Configuring modular alert actions and reporting action performance information

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

• receiving, through a graphical interface for creating modular alerts, input defining a modular alert comprising:
• a correlation search used to identify notable events from events stored by a data intake and query system in a field-searchable data store, wherein each of the events includes a time stamp and a portion of raw machine data produced by a component of an information technology or security environment and reflects activity in the information technology or security environment, and wherein the correlation search is executed based on a recurring schedule specified in the input;
• a triggering condition reflected in criteria in the correlation search, the triggering condition representing detection of a potential security threat;
• and
• a plurality of actions to be executed based on the triggering condition being satisfied during execution of the correlation search, the plurality of actions including:
• a first action involving execution of a query against time stamped event data stored by the data intake and query system in the field-searchable data store, wherein the query is used to obtain additional information related to a notable event identified based on execution of the correlation search, and wherein execution of the query returns first results information, and
• a second action to be executed by a security application that is external to the data intake and query system, wherein execution of the second action by the security application returns second results information;
• persisting the modular alert in memory;
• executing the correlation search included in the modular alert according to the recurring schedule;
• detecting the triggering condition in the modular alert;
• based on detecting the triggering condition, executing the plurality of actions in the modular alert including the first action and the second action;
• obtaining information associated with execution of the plurality of actions;
• and
• causing display of a graphical user interface (GUI) including information representing a notable event identified based on execution of the correlation search, the first results information obtained by executing the first action involving execution of a query against time stamped event data stored by the data intake and query system, and the second results information obtained based on the security application executing the second action.

An apparatus, comprising:

• one or more processors;
• a non-transitory computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
• receive, through a graphical interface for creating modular alerts, input defining a modular alert comprising:
• a correlation search used to identify notable events from events stored by a data intake and query system in a field-searchable data store, wherein each of the events includes a time-stamp and a portion of raw machine data produced by a component of an information technology or security environment and reflects activity in the information technology or security environment, and wherein the correlation search is executed based on a recurring schedule specified in the input;
• a triggering condition reflected in criteria in the correlation search, the triggering condition representing detection of a potential security threat;
• and
• a plurality of actions to be executed based on the triggering condition being satisfied during execution of the correlation search, the plurality of actions including:
• a first action involving execution of a query against time stamped event data stored by the data intake and query system in the field-searchable data store, wherein the query is used to obtain additional information related to a notable event identified based on execution of the correlation search, and wherein execution of the query returns first results information, and
• a second action to be executed by a security application that is external to the data intake and query system, wherein execution of the second action by the security application returns second results information;
• persist the modular alert in memory;
• execute the correlation search included in the modular alert according to the recurring schedule;
• detect the triggering condition in the modular alert;
• based on detecting the triggering condition, execute the plurality of actions in the modular alert including the first action and the second action;
• obtain information associated with execution of the plurality of actions;
• and
• cause display of a graphical user interface (GUI) including information representing a notable event identified based on execution of the correlation search, the first results information obtained by executing the first action involving execution of a query against time stamped event data stored by the data intake and query system, and the second results information obtained based on the security application executing the second action.