Create an Insights Rule

You must set up an insights rule to select the events for which notifications will be sent via notification channels. 

To create an Insights Rule, follow these steps:

1. Login to the JumpCloud Admin portal.

2. Go to Monitoring > Alerts to view the alerts console.
3. Click Rules to view the dashboard.
4. Click +Rule. This will take you to the Rule Management section with all the predefined rule templates.
   
5. Go to the Insights tab and click Directory Insights Event Monitoring. You can also type the rule name in the Search bar.
6. Leave the Enabled button as is to activate the rule immediately after saving. You can switch the button to Disable if you prefer. 
7. Provide Rule Details:
   1. Rule Name: Enter a clear and concise name for your rule.
   2. Description: Document the purpose of the rule in the description field.
8. Use the Rule Priority dropdown to assign a priority level to the rule. This helps prioritize alerts and manage responses according to the severity of the issue. These options are available:
   • Low - Select this for alerts that are neither urgent nor highly important. They should receive fewer resources and can usually wait until they become more urgent.
   • Medium- Select this for alerts that are urgent but less important. They should receive a moderate allocation of resources.
   • High - Select this for alerts that are important and require immediate attention. They should receive the most resources to ensure they are addressed promptly.

9. In the Conditions section, select the events for which you want to send notifications.
   • You can use the Show Selected Events checkbox to view all the selected events at one go.
   • You can also Add additional attribute filters for each event to enhance your rule conditions. See Configure Event Attribute Filters to learn more.
10. The Alert Trigger Conditions section lets you configure frequency-based alerting. Instead of generating an alert every time an event occurs, you can require an event to occur for a specified number of times within a defined time period before an alert is generated.
    To add an alert trigger condition, configure the following options:

• Threshold Value: The number of event occurrences required before an alert is triggered.

• Monitoring Window: The time period over which event occurrences are counted (for example, 10 minutes, 1 hour, or 7 days).
• Apply Threshold Per Resource (optional): Controls whether occurrences are counted organization-wide or separately for each affected resource.

How Event Occurrences are Counted

By default (Apply Threshold Per Resource disabled), occurrences are counted across your entire organization for each selected event type.

For example, if you configure:

• Event: Device Login Failed
• Threshold Value: 5
• Monitoring Window: 10 minutes

The alert is triggered after five failed device login events anywhere in the organization within 10 minutes, regardless of which devices or users generated the events.

When Apply Threshold Per Resource is enabled, the threshold is evaluated independently for each resource associated with the event. The alert is generated only when a single resource reaches the configured threshold.

For example:

• Five failed logins on Device A trigger an alert.
• Three failed logins on Device A and two on Device B do not trigger an alert because neither device individually reached the threshold.

Example:

For example, consider this event: a policy is created or user is deleted (Threshold = 2, Per Resource toggle button is turned on)

• Action: Administrator creates Policy A, then creates Policy B.
• Result: 1 combined alert is triggered (Org-wide behavior) instead of separate alerts per policy, as global lifecycle events do not bind to individual entity resources during creation/deletion.

9. You can configure the Actions section to either generate alerts, send notifications via configured channels, or both.  You must configure at least one of these options to create a rule.
   • (Optional) Use the Generate Alerts toggle to enable/disable alert generation in the JumpCloud console. When enabled this will generate alerts along with complete lifecycle tracking.
   • (Optional) Use the toggle button to Enable/Disable existing conditions. See Understanding Existing Conditions to learn more.
   • (Optional) Use the Send Notifications toggle to configure sending notifications to your pre-configured notification channels (webhook, email, Slack). See Get Started: Notifications to learn more.
     • Use the Search bar to search and select the channels that you want to send notifications to.
10. In the Additional Notifications section, select the checkbox for each action to enable notifications to the selected channels. This option is only available when both Generate Alerts and Send Notifications are enabled.
    • Alert Resolution: Notify all users in the selected channels when an alert from this rule is resolved.
    • Alert Acknowledgement: Email all users in the selected channels when an alert from this rule is acknowledged.
11. Click Save.

The rule will be activated and added to the Rules dashboard. If you want to Disable the rule or make any other modifications, see Use the Rules Dashboard to learn more. 

Once the rule is saved, every time the event selected in the Condition section occurs, an alert will be generated and the selected channels will receive notifications. You can view the alerts in the Alerts Dashboard. See Use the Alerts Dashboard to learn more about alerts.

Events: Insight Alerts

There are a number of events recorded in Directory Insights related to alerts and webhooks. Reference the table below for the Event Type and Description of the event as captured in Directory Insights. For more information on using Directory Insights, see View the Directory Insights Data Activity Log.

The following is a list of events that you see related to Insight Alerts.

Any modification to the connections (associations) between resources in JumpCloud, such as users to groups, or policies to devices are recorded under the single base event - association_change. While a list of prefiltered events is available for you to select from in the Conditions section of the Insights rule, the JSON data in the Directory Insights displays these changes (listed in the table below) under the single association_change event type.

FAQ: Alert Trigger Conditions