Tagging devices - criticality

There are multiple ways in which you could do this:

• Using Device Groups, and using those in the Alert queries - e.g. create the same alert several times, once for when the device is in a specific group, and again for when it isn’t, and then give the alert rule a different criticality
• Using lists - similar to the above, but not specifically configured on the device itself, but instead in a list that contains the device names, IP addresses or other identifiers, and then using the lists in alert queries as above
• Using enrichment and a lookup table - the information about a device’s criticality could be present in a lookup table and then used for enrichment, where this additional information is baked into the logs when it arrives. The enrichment source could even be an external database or CSV where this information is maintained. The enriched information could then again either be used for modified alert rules, or just shown alongside the other information from the logs (e.g. through the Jinja template on the alert).

There’s probably other ways of dealing with this but hopefully it has given some ideas.

CSV is an enrichment source, so you find it under “Configuration”. You can either upload a CSV through the browser, or point LogPoint at a URL where a web server hosts the CSV file. There’s no specific documentation on device criticality, but enrichment sources of any kind are covered in the manual (https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/Enrichment%20Sources.html) together with enrichment policies (https://docs.logpoint.com/docs/data-integration-guide/en/latest/Configuration/Enrichment%20Policies.html), and also the User Training course.