Configure Notification Endpoints

About Notification Endpoints

During policy creation, you can configure multiple endpoints to receive alarm notifications when a rule inside a policy is violated.

The following notification endpoint types are available:

  • Email

  • Google Storage

  • Amazon S3

  • SMS

  • Slack

  • WebEx

  • Microsoft Teams

  • PagerDuty

Endpoint Notification Content

Content and delivery of alarm notification information vary depending on the endpoint notification type. The types of information contained in the notification message are categorized as Raw Data or Summarized Data.

Raw Data

For Amazon S3 and Google Storage notification endpoints, the information is delivered in raw form as a series of JSON (JavaScript Object Notation) objects. A JSON object represents an alarm notification event as it appears in the system. These events are written into the configured S3 and Cloud Storage bucket as an object that corresponds to the current window of time (for example, the current minute). If there are no events delivered during a given window, a JSON object is not written. For examples, see Amazon S3 and Google Storage Endpoint Notification Examples by Alarm Type.

Summarized Data

The message contains a summary of events that occurred during a window of time. Typically, the message includes the total number of alarm transition events, specific alarm details from the first few events, and a link to view more events. The exact format and alarm details displayed depends on the endpoint type and corresponding constraints on message size (for example: SMS endpoints do not contain any specific alarm details since there is only enough room to display the total count).

Error Handling

If an endpoint fails to receive a notification, Crosswork Cloud attempts to deliver the notification until it succeeds or the notification no longer exists in the system. The latter case results in the notification endpoint not being delivered.

Configure Notification Endpoints

When a policy rule is violated, an alarm appears in the Alarms page. However, you may want Crosswork Cloud to also notify you or a group of users when an alarm occurs. You can configure an endpoint to receive alarm notifications.

You configure endpoint notifications within a policy or by clicking the Settings icon Settings icon > Global > Notifications. Follow these steps to create an endpoint notification:

Procedure

Step 1

In the main window, click Settings icon > Global > Notifications.

Step 2

Choose the notification type for the endpoint you want to create:

Note

 

See also Notification Message Examples.

Step 3

Click Add type Endpoint.

Step 4

Enter a name for the endpoint.

Step 5

Choose whether the endpoint is Enabled (default) or Disabled.

Step 6

Enter the required information for the endpoint type you chose in Step 2.

Step 7

(Optional) Enter any notes.

Step 8

Click Save.

Step 9

After you receive a confirmation code from Crosswork Cloud, enter the code in the Verification Code field, then click Verify.

If you select Skip for Now, Crosswork Cloud creates the endpoint but will not send any notifications to the endpoint until you verify the endpoint by entering the verification code.

Configure Google Storage Endpoints

You can configure Crosswork Cloud to send notification logs to Google Cloud Storage.

Before you begin

  • You must have a Google Cloud Storage account and have an existing Cloud Storage Bucket where you want all alarm notification information sent to.

  • You must create a service account key file (in JSON format) to allow Crosswork Cloud access to the Google Cloud Storage Bucket. You will need to upload this file as part of the Google Storage notification endpoint configuration.

Procedure

Step 1

In Crosswork Cloud, click Settings icon > Global > Notifications > Google Storage tab and click Add Google Storage Endpoint.

Step 2

Do the following:

  1. Enter a name for the notification.

  2. Toggle the option to ENABLED.

  3. Enter the name of the Google Cloud Storage Bucket.

  4. If there is a particular folder within the bucket you want notification logs to go to, enter the path.

  5. Upload the JSON key file that provides access to the Google Cloud Storage.

Step 3

Click Save.

Example of file location and properties in Google Cloud Storage Bucket:

Google Storage Notification File Example

Note

 

To see an example of the log file contents, see Amazon S3 and Google Storage Endpoint Notification Examples by Alarm Type.

Configure Webex Endpoints

You can configure Crosswork Cloud to send notifications to a Webex space. This procedure describes how to create a webhook and configure the notification endpoint in the UI.

Before you begin

You must have an apphub.webex.com account and be a member of a Webex space (room) you are creating the webhook for.

Procedure

Step 1

Log into https://apphub.webex.com.

Step 2

Search for Incoming Webhooks. The Incoming Webhooks application is listed.

Step 3

Click on the Incoming Webhooks application.

Step 4

On the Incoming Webhooks page, click Connect.

Step 5

If a window appears requesting permission to a number of items and you agree, click Accept.

Step 6

Scroll down the page and in the space provided, enter a new Webhook name and select the Webex space from the drop-down list.

Step 7

Click Add. The Webhook URL field is populated.

Step 8

Copy the newly created Webhook URL to use later.

Step 9

In Crosswork Cloud, click Settings icon > Global > Notifications.

Step 10

Select Webex, then click Create Webex Endpoint.

Step 11

Enter a name for the endpoint.

Step 12

In the Webhook URL field, paste the Webhook URL you copied earlier. 

 https://webexapis.com/v1/webhooks/incoming/<new_webhook_ID>

Step 13

Click Save.

You will receive a notification in the Webex space indicating you have configured a new endpoint.

Step 14

Confirm the endpoint, and then the endpoint changes to active state and processes new notifications.

Configure Microsoft Teams Endpoints

To configure Microsoft Teams endpoints in Crosswork Cloud, Microsoft’s new application, Workflows, replaces the Microsoft Teams incoming webhook connector.

The Workflows application includes connectors for many Microsoft products, such as Outlook, Teams, One Drive, and others, instead of a single webhook connector that was previously used.

Follow these steps to configure Microsoft Teams endpoints in Crosswork Cloud. Steps that require actions in Microsoft Teams include help links to the Microsoft support site. However, it is always best practice to search the Microsoft Teams online documentation for the latest instructions.

Procedure

Step 1

In Microsoft Teams, create a team to receive the Crosswork Cloud alarm notifications.

For example, create a team named WorkFlow-Demo and a channel named WorkFlow-Demo-1.

Step 2

Select Chat > Teams and channels, then right click on either the team or channel to create an endpoint for notification and select Workflows.

Step 3

In Workflows, search for and select the Teams default template: Post to a channel when a webhook request is received.

Step 4

Click Post to a channel when a webhook request is received.

Step 5

Enter a name for the workflow, then select Next.

For example, Workflow-Create-1.

Step 6

Enter the Microsoft Teams Team and Microsoft Teams Channel names created in step 1, then select Add workflow.

