### Install BGPalerter with Docker

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Run BGPalerter using Docker containers. Examples are provided for interactive setup and a production-ready deployment with health checks and auto-restart.

```bash
# Run with interactive mode for initial setup
docker run -i --name bgpalerter \
  -v $(pwd)/volume:/opt/bgpalerter/volume \
  nttgin/bgpalerter:latest run serve -- --d /opt/bgpalerter/volume/

# Production run with health check and auto-restart
docker run -d --name bgpalerter \
  -v $(pwd)/volume:/opt/bgpalerter/volume \
  --health-cmd='wget --quiet --tries=1 --spider http://127.0.0.1:8011/status || exit 1' \
  --health-timeout=2s \
  --health-retries=15 \
  --health-interval=60s \
  --restart unless-stopped \
  -p 8011:8011 \
  nttgin/bgpalerter:latest run serve -- --d /opt/bgpalerter/volume/
```

--------------------------------

### Install BGPalerter Binary on Linux

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/linux-service.md

Downloads the BGPalerter binary, makes it executable, and places it in the user's home directory. This is the initial setup step for running BGPalerter.

```shell
sudo su bgpalerter

cd /home/bgpalerter

wget https://github.com/nttgin/BGPalerter/releases/latest/download/bgpalerter-linux-x64

chmod +x bgpalerter-linux-x64
```

--------------------------------

### Install BGPalerter Binary

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Download, make executable, auto-configure, and run the BGPalerter binary for Linux. This method includes an interactive setup wizard.

```bash
# Download the binary
wget https://github.com/nttgin/BGPalerter/releases/latest/download/bgpalerter-linux-x64

# Make it executable
chmod +x bgpalerter-linux-x64

# Auto-configure for your AS number
./bgpalerter-linux-x64 generate -a 2914 -o prefixes.yml -i -m

# Run BGPalerter
./bgpalerter-linux-x64
```

--------------------------------

### Install BGPalerter from Source

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Install BGPalerter using Node.js by cloning the repository and installing dependencies. This method is suitable for development and customization.

```bash
# Clone the repository
git clone https://github.com/nttgin/BGPalerter.git
cd BGPalerter

# Install dependencies
npm install

# Run BGPalerter
npm run serve
```

--------------------------------

### monitorNewPrefix Configuration Example (YAML)

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

This snippet demonstrates how to configure the monitorNewPrefix module in BGPalerter's configuration file. It shows an example prefix entry and how to enable the monitor to detect more specific prefixes announced by the same AS.

```yaml
50.82.0.0/20:
   asn: 58302
   description: an example
   ignoreMorespecifics: false

# In config.yml, ensure monitorNewPrefix is enabled:
# monitorNewPrefix:
#   enabled: true
#   thresholdMinPeers: 5
#   notificationIntervalSeconds: 3600
#   maxDataSamples: 1000
```

--------------------------------

### monitorNewPrefix Alert Example

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

This example illustrates the format of an alert generated by the monitorNewPrefix module when a new, more specific prefix is detected. It highlights the detected prefix, the expected prefix, and the associated AS.

```text
A new prefix 165.254.255.0/25 is announced by AS15562. It should be instead 165.254.255.0/24 (description associated with the prefix) announced by AS15562
```

--------------------------------

### Common AS_PATH Regular Expression Examples

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/path-matching.md

Illustrates common regular expression patterns used for matching AS_PATHs in BGPalerter. These examples cover various scenarios like origin matching, traversal at any point, and specific sequence matching.

```regex
(,|^)789$
```

```regex
(,|^)456,
```

```regex
(,|^)456(,|$) 
```

```regex
^123,456,
```

```regex
^123,456,789$
```

```regex
\[789,101112\]
```

--------------------------------

### Configure Global AS Monitoring

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/prefixes.md

Example of setting up monitorASns to track specific Autonomous Systems and assign them to alert groups.

```yaml
monitorASns:
    2914:
      group: ntt
    3333:
      group: ripencc
```

--------------------------------

### Configure BGPalerter Components via YAML

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

Example configuration demonstrating how to define connectors, monitors, and reports in the config.yml file. It shows the structure for linking data sources, analysis logic, and output destinations.

```yaml
connectors:
  - file: connectorRIS
    name: ris

monitors:
  - file: monitorHijack
    channel: hijack
    name: basic-hijack-detection

  - file: monitorPath
    channel: path
    name: path-matching
    params:
      thresholdMinPeers: 10

reports:
  - file: reportFile
    channels:
      - hijack
      - path
    params:
      persistAlertData: false
      alertDataDirectory: alertdata/
```

--------------------------------

### Example External User Group Configuration for reportEmail in YAML

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/usergroups.md

This YAML example shows a specific configuration for the `reportEmail` module within an external user groups file. It defines a user group named 'myGroup' and assigns a contact email address to it.

```yaml
reportEmail:
   myGroup:
      example@example.it
```

--------------------------------

### YAML Configuration for AS_PATH Matching Rules

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/path-matching.md

Example of how to define AS_PATH matching rules within a BGPalerter configuration file using YAML. This demonstrates the structure for 'match', 'notMatch', and 'matchDescription'.

```yaml
165.254.255.0/24:
   asn: 15562
   description: an example on path matching
   ignoreMorespecifics: false
   path:
     - match: ".*2194,1234$"
       notMatch: ".*5054.*"
       matchDescription: detected scrubbing center
     - match: ".*123$"
       notMatch: ".*5056.*"
       matchDescription: other match
```

--------------------------------

### Install Node.js via Package Managers

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/node.md

Provides commands to install Node.js 18 on Debian-based systems, macOS via Homebrew, and CentOS-based systems. These commands require administrative privileges and an active internet connection.

```bash
curl -sL https://deb.nodesource.com/setup_18.x | sudo bash -
sudo apt install nodejs
```

```bash
brew update
brew install node@18
```

```bash
curl -sL https://deb.nodesource.com/setup_18.x | sudo bash -
sudo yum install nodejs
```

--------------------------------

### Fetch Alerts from Pull API

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Example using curl to fetch alerts from the BGPalerter REST API. Shows the command and an example JSON response structure.

```bash
# Fetch alerts from the API
curl http://localhost:8011/alerts/

# Example response
# [
