Sazabi
CLI

sazabi signal-definitions

Command reference for sazabi signal-definitions.

sazabi signal-definitions — Manage CEL signal definitions. Subcommands: list, get, create, update, disable.

sazabi signal-definitions

Manage CEL signal definitions

sazabi signal-definitions <subcommand>

sazabi signal-definitions list

List signal definitions

sazabi signal-definitions list [options]
FlagTypeRequiredDescription
--tokenstringNoOverride token
--api-base-urlstringNoOverride API base URL
--jsonbooleanNoOutput as JSON
--project-idstringNoOverride active project ID
sazabi signal-definitions list --json  # List signal definitions

sazabi signal-definitions get

Get one signal definition by ID

sazabi signal-definitions get <signal-definition-id> [options]
FlagTypeRequiredDescription
--tokenstringNoOverride token
--api-base-urlstringNoOverride API base URL
--jsonbooleanNoOutput as JSON
--project-idstringNoOverride active project ID
sazabi signal-definitions get <signal-definition-id> --json  # Get one signal definition

sazabi signal-definitions create

Create a signal definition

sazabi signal-definitions create <name> [options]
FlagTypeRequiredDescription
--tokenstringNoOverride token
--api-base-urlstringNoOverride API base URL
--jsonbooleanNoOutput as JSON
--project-idstringNoOverride active project ID
--expressionstringNoCEL expression evaluated against ingested logs
--enabledbooleanNoCreate the signal definition enabled
--disabledbooleanNoCreate the signal definition disabled
sazabi signal-definitions create plain-tickets --expression 'service == "plain"' --json  # Create a signal definition

sazabi signal-definitions update

Update a signal definition

sazabi signal-definitions update <signal-definition-id> [options]
FlagTypeRequiredDescription
--tokenstringNoOverride token
--api-base-urlstringNoOverride API base URL
--jsonbooleanNoOutput as JSON
--project-idstringNoOverride active project ID
--namestringNoNew signal definition name
--expressionstringNoNew CEL expression body
--enablebooleanNoEnable the signal definition
--disablebooleanNoDisable the signal definition
sazabi signal-definitions update <signal-definition-id> --expression 'severity == "ERROR"' --json  # Update signal definition CEL

sazabi signal-definitions disable

Disable a signal definition

sazabi signal-definitions disable <signal-definition-id> [options]
FlagTypeRequiredDescription
--tokenstringNoOverride token
--api-base-urlstringNoOverride API base URL
--jsonbooleanNoOutput as JSON
--project-idstringNoOverride active project ID
sazabi signal-definitions disable <signal-definition-id> --json  # Disable a signal definition