Step 7

After the Workflow added successfully! message appears, select Manage your workflow to modify the newly created default workflow template so to integrate with Crosswork Cloud.

Attention

 

Do not copy the URL from this location.

Step 8

In Workflows > Home, select the new Flow name (Workflow-Create-1), then select Edit.

Step 9

Select the three dots icon next to When a Teams webhook request is received to modify the default template.

Details on Who can trigger the flow? and HTTP POST URL appear.

Step 10

Under When a Teams webhook request is received, create the authentication flow and alarm data card flow that will be used to complete the Microsoft Teams endpoints configuration.

What to do next

Follow the steps in Create the authentication flow that defines how details are extracted from the JSON payload.

Create the Authentication Flow

Follow these steps to create the authentication flow that defines how the body, outputs, attachments, and content is extracted from the JSON payload.

Procedure

Step 1

Hover the mouse pointer underneath When a Teams webhook request is received, then click the + symbol to insert a new step.

Step 2

In Choose an operation, search for compose, then select Compose Data Operation under Actions.

Step 3

In the Inputs field, select Body from the Dynamic content list.

Crosswork Cloud sends data using the JSON format. The body represents the dynamic content extracted from the JSON.

Step 4

Hover the mouse pointer underneath Compose, then click the + symbol to insert a new step and select Add action.

Step 5

In Choose an operation, search for post chat or channel, then select Post message in a chat or channel under Actions.

Step 6

In the Team field, select the new team name (WorkFlow-Demo). In the Channel field, select the new channel name (WorkFlow-Demo-1) for the authentication code.

The Post as and Post in fields may remain auto filled.

Step 7

In the Message field, select Outputs from the Dynamic content list to extract the JSON output field from the body.

Step 8

Next, create the alarm data card flow.

What to do next

Follow the steps in the next section to create the alarm data card flow.

Create the Alarm Data Card Flow

Create the alarm data card flow.

Procedure

Step 1

Hover the mouse pointer underneath When a Teams webhook request is received, then click the + symbol and select Add a parallel branch.

This flow is used for retrieving the Crosswork Cloud alarm information.

Step 2

In Choose an operation, search for post card, then select Post card in a chat or channel under Actions.

Step 3

In Select an output from previous steps, select attachments.

Step 4

In Post card in a chat or channel expanded fields, select the new team name (WorkFlow-Demo), and in the Channel field, select the new channel name (WorkFlow-Demo-1).

The Post as and Post in fields may remain auto filled.

Step 5

In the Adaptive Card field, select content.

Step 6

Select Save.

Move to the next section to complete the configuration.

Complete the Microsoft Teams Endpoints Configuration

Complete the integration of the Microsoft Teams endpoints into Crosswork Cloud.

Procedure

Step 1

Hover the mouse pointer underneath When a Teams webhook request is received, then click the three dots icon and copy the URL from the HTTP POST URL field.

Step 2

In Crosswork Cloud, select Settings > Global > Notifications.

Step 3

Select Microsoft Teams, then select Add Microsoft Teams Endpoint and enter a name for the endpoint.

Step 4

In the Webhook URL field, paste the webhook URL you copied earlier.

Step 5

Select Save.

A Verify message appears indicating that a verification code has been sent to the URL provided.

Follow the steps in the next section to verify the integration of the Microsoft Teams endpoints into Crosswork Cloud.

Verify the Microsoft Teams Endpoints Configuration

Verify the integration of the Microsoft Teams endpoints into Crosswork Cloud.

Procedure

Step 1

To verify the workflow is ready to use, select Chat > Teams and channels, then select the newly created channel (WorkFlow-Demo-1).

Step 2

In Posts, locate the Last read message containing the Crosswork Cloud confirmation code (requested in the last step of Configure Microsoft Team endpoints).

Step 3

Copy the confirmation code, then paste it in the Verify message field described in step 12 of the Configure Microsoft Team endpoints procedure.

Step 4

Select Verify.

With the integration of the Microsoft Teams endpoints into Crosswork Cloud, a verification screen will appear and indicate Verified/Enabled after several seconds. The Webhook URL will then be visible.

Resend Confirmation Code for Endpoints

After you configure an endpoint to receive notifications from Crosswork Cloud Network Insights, you must first confirm the endpoint by entering a verification code. You can resend a verification code by following these steps:

Procedure

Step 1

In the main window, click External Routing Analytics > Configure > Notification Endpoints.

Step 2

Click on the name of the endpoint you previously entered.

Step 3

Click Verify.

Crosswork Cloud Network Insights resends the verification code.

Step 4

After you receive the verification code from Crosswork Cloud Network Insights, enter the code in the Verification Code field, then click Verify.

Notification Message Examples

After you configure notification endpoints, Crosswork Cloud Network Insights sends notification messages to the endpoint you specified. The following examples show sample messages for each endpoint type.

Email Endpoint Notification Example

After you configure a notification endpoint and specify the type Email, when the alarm conditions are met, Crosswork Cloud Network Insights sends an email message similar to the following example:

Slack Endpoint Notification Example

After you configure a notification endpoint and specify the type Slack, when the alarm conditions are met, Crosswork Cloud Network Insights sends a Slack message similar to the following example:

Microsoft Teams Endpoint Notification Example

After you configure a notification endpoint and specify the type Microsoft Teams, when the alarm conditions are met, Crosswork Cloud Network Insights sends a message similar to the following example:

Cisco Webex Endpoint Notification Example

After you configure a notification endpoint and specify the type Webex, when the alarm conditions are met, Crosswork Cloud sends a Webex message similar to the following example:

Amazon S3 and Google Storage Endpoint Notification Examples by Alarm Type

The following sections contain log message examples of Amazon S3 and Google Storage notifications for each alarm type.

AS Origin Violation Example

The following is an Amazon S3 and Google Storage notification log message example for an AS Origin Violation alarm. 

