Thanks to the conditional block, we can create proper alerts. A simple example:

Example1: send a report after comparing values from two websites

1. Capture a string/numeric value from a website

2. Capture numeric/string value from another website

3. Compare the two

4. Skip sending the report if condition is met

Example2: alert if a numeric reading is above/below a threshold

This is useful for brute force attack detection, or any other alerts about high log event count over time.

1. Capture Kibana discovery query results “count” for the last hour

2. Compare if this value is > 1 million

3. Send the report (notify the system admin)