Add custom variable in global config.yml for use in rule configs

[luminous706]

Hello, is it possible to add a custom variable to the config.yml file that can be used in a rule?

Here's what I tried but it doesn't work:

[jertel]

Your command line args can contain references to match fields, as documented. However, I don't believe that will have access to config key/values. However, you have a couple of options:

1. You can write a tiny enhancement to add custom keys/values to the match dict. The enhancement will have access to the rule config, so any key/values in there can also be copied into the match dict.

2. You can use the alert body text and args, which do allow references to config or rule key/values, combined with the pipe_alert_text setting (see documentation referenced earlier) to pipe this in the form of JSON into your command.

[luminous706]

Thanks for the tips! I decided to use the command and do a sed in a script instead, but would be nice if we had something for straightforward to define variables.