{
  "activatedAt": "2023-02-04T03:02:19Z",
  "alarmId": "04aa5831-7e62-45cb-a123-3d5e9c019330",
  "clearedAt": "2023-02-04T03:01:41Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "originAsns": [
      1523
    ]
  },
  "monitoredPrefix": "31.1.1.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 6008,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 21
      },
      {
        "asn": 6009,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 22
      },
      {
        "asn": 6005,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 6007,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 20
      },
      {
        "asn": 6002,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 6004,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 6001,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 6000,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      },
      {
        "asn": 6006,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 19
      },
      {
        "asn": 6003,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "963b86db-329d-4cba-a38a-3fc19ddd330d",
  "policyName": "02 - AS Origin Violation",
  "rule": "ALARM_RULE_AS_ORIGIN_VIOLATION",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "02 - AS Origin Violation"
  ],
  "transitionedAt": "2023-02-04T03:02:19Z"
}
{
  "activatedAt": "2023-02-04T03:02:19Z",
  "alarmId": "9ea271fb-1976-450f-b653-d3d188426b6e",
  "clearedAt": "2023-02-04T03:01:42Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "originAsns": [
      1523
    ]
  },
  "monitoredPrefix": "2002:1f01:100::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 6009,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 30
      },
      {
        "asn": 6004,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 25
      },
      {
        "asn": 6001,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 23
      },
      {
        "asn": 6006,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 27
      },
      {
        "asn": 6000,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      },
      {
        "asn": 6003,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 24
      },
      {
        "asn": 6005,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 26
      },
      {
        "asn": 6008,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 29
      },
      {
        "asn": 6007,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 28
      },
      {
        "asn": 6011,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 32
      },
      {
        "asn": 6002,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 6010,
        "at": "2023-02-04T03:00:58Z",
        "peerId": 31
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "963b86db-329d-4cba-a38a-3fc19ddd330d",
  "policyName": "02 - AS Origin Violation",
  "rule": "ALARM_RULE_AS_ORIGIN_VIOLATION",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "02 - AS Origin Violation"
  ],
  "transitionedAt": "2023-02-04T03:02:19Z"
}

AS Path Length Violation Example

The following is an Amazon S3 and Google Storage notification log message example for an AS Path Length Violation alarm. 

{
  "activatedAt": "2023-02-04T03:09:32Z",
  "alarmId": "38a07db7-776e-4b4a-a186-b7d4bd9b045c",
  "clearedAt": "2023-02-04T03:08:53Z",
  "expected": {
    "maxAsPathLength": 2,
    "minAsPathLength": 1,
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredPrefix": "145.25.0.0/16",
  "observed": {
    "allViolationPeers": [
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 19
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 20
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 21
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 22
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "bc4298d2-1a52-4339-83e8-1d8932e1fe61",
  "policyName": "03 - AS Path Length Violation",
  "rule": "ALARM_RULE_AS_PATH_LENGTH_VIOLATION",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "03 - AS Path Length Violation"
  ],
  "transitionedAt": "2023-02-04T03:09:32Z"
}
{
  "activatedAt": "2023-02-04T03:09:32Z",
  "alarmId": "e44e6834-7877-435c-9068-169e56cae5aa",
  "clearedAt": "2023-02-04T03:08:53Z",
  "expected": {
    "maxAsPathLength": 2,
    "minAsPathLength": 1,
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredPrefix": "2002:9119::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 23
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 24
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 25
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 26
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 27
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 28
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 29
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 30
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 31
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 32
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asPath": [
          902,
          602,
          22
        ],
        "asPathLength": 3,
        "asn": 22,
        "at": "2023-02-04T03:06:32Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "bc4298d2-1a52-4339-83e8-1d8932e1fe61",
  "policyName": "03 - AS Path Length Violation",
  "rule": "ALARM_RULE_AS_PATH_LENGTH_VIOLATION",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "03 - AS Path Length Violation"
  ],
  "transitionedAt": "2023-02-04T03:09:32Z"
}

DNS Root Server Withdrawal Example

The following is an Amazon S3 and Google Storage notification log message example for a DNS Root Server Withdrawal alarm. 

{
  "activatedAt": "2023-02-04T06:16:17Z",
  "alarmId": "5161f679-8e4e-4b95-a979-1788b3444136",
  "monitoredPeer": {
    "peerIp": "2000::30:100:10",
    "peerName": "Root DNS IPv6",
    "sessionId": "9b3f0207-a484-465b-886b-0c8bbcefb8bc"
  },
  "observed": {
    "withdrawnPrefix": "2001:503:ba3e::/48"
  },
  "orgName": "AutomationOnly5",
  "policyId": "3fb1473d-a1cb-43f2-b232-6a3cb470051b",
  "policyName": "20 - DNS Root Server Withdrawal",
  "rule": "ALARM_RULE_DNS_ROOT_SERVER_WITHDRAWAL",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "transitionedAt": "2023-02-04T06:16:17Z"
}
{
  "activatedAt": "2023-02-04T06:16:17Z",
  "alarmId": "b87dc535-7151-4728-90f2-0b24b979d4b8",
  "monitoredPeer": {
    "peerIp": "10.31.32.1",
    "peerName": "Root DNS IPv4",
    "sessionId": "c5dcf2d2-99b7-4565-8b29-9b30f20ed2f7"
  },
  "observed": {
    "withdrawnPrefix": "198.41.0.0/24"
  },
  "orgName": "AutomationOnly5",
  "policyId": "3fb1473d-a1cb-43f2-b232-6a3cb470051b",
  "policyName": "20 - DNS Root Server Withdrawal",
  "rule": "ALARM_RULE_DNS_ROOT_SERVER_WITHDRAWAL",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "transitionedAt": "2023-02-04T06:16:17Z"
}

New AS Path Edge Example

The following is an Amazon S3 notification and Google Storage log message example for a New AS Path Edge alarm. 

