Find out which log file triggered decision

crowdsec
1

Hey guys,

Is there a way I can find out which log file triggered a decision?

This would help me find out which services are triggering the most alerts.

Thanks!

2

Yes, when you have an alert you can run cscli alerts list then take the alert ID and feed that into cscli alerts inspect -d <ID> it will give you the log file name and the contents of the bucket

1 Like