{
  "type": "monitor",
  "monitor_type": "query_level_monitor",
  "name": "Falco: event of priority Error or higher",
  "enabled": true,
  "schedule": {
    "period": {
      "interval": 5,
      "unit": "MINUTES"
    }
  },
  "inputs": [
    {
      "search": {
        "indices": [
          "falco-*"
        ],
        "query": {
          "size": 10,
          "_source": [
            "@timestamp",
            "message",
            "source.hostname"
          ],
          "query": {
            "bool": {
              "filter": [
                {
                  "terms": {
                    "priority": [
                      "Emergency",
                      "Alert",
                      "Critical",
                      "Error"
                    ]
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{period_end}}||-5m",
                      "lte": "{{period_end}}",
                      "format": "epoch_millis"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  ],
  "triggers": [
    {
      "name": "Falco reported an event of priority Error or higher",
      "severity": "1",
      "condition": {
        "script": {
          "source": "ctx.results[0].hits.total.value > 0",
          "lang": "painless"
        }
      },
      "actions": []
    }
  ]
}