{
  "activatedAt": "2023-02-04T03:11:17Z",
  "alarmId": "4b9eb669-774d-4a6d-bed5-d559248953e8",
  "expected": {
    "numPeersToTrigger": 1
  },
  "monitoredPrefix": "88.88.109.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "asPath": [
          916,
          700,
          620,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 1,
        "peerIp": "10.11.12.1",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 620
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          },
          {
            "edgeId": {
              "fromAs": 620,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          621,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 19,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 621
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 621,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          619,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 2,
        "peerIp": "10.11.12.2",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 619
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          },
          {
            "edgeId": {
              "fromAs": 619,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          622,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 20,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 622
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 622,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          623,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 21,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 623
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          },
          {
            "edgeId": {
              "fromAs": 623,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          624,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 22,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 624
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 624,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          618,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 3,
        "peerIp": "10.11.12.3",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 618
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 618,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          617,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 4,
        "peerIp": "10.11.12.4",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 617
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 617,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          616,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 5,
        "peerIp": "10.11.12.5",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 616
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 616,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          615,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 7,
        "peerIp": "10.31.32.1",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 615
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 615,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "3755ed13-6498-4cc6-9798-a1264d03b402",
  "policyName": "04 - New AS Path Edge",
  "rule": "ALARM_RULE_NEW_AS_PATH_EDGE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "04 - New AS Path Edge"
  ],
  "transitionedAt": "2023-02-04T03:11:17Z"
}
{
  "activatedAt": "2023-02-04T03:11:17Z",
  "alarmId": "9a1ab970-144b-4256-a864-4eb26e698844",
  "expected": {
    "numPeersToTrigger": 1
  },
  "monitoredPrefix": "2002:5858:6d00::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asPath": [
          916,
          700,
          616,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 23,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 616
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 616,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          618,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 24,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 618
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 618,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          619,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 25,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 619
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          },
          {
            "edgeId": {
              "fromAs": 619,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          620,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 26,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 620
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          },
          {
            "edgeId": {
              "fromAs": 620,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          621,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 27,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 621
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 621,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          622,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 28,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 622
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 622,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          623,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 29,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 623
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "2002:5858:6d00::/48",
              "88.88.109.0/24"
            ]
          },
          {
            "edgeId": {
              "fromAs": 623,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          624,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 30,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 624
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 624,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          625,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 31,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 625
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 1,
            "prefixCount": 1,
            "prefixList": [
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 625,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 1,
            "prefixCount": 1,
            "prefixList": [
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          626,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 32,
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 626
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 1,
            "prefixCount": 1,
            "prefixList": [
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 626,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 1,
            "prefixCount": 1,
            "prefixList": [
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          617,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 617
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 617,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      },
      {
        "asPath": [
          916,
          700,
          615,
          36
        ],
        "asn": 36,
        "at": "2023-02-04T01:34:59Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10",
        "suspiciousEdges": [
          {
            "edgeId": {
              "fromAs": 36,
              "toAs": 615
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          },
          {
            "edgeId": {
              "fromAs": 615,
              "toAs": 700
            },
            "firstSeen": "2023-02-04T01:34:59Z",
            "lastSeen": "2023-02-04T01:34:59Z",
            "peerCount": 2,
            "prefixCount": 2,
            "prefixList": [
              "88.88.109.0/24",
              "2002:5858:6d00::/48"
            ]
          }
        ]
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "3755ed13-6498-4cc6-9798-a1264d03b402",
  "policyName": "04 - New AS Path Edge",
  "rule": "ALARM_RULE_NEW_AS_PATH_EDGE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "04 - New AS Path Edge"
  ],
  "transitionedAt": "2023-02-04T03:11:17Z"
}

Parent Aggregate Change Example

The following is an Amazon S3 notification and Google Storage notification log message example for a Parent Aggregate Change alarm. 

{
  "activatedAt": "2023-02-04T05:23:55Z",
  "alarmId": "928315c2-c804-47dc-bc52-e2282e605753",
  "expected": {
    "allowedAggregates": [
      "2002::/16",
      "2002::/17",
      "2002:57e8::/36"
    ],
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "originAsns": [
      1000
    ],
    "originAsnsUsage": "ALARM_USAGE_EXCLUDE"
  },
  "monitoredPrefix": "2002:57e8::/48",
  "observed": {
    "allViolationPeers": [
      {
        "peerId": 23
      },
      {
        "peerId": 24
      },
      {
        "peerId": 25
      },
      {
        "peerId": 26
      },
      {
        "peerId": 27
      },
      {
        "peerId": 28
      },
      {
        "peerId": 29
      },
      {
        "peerId": 30
      },
      {
        "peerId": 31
      },
      {
        "peerId": 32
      },
      {
        "peerId": 6
      },
      {
        "peerId": 8
      }
    ],
    "allViolationPeersCount": 12,
    "lastViolationPeers": [
      {
        "asn": 6002,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 6010,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 31
      },
      {
        "asn": 6009,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 30
      },
      {
        "asn": 6003,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 24
      },
      {
        "asn": 6011,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 32
      },
      {
        "asn": 6005,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 26
      },
      {
        "asn": 6007,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 28
      },
      {
        "asn": 6004,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 25
      },
      {
        "asn": 6006,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 27
      },
      {
        "asn": 6000,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      },
      {
        "asn": 6001,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 23
      },
      {
        "asn": 6008,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 29
      }
    ],
    "lastViolationPeersCount": 12,
    "lastViolationPrefix": "2002:57e8::/36",
    "violationPrefixesCount": 3
  },
  "orgName": "AutomationOnly5",
  "policyId": "3dd434f4-92fe-447f-b7e8-129b09cff9da",
  "policyName": "17 - Parent Aggregate Change - Test 3",
  "rule": "ALARM_RULE_PARENT_AGGREGATE_CHANGE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "17 - Parent Aggregate Change"
  ],
  "transitionedAt": "2023-02-04T05:23:55Z"
}
{
  "activatedAt": "2023-02-04T05:23:55Z",
  "alarmId": "c3d24f64-5814-463e-855f-da56545a621f",
  "expected": {
    "allowedAggregates": [
      "87.232.0.0/22"
    ],
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "originAsns": [
      1000
    ],
    "originAsnsUsage": "ALARM_USAGE_EXCLUDE"
  },
  "monitoredPrefix": "87.232.0.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "peerId": 1
      },
      {
        "peerId": 19
      },
      {
        "peerId": 2
      },
      {
        "peerId": 20
      },
      {
        "peerId": 21
      },
      {
        "peerId": 22
      },
      {
        "peerId": 3
      },
      {
        "peerId": 4
      },
      {
        "peerId": 5
      },
      {
        "peerId": 7
      }
    ],
    "allViolationPeersCount": 10,
    "lastViolationPeers": [
      {
        "asn": 6004,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 6008,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 21
      },
      {
        "asn": 6009,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 22
      },
      {
        "asn": 6002,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 6003,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 6005,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 6006,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 19
      },
      {
        "asn": 6001,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 6000,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      },
      {
        "asn": 6007,
        "at": "2023-02-04T05:03:37Z",
        "peerId": 20
      }
    ],
    "lastViolationPeersCount": 10,
    "lastViolationPrefix": "87.232.0.0/22",
    "violationPrefixesCount": 1
  },
  "orgName": "AutomationOnly5",
  "policyId": "3dd434f4-92fe-447f-b7e8-129b09cff9da",
  "policyName": "17 - Parent Aggregate Change - Test 3",
  "rule": "ALARM_RULE_PARENT_AGGREGATE_CHANGE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "17 - Parent Aggregate Change"
  ],
  "transitionedAt": "2023-02-04T05:23:55Z"
}

Peer Advertised Prefix Count Example

The following is an Amazon S3 notification and Google Storage notification log message example for a Peer Advertised Prefix Count alarm. 

