apiVersion: 1

contactPoints:
  - orgId: 1
    name: teams-webhook
    receivers:
      - uid: teams-webhook
        type: webhook
        settings:
          url: ${TEAMS_WEBHOOK_URL}
          httpMethod: POST
        disableResolveMessage: true

policies:
  - orgId: 1
    receiver: teams-webhook
    group_by:
      - alertname
      - grafana_folder
    group_wait: 0s
    group_interval: 5m
    repeat_interval: 4h

groups:
  - orgId: 1
    name: ahnlab-risk
    folder: Ahnlab Security
    interval: 1m
    rules:
      - uid: ahnlab-mds-risk-exists
        title: MDS Risk Exists (Low/Medium/High)
        condition: B
        data:
          - refId: A
            datasourceUid: loki
            relativeTimeRange:
              from: 300
              to: 0
            model:
              datasource:
                type: loki
                uid: loki
              editorMode: builder
              expr: sum(count_over_time({service="ahnlab_mds", risk=~"Low|Medium|High"}[5m]))
              queryType: instant
              refId: A
              intervalMs: 1000
              maxDataPoints: 43200
          - refId: B
            datasourceUid: "__expr__"
            model:
              conditions:
                - evaluator:
                    params:
                      - 0
                    type: gt
                  operator:
                    type: and
                  query:
                    params:
                      - A
                  reducer:
                    type: last
                  type: query
              datasource:
                type: __expr__
                uid: "__expr__"
              expression: A
              intervalMs: 1000
              maxDataPoints: 43200
              refId: B
              type: classic_conditions
        dashboardUid: ahnlab-security
        panelId: 30
        noDataState: OK
        executionErrorState: Alerting
        for: 0s
        annotations:
          summary: MDS Risk detected
          description: MDS risk logs detected in last 5m. Service=ahnlab_mds.
        labels:
          service: ahnlab_mds
          severity: warning
        isPaused: false
      - uid: ahnlab-epp-risk-exists
        title: EPP Risk Exists (Low/Medium/High)
        condition: B
        data:
          - refId: A
            datasourceUid: loki
            relativeTimeRange:
              from: 300
              to: 0
            model:
              datasource:
                type: loki
                uid: loki
              editorMode: builder
              expr: sum(count_over_time({service="ahnlab_epp", risk=~"Low|Medium|High"}[5m]))
              queryType: instant
              refId: A
              intervalMs: 1000
              maxDataPoints: 43200
          - refId: B
            datasourceUid: "__expr__"
            model:
              conditions:
                - evaluator:
                    params:
                      - 0
                    type: gt
                  operator:
                    type: and
                  query:
                    params:
                      - A
                  reducer:
                    type: last
                  type: query
              datasource:
                type: __expr__
                uid: "__expr__"
              expression: A
              intervalMs: 1000
              maxDataPoints: 43200
              refId: B
              type: classic_conditions
        dashboardUid: ahnlab-security
        panelId: 31
        noDataState: OK
        executionErrorState: Alerting
        for: 0s
        annotations:
          summary: EPP Risk detected
          description: EPP risk logs detected in last 5m. Service=ahnlab_epp.
        labels:
          service: ahnlab_epp
          severity: warning
        isPaused: false
