Alerting when Daily Ingestion Threshold reaches 80%

PA_nts — Thu, 03 Jul 2025 11:06:32 GMT

Just wanted to share this with everyone - i am sure it might be useful if not already deployed. Feel free to comment on possible enhancements/ recommendations.

The Query below will calculate the daily ingestion per GB and will output 'TRUE' if it exceeds 80% of daily ingestion.

dataset = metrics_source
| comp sum(total_size_bytes ) as total_ingestion_gb
| alter total_ingested_gb = divide(round(multiply(divide(total_ingestion_gb, pow(to_number(1024), to_number(3))), 100)), 100)
| alter is_exceeding_80_percent = if(total_ingested_gb <XX>, "TRUE", "FALSE")
| fields total_ingested_gb, is_exceeding_80_percent
| filter is_exceeding_80_percent = "TRUE"

(just replace <XX> with your 80% value in GB)

In the above example, if Daily ingestion is above <XX>GB per day, it should output as TRUE.

Then create a correlation rule that runs once a day if if exceeded, will generate an Alert if TRUE.

Then set a Trigger condition/automation to notify (in my case via email) the persons responsible.

tested seems to work

rgds

topic Alerting when Daily Ingestion Threshold reaches 80% in Cortex XSIAM Discussions

Alerting when Daily Ingestion Threshold reaches 80%