{
  "activatedAt": "2023-02-04T06:18:37Z",
  "alarmId": "139a7983-36ba-4d17-8371-2480290f3799",
  "expected": {
    "prefixCounts": [
      {
        "addressFamily": "ALARM_BGP_AF_IPV4",
        "maxPrefixes": 100,
        "minPrefixes": 10
      }
    ]
  },
  "monitoredPeer": {
    "ciscoPeerIp": "104.236.154.30",
    "ciscoPeerName": "RS06",
    "peerIp": "10.11.12.1",
    "peerName": "BGP-1",
    "sessionId": "de26c09c-15f6-435f-9044-c9a89fdc7bed"
  },
  "observed": {
    "prefixCounts": [
      {
        "addressFamily": "ALARM_BGP_AF_IPV4",
        "prefixCount": 2000
      }
    ]
  },
  "orgName": "AutomationOnly5",
  "policyId": "482de3d2-8550-4b84-a0ab-3b3e36f5869a",
  "policyName": "22 - Peer Advertised Prefix Count",
  "rule": "ALARM_RULE_ADVERTISED_PREFIX_COUNT",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "transitionedAt": "2023-02-04T06:18:37Z"
}

Peer Down Example

The following is an Amazon S3 notification and Google Storage notification log message example for a Peer Down alarm. 

{
  "activatedAt": "2023-02-04T06:17:05Z",
  "alarmId": "b654ced0-5357-4eb7-b3c9-27cbd24a8f65",
  "monitoredPeer": {
    "ciscoPeerIp": "3.21.42.66",
    "ciscoPeerName": "RS95",
    "peerIp": "10.11.12.2",
    "peerName": "BGP-2",
    "sessionId": "29651423-e603-4a11-89b7-37500e40e562"
  },
  "observed": {
    "lastUpdatedAt": "2019-10-03T22:30:00Z"
  },
  "orgName": "AutomationOnly5",
  "policyId": "ff3b620d-33a9-49c0-9e33-b99b53c55b1d",
  "policyName": "21 - Peer Down",
  "rule": "ALARM_RULE_PEER_DOWN",
  "severity": "ALARM_SEVERITY_YELLOW",
  "state": "ALARM_STATE_ACTIVE",
  "transitionedAt": "2023-02-04T06:17:05Z"
}

Prefix Advertisement Example

The following is an Amazon S3 notification and Google Storage notification log message example for a Prefix Advertisement alarm. 

{
  "activatedAt": "2023-02-04T03:16:25Z",
  "alarmId": "79222047-4954-4b6e-a339-9d01bfb06434",
  "clearedAt": "2023-02-04T03:15:47Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredPrefix": "218.56.100.0/28",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 19
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 20
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 21
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 22
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "4d4816b9-e579-4209-a907-8d909aafa1f0",
  "policyName": "05 - Prefix Advertisement",
  "rule": "ALARM_RULE_PREFIX_ADVERTISEMENT",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "05 - Prefix Advertisement"
  ],
  "transitionedAt": "2023-02-04T03:16:25Z"
}
{
  "activatedAt": "2023-02-04T03:16:25Z",
  "alarmId": "ba974865-7e94-4623-ad8f-d660acf7d69f",
  "clearedAt": "2023-02-04T03:15:47Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredPrefix": "2002:da38:6400::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 23
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 24
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 25
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 26
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 27
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 28
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 29
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 30
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 31
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 32
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 20,
        "at": "2023-02-04T03:15:04Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "4d4816b9-e579-4209-a907-8d909aafa1f0",
  "policyName": "05 - Prefix Advertisement",
  "rule": "ALARM_RULE_PREFIX_ADVERTISEMENT",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "05 - Prefix Advertisement"
  ],
  "transitionedAt": "2023-02-04T03:16:25Z"
}

Prefix Withdrawal Example

The following is an Amazon S3 notification and Google Storage notification log message example for a Prefix Withdrawal alarm. 

{
  "activatedAt": "2023-02-04T03:20:36Z",
  "alarmId": "2e12713b-4ecf-4d59-868a-00f07aba47ae",
  "clearedAt": "2023-02-04T03:19:55Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredPrefix": "100.200.1.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 19
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 20
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 21
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 22
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 9
  },
  "orgName": "AutomationOnly5",
  "policyId": "16105783-75c8-4c98-be71-b0a758645f41",
  "policyName": "06 - Prefix Withdrawal",
  "rule": "ALARM_RULE_PREFIX_WITHDRAWAL",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "06 - Prefix Withdrawal"
  ],
  "transitionedAt": "2023-02-04T03:20:36Z"
}
{
  "activatedAt": "2023-02-04T03:20:36Z",
  "alarmId": "3c4cf6e0-e6f2-475d-9030-4bc51a7e0550",
  "clearedAt": "2023-02-04T03:19:55Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredPrefix": "2002:64c8:100::/48",
  "observed": {
    "allViolationPeers": [
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 23
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 24
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 25
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 26
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 27
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 28
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 29
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 30
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 31
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 32
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "at": "2023-02-04T03:19:13Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "16105783-75c8-4c98-be71-b0a758645f41",
  "policyName": "06 - Prefix Withdrawal",
  "rule": "ALARM_RULE_PREFIX_WITHDRAWAL",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "06 - Prefix Withdrawal"
  ],
  "transitionedAt": "2023-02-04T03:20:36Z"
}

Prohibited IP Prefix Example

The following is an S3 and Google Storage notification log message example for a Prohibited IP Prefix (Full Bogon) alarm. 

{
  "activatedAt": "2023-02-04T06:11:31Z",
  "alarmId": "a077c6cd-5a74-4378-8d60-e8acb39ae2c7",
  "clearedAt": "2023-02-04T06:09:26Z",
  "monitoredPeer": {
    "ciscoPeerIp": "104.236.154.30",
    "ciscoPeerName": "RS06",
    "peerIp": "10.11.12.5",
    "peerName": "FullBogon-1",
    "sessionId": "f5327ffb-221f-49d6-b8a2-2b812d02d35e"
  },
  "observed": {
    "lastViolationPeerPrefix": {
      "at": "2023-02-04T06:07:33Z",
      "bogonDetails": {
        "bogonType": "ALARM_BOGON_TYPE_FULL_BOGON",
        "prohibitedPrefixBlock": "5.44.248.0/21"
      },
      "prefix": "5.44.248.0/21"
    },
    "violationPrefixesCount": 1
  },
  "orgName": "AutomationOnly5",
  "policyId": "d011c5e4-54a1-41bb-8c7f-963d9caab208",
  "policyName": "19 - Prohibited IP Prefix - FullBogon",
  "rule": "ALARM_RULE_PROHIBITED_IP_PREFIX",
  "severity": "ALARM_SEVERITY_YELLOW",
  "state": "ALARM_STATE_ACTIVE",
  "transitionedAt": "2023-02-04T06:11:31Z"
}
{
  "activatedAt": "2023-02-04T06:11:31Z",
  "alarmId": "142659ed-15f1-4d60-b2d6-3d0da5c75b17",
  "clearedAt": "2023-02-04T06:09:26Z",
  "monitoredPeer": {
    "ciscoPeerIp": "2604:a880:1:20::2de:1001",
    "ciscoPeerName": "RS06",
    "peerIp": "2000::20:100:10",
    "peerName": "FullBogon-2",
    "sessionId": "639f069d-9ccd-46d0-b8b2-77054a199ce8"
  },
  "observed": {
    "lastViolationPeerPrefix": {
      "at": "2023-02-04T06:07:33Z",
      "bogonDetails": {
        "bogonType": "ALARM_BOGON_TYPE_FULL_BOGON",
        "prohibitedPrefixBlock": "2001:506:101::/48"
      },
      "prefix": "2001:506:101::/48"
    },
    "violationPrefixesCount": 1
  },
  "orgName": "AutomationOnly5",
  "policyId": "d011c5e4-54a1-41bb-8c7f-963d9caab208",
  "policyName": "19 - Prohibited IP Prefix - FullBogon",
  "rule": "ALARM_RULE_PROHIBITED_IP_PREFIX",
  "severity": "ALARM_SEVERITY_YELLOW",
  "state": "ALARM_STATE_ACTIVE",
  "transitionedAt": "2023-02-04T06:11:31Z"
}

ROA Expiry Example

The following is an Amazon S3 notification and Google Storage notification log message example for a ROA Expiry alarm. 

{
  "activatedAt": "2023-02-04T03:27:02Z",
  "alarmId": "9f8eb76a-3eff-4e8b-809e-53bf0fd56ebe",
  "clearedAt": "2023-02-04T03:26:20Z",
  "expected": {
    "numPeersToTrigger": 1
  },
  "monitoredPrefix": "2002:101:7700::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 23
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 24
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 25
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 26
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 27
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 28
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 29
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 30
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 31
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 32
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12,
    "roas": [
      {
        "asn": 33,
        "maxLength": 48,
        "notAfter": "2023-02-17T03:49:38Z",
        "notBefore": "2022-02-03T03:49:38Z",
        "prefix": "2002:101:7700::/48",
        "rpkiStatus": "ALARM_ROA_VALID",
        "trustAnchor": "ALARM_AFRINIC"
      },
      {
        "asn": 33,
        "maxLength": 48,
        "notAfter": "2023-02-17T19:24:49Z",
        "notBefore": "2022-02-03T19:24:49Z",
        "prefix": "2002:101:7700::/48",
        "rpkiStatus": "ALARM_ROA_VALID",
        "trustAnchor": "ALARM_AFRINIC"
      },
      {
        "asn": 33,
        "maxLength": 48,
        "notAfter": "2023-02-18T01:34:59Z",
        "notBefore": "2022-02-04T01:34:58Z",
        "prefix": "2002:101:7700::/48",
        "rpkiStatus": "ALARM_ROA_VALID",
        "trustAnchor": "ALARM_AFRINIC"
      }
    ]
  },
  "orgName": "AutomationOnly5",
  "policyId": "d3d47d8c-fee7-45ab-baee-3a860128aa65",
  "policyName": "08 - ROA Expiry",
  "rule": "ALARM_RULE_ROA_EXPIRY",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "08 - ROA Expiry"
  ],
  "transitionedAt": "2023-02-04T03:27:02Z"
}
{
  "activatedAt": "2023-02-04T03:27:02Z",
  "alarmId": "e85e68ad-e16d-4892-9fb9-c71bd92f9caf",
  "clearedAt": "2023-02-04T03:26:20Z",
  "expected": {
    "numPeersToTrigger": 1
  },
  "monitoredPrefix": "210.176.151.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 19
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 20
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 21
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 22
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 33,
        "at": "2023-02-04T03:25:38Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 10,
    "roas": [
      {
        "asn": 33,
        "maxLength": 24,
        "notAfter": "2023-02-17T03:49:38Z",
        "notBefore": "2022-02-03T03:49:38Z",
        "prefix": "210.176.151.0/24",
        "rpkiStatus": "ALARM_ROA_VALID",
        "trustAnchor": "ALARM_AFRINIC"
      },
      {
        "asn": 33,
        "maxLength": 24,
        "notAfter": "2023-02-17T19:24:49Z",
        "notBefore": "2022-02-03T19:24:49Z",
        "prefix": "210.176.151.0/24",
        "rpkiStatus": "ALARM_ROA_VALID",
        "trustAnchor": "ALARM_AFRINIC"
      },
      {
        "asn": 33,
        "maxLength": 24,
        "notAfter": "2023-02-18T01:34:58Z",
        "notBefore": "2022-02-04T01:34:58Z",
        "prefix": "210.176.151.0/24",
        "rpkiStatus": "ALARM_ROA_VALID",
        "trustAnchor": "ALARM_AFRINIC"
      }
    ]
  },
  "orgName": "AutomationOnly5",
  "policyId": "d3d47d8c-fee7-45ab-baee-3a860128aa65",
  "policyName": "08 - ROA Expiry",
  "rule": "ALARM_RULE_ROA_EXPIRY",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "08 - ROA Expiry"
  ],
  "transitionedAt": "2023-02-04T03:27:02Z"
}

ROA Not Found Example

The following is an Amazon S3 notification and Google Storage notification log message example for a ROA Not Found alarm. 

