Downtime Alerting via Email

A few users has asked about using MHN to perform email alerting. While this is not a built in capability of MHN today here are ways users have done this.

• Setup a cron task to run every hour polling the REST APIs.
  • /api/top_attackers/?api_key=XXXXXXXXXX&hours_ago=1 endpoint (see, https://github.com/threatstream/mhn/wiki/MHN-REST-APIs).
  • This could be done at the event level by querying the /api/session/?api_key=XXXXXXXXXX&hours_ago=1 endpoint.
• Setup Splunk alert emails if you did our Splunk integration (and you could install the MHN splunk app to get even more value). All this is free and open source (code: https://github.com/threatstream/mhn-splunk, package: https://splunkbase.splunk.com/app/2707/).