Build a trigger

The first step to building a trigger is to provide a trigger name, determine whether debugging is enabled, and most importantly, identify which system events the trigger will run on.

1. Log into the Web UI on the ExtraHop Discover or Command appliance.
2. Click the System Settings icon and then click Triggers.
3. Click New, and then click the Configuration tab.
4. Specify the following trigger configuration settings:

   Name

   A name for the trigger.

   Author

   The name of the user that wrote the trigger. Default triggers display ExtraHop.

   Description

   An optional description of the trigger.

   Status

   A checkbox that enables or disables the trigger.

   Debug

   A checkbox that enables or disables debugging. If you add debug statements to the trigger script, this option enables you to view debug output in the runtime log when the trigger is running.

   Events

   The events on which the trigger runs. The trigger runs whenever one of the specified events occurs on an assigned device; therefore, you must assign at least one event to your trigger. You can click in the field or begin typing an event name to display a filtered list of available events.

   Select advanced options

   Advanced trigger options vary by the selected events. For example, if you select the HTTP_RESPONSE event, you can set the number of payload bytes to buffer on those events.

   The following figure shows a sample configuration for a trigger than runs on HTTP responses:

   

The trigger script specifies the instructions the trigger will carry out when a system event configured for the trigger occurs.

1. Log into the Web UI on the ExtraHop Discover or Command appliance.
2. Click the System Settings icon , and then click Triggers.
3. From the Trigger Configuration window, click the Editor tab.
4. Type the trigger script in JavaScript-like syntax with events, methods, and properties from the ExtraHop Trigger API Reference.

   The following figure shows a sample script entered on the Editor tab:

   

   The editor provides an autocomplete feature that displays a list of properties and methods based on the selected class object. For example, press CTRL+Space in the editor to display a list of class objects, and after you select a class, type a dot (.) to display a list of available properties and methods as shown in the following figure:

   
5. Click Save Changes.

   The editor provides syntax validation of your script. When you save the trigger, the validator calls out any invalid actions, syntax errors, or deprecated elements in the script. If available, the validator displays replacements for deprecated elements. You cannot save the trigger until you fix your code or you disable syntax validation.

   Warning:

   To avoid poor trigger performance, incorrect results, or a trigger that does not function, we strongly recommended that you fix the code or replace the deprecated element rather than disabling validation. Disabling validation applies only to the trigger you are editing; there is no option to disable validation globally.

   The following figure shows a sample error message generated by the syntax validator:

   
   After a new trigger is saved, the Runtime Log and Performance tabs are displayed.

You can assign a trigger to one or more devices or to a device group. A trigger does not run until it is assigned to a device, and the trigger gathers metric data only from the devices to which it is assigned.

1. Log into the Web UI on the ExtraHop Discover or Command appliance.
2. Click Metrics from the top menu.
3. Click Devices or Device Groups in the left pane.
4. Select the checkbox for each device or device group you want to assign the trigger to.
5. Click the Assign Trigger icon from the top of the page.
6. Select the checkbox for each trigger you want to assign to the selected devices or device groups.
7. Click Assign Triggers.