{
  "activatedAt": "2023-02-04T03:22:07Z",
  "alarmId": "992266a8-bc34-4e6f-b396-6f0c956886ae",
  "monitoredPrefix": "2.2.2.2/32",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 19
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 20
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 21
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 22
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "588687b4-4e2c-44d6-8f93-56957139b4f4",
  "policyName": "07 - ROA Not Found",
  "rule": "ALARM_RULE_ROA_NOT_FOUND",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "07 - ROA Not Found"
  ],
  "transitionedAt": "2023-02-04T03:22:07Z"
}
{
  "activatedAt": "2023-02-04T03:22:07Z",
  "alarmId": "c7ff225d-f4e0-49d7-b607-f9d4f98b346f",
  "monitoredPrefix": "2002:202:202::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 23
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 24
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 25
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 26
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 27
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 28
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 29
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 30
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 31
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 32
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 31,
        "at": "2023-02-04T01:34:58Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "588687b4-4e2c-44d6-8f93-56957139b4f4",
  "policyName": "07 - ROA Not Found",
  "rule": "ALARM_RULE_ROA_NOT_FOUND",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "07 - ROA Not Found"
  ],
  "transitionedAt": "2023-02-04T03:22:07Z"
}

ROA Failure Example

The following is an Amazon S3 notification and Google Storage notification log message example for an ROA Failure alarm. 

{
  "activatedAt": "2023-02-04T03:31:32Z",
  "alarmId": "358c3f57-80b8-4685-baec-7d913f39988e",
  "clearedAt": "2023-02-04T03:30:51Z",
  "expected": {
    "numPeersToTrigger": 1,
    "originAsns": [
      24,
      1136
    ]
  },
  "monitoredPrefix": "194.45.8.0/22",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 19
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 20
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 21
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 22
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "0510e174-1553-4c12-ac9e-be68118c8bd2",
  "policyName": "09 - ROA Failure",
  "rule": "ALARM_RULE_ROA_FAILURE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "09 - ROA Failure"
  ],
  "transitionedAt": "2023-02-04T03:31:32Z"
}
{
  "activatedAt": "2023-02-04T03:31:32Z",
  "alarmId": "4e0b7398-ae54-408e-95fc-e7bb17a7d952",
  "clearedAt": "2023-02-04T03:30:51Z",
  "expected": {
    "numPeersToTrigger": 1,
    "originAsns": [
      24
    ]
  },
  "monitoredPrefix": "2002:c22d:800::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 23
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 24
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 25
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 26
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 27
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 28
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 29
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 30
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 31
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 32
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 23,
        "at": "2023-02-04T03:30:09Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "0510e174-1553-4c12-ac9e-be68118c8bd2",
  "policyName": "09 - ROA Failure",
  "rule": "ALARM_RULE_ROA_FAILURE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "09 - ROA Failure"
  ],
  "transitionedAt": "2023-02-04T03:31:32Z"
}

SubPrefix Advertisement Example

The following is an Amazon S3 notification and Google Storage log message example for a SubPrefix Advertisement alarm. 

{
  "activatedAt": "2023-02-04T03:48:07Z",
  "alarmId": "4f90ba05-d16e-4cb1-8bfe-f9bb54fc96dd",
  "clearedAt": "2023-02-04T03:47:26Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "originAsns": [
      754,
      755,
      1000,
      6000,
      6001,
      6002,
      6003,
      6004,
      6005,
      6006,
      6007,
      6008,
      6009,
      6010,
      6011,
      9541,
      9542,
      9543,
      12654,
      12655,
      28642,
      30175,
      45031,
      49622
    ],
    "originAsnsUsage": "ALARM_USAGE_IGNORE"
  },
  "monitoredPrefix": "2002:1764:100::/48",
  "observed": {
    "allViolationPeers": [
      {
        "peerId": 28
      },
      {
        "peerId": 29
      }
    ],
    "allViolationPeersCount": 2,
    "lastViolationPeers": [
      {
        "asn": 6000,
        "at": "2023-02-04T03:45:01Z",
        "peerId": 28
      },
      {
        "asn": 6001,
        "at": "2023-02-04T03:45:02Z",
        "peerId": 29
      }
    ],
    "lastViolationPeersCount": 2,
    "lastViolationPrefix": "2002:1764:100::/49",
    "violationPrefixesCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "634cc992-80f5-488e-bd42-bcb61217be9f",
  "policyName": "12 - Subprefix Advertisement - Default",
  "rule": "ALARM_RULE_SUBPREFIX_ADVERTISEMENT",
  "severity": "ALARM_SEVERITY_GRAY",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "12 - Subprefix Advertisement"
  ],
  "transitionedAt": "2023-02-04T03:48:07Z"
}
{
  "activatedAt": "2023-02-04T03:48:07Z",
  "alarmId": "6e1e50ff-e57f-4a2b-9814-7c5a71b01b1d",
  "clearedAt": "2023-02-04T03:47:26Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "originAsns": [
      754,
      755,
      1000,
      6000,
      6001,
      6002,
      6003,
      6004,
      6005,
      6006,
      6007,
      6008,
      6009,
      6010,
      6011,
      9541,
      9542,
      9543,
      12654,
      12655,
      28642,
      30175,
      45031,
      49622
    ],
    "originAsnsUsage": "ALARM_USAGE_IGNORE"
  },
  "monitoredPrefix": "23.100.1.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "peerId": 1
      },
      {
        "peerId": 19
      }
    ],
    "allViolationPeersCount": 2,
    "lastViolationPeers": [
      {
        "asn": 6000,
        "at": "2023-02-04T03:45:01Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 6001,
        "at": "2023-02-04T03:45:01Z",
        "peerId": 19
      }
    ],
    "lastViolationPeersCount": 2,
    "lastViolationPrefix": "23.100.1.0/25",
    "violationPrefixesCount": 8
  },
  "orgName": "AutomationOnly5",
  "policyId": "634cc992-80f5-488e-bd42-bcb61217be9f",
  "policyName": "12 - Subprefix Advertisement - Default",
  "rule": "ALARM_RULE_SUBPREFIX_ADVERTISEMENT",
  "severity": "ALARM_SEVERITY_GRAY",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "12 - Subprefix Advertisement"
  ],
  "transitionedAt": "2023-02-04T03:48:07Z"
}

Unexpected AS Prefix Example

The following is an Amazon S3 notification and Google Storage notification log message example for an Unexpected AS Prefix alarm. 

{
  "activatedAt": "2023-02-04T02:58:11Z",
  "alarmId": "6a6be977-ecf3-423c-bf4e-fc9118659a69",
  "clearedAt": "2023-02-04T02:57:43Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2
  },
  "monitoredAsn": 601,
  "observed": {
    "allViolationPeers": [
      {
        "peerId": 1
      },
      {
        "peerId": 2
      },
      {
        "peerId": 3
      },
      {
        "peerId": 4
      },
      {
        "peerId": 5
      },
      {
        "peerId": 7
      },
      {
        "peerId": 19
      },
      {
        "peerId": 20
      },
      {
        "peerId": 21
      },
      {
        "peerId": 22
      }
    ],
    "allViolationPeersCount": 10,
    "lastViolationPeers": [
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 19
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 20
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 21
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 22
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 601,
        "at": "2023-02-04T02:55:11Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "lastViolationPeersCount": 10,
    "lastViolationPrefix": "101.1.1.0/24",
    "violationPrefixesCount": 1
  },
  "orgName": "AutomationOnly5",
  "policyId": "5e3288f9-6e6d-4df7-a862-b638e2d17b9f",
  "policyName": "01 - Unexpected AS Prefix",
  "rule": "ALARM_RULE_UNEXPECTED_AS_PREFIX",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "asn policy",
    "01 - Unexpected AS Prefix"
  ],
  "transitionedAt": "2023-02-04T02:58:11Z"
}

Upstream AS Change Example

The following is an Amazon S3 notification and Google Storage notification log message example for an Upstream AS Change alarm. 

{
  "activatedAt": "2023-02-04T03:36:49Z",
  "alarmId": "82f76592-14ca-42ef-b446-149c1d4be731",
  "clearedAt": "2023-02-04T03:36:09Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "upstreamAsns": [
      12345
    ]
  },
  "monitoredPrefix": "2002:ab64:1100::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 6504,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asn": 6503,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 23
      },
      {
        "asn": 6508,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 27
      },
      {
        "asn": 6502,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      },
      {
        "asn": 6509,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 28
      },
      {
        "asn": 6505,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 24
      },
      {
        "asn": 6510,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 29
      },
      {
        "asn": 6507,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 26
      },
      {
        "asn": 6512,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 31
      },
      {
        "asn": 6513,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 32
      },
      {
        "asn": 6506,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 25
      },
      {
        "asn": 6511,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 30
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "c37b83be-0213-4bb2-b391-7f02b3cec061",
  "policyName": "10 - Upstream AS Change",
  "rule": "ALARM_RULE_UPSTREAM_AS_CHANGE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "10 - Upstream AS Change"
  ],
  "transitionedAt": "2023-02-04T03:36:49Z"
}
{
  "activatedAt": "2023-02-04T03:36:49Z",
  "alarmId": "a778b4be-e23f-42d8-8880-5402f59c1495",
  "clearedAt": "2023-02-04T03:36:09Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "upstreamAsns": [
      12345
    ]
  },
  "monitoredPrefix": "171.100.17.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "asn": 6505,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asn": 6503,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asn": 6504,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asn": 6509,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 20
      },
      {
        "asn": 6508,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 19
      },
      {
        "asn": 6507,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asn": 6511,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 22
      },
      {
        "asn": 6502,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      },
      {
        "asn": 6510,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 21
      },
      {
        "asn": 6506,
        "at": "2023-02-04T03:33:54Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "c37b83be-0213-4bb2-b391-7f02b3cec061",
  "policyName": "10 - Upstream AS Change",
  "rule": "ALARM_RULE_UPSTREAM_AS_CHANGE",
  "severity": "ALARM_SEVERITY_RED",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "10 - Upstream AS Change"
  ],
  "transitionedAt": "2023-02-04T03:36:49Z"
}

Valid AS Path Example

The following is an Amazon S3 notification and Google Storage notification log message example for a Valid AS Path alarm. 

{
  "activatedAt": "2023-02-04T03:42:08Z",
  "alarmId": "7cc0e8d0-cef5-422f-a9b9-e6dd227e2bfc",
  "clearedAt": "2023-02-04T03:41:08Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "validAsPathPattern": "108 (999|400) 705"
  },
  "monitoredPrefix": "2002:dc45:500::/48",
  "observed": {
    "allViolationPeers": [
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 23
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 24
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 25
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 26
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 27
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 28
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 29
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 30
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 31
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 32
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 6,
        "peerIp": "2000::20:100:10"
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 8,
        "peerIp": "2000::30:100:10"
      }
    ],
    "allViolationPeersCount": 12
  },
  "orgName": "AutomationOnly5",
  "policyId": "1b1d7a95-1104-4434-8f72-33ba216a7e7f",
  "policyName": "11 - Valid AS Path",
  "rule": "ALARM_RULE_VALID_AS_PATH_VIOLATION",
  "severity": "ALARM_SEVERITY_YELLOW",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "11 - Valid AS Path"
  ],
  "transitionedAt": "2023-02-04T03:42:08Z"
}
{
  "activatedAt": "2023-02-04T03:42:08Z",
  "alarmId": "86304e9c-50ce-4ec2-89a2-2c84ab10658b",
  "clearedAt": "2023-02-04T03:41:08Z",
  "expected": {
    "numPeersToClear": 1,
    "numPeersToTrigger": 2,
    "validAsPathPattern": "108 (999|400) 705"
  },
  "monitoredPrefix": "220.69.5.0/24",
  "observed": {
    "allViolationPeers": [
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 1,
        "peerIp": "10.11.12.1"
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 19
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 2,
        "peerIp": "10.11.12.2"
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 20
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 21
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 22
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 3,
        "peerIp": "10.11.12.3"
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 4,
        "peerIp": "10.11.12.4"
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 5,
        "peerIp": "10.11.12.5"
      },
      {
        "asPath": [
          108,
          500,
          755
        ],
        "asn": 755,
        "at": "2023-02-04T03:39:27Z",
        "peerId": 7,
        "peerIp": "10.31.32.1"
      }
    ],
    "allViolationPeersCount": 10
  },
  "orgName": "AutomationOnly5",
  "policyId": "1b1d7a95-1104-4434-8f72-33ba216a7e7f",
  "policyName": "11 - Valid AS Path",
  "rule": "ALARM_RULE_VALID_AS_PATH_VIOLATION",
  "severity": "ALARM_SEVERITY_YELLOW",
  "state": "ALARM_STATE_ACTIVE",
  "tags": [
    "common tag",
    "prefix policy",
    "11 - Valid AS Path"
  ],
  "transitionedAt": "2023-02-04T03:42:08Z"
}