filter or search to find a built-in or user-created query. Click Manage Rules from the actions menu to edit rules for the query.
Click Add a new rule to open the rule builder:
Give the rule a name and description, and set the severity level.
You can configure escalating levels of rules to trigger different actions based on the severity level: High, Medium, or Low.
Configure rule conditions:
Choose to trigger the rule based on the number of Query Results, or changes in Query Properties:
Query Results: Choose an operator (equals, less than, more than, changed by, changed by more than, increased by more than) and count to trigger the rule.
Query Properties: Choose an attribute that will trigger the rule if it changes.
Configure rule actions (optional):
Check the box to deliver the alert via the selected Veza Action: email, webhook, ServiceNow, or Jira. The alert will include details about the query result that triggered the rule for remediation purposes.
If you have not configured a supported Veza Action, click Create Veza Action to open the builder in a new tab. To enable Webhooks and other destinations, see Veza Actions.
Click Save to close the rule builder.
On the Save Query flow, add additional rules as desired.
Click Save Query to save your changes.
Once saved and enabled, the rule will appear active on the Rules tab of the Access Intelligence > Rules & Alerts page.
To deliver the notification via a webhook, email, or Slack, you will first need to create the connection from Integrations > Veza Actions. When the rule triggers, a JSON payload will be delivered to the destination address, including:
The query and results that triggered the rule
The previous query results
The entities that changed between the two updates
Supported targets for alerts are:
Veza notifications are always enabled for active rules. A notification icon with the number of any new alerts is shown on the Veza navigation menu, with more details available on the Access Intelligence > Rules and Alerts page. The list can be sorted by date or severity.
Each row on the Rules tab represents a Query with a rule attached, with the option to view query details, edit the rule, or delete the rule.
The Alert Details tab shows individual alert events for each time the rule has been triggered, including the trigger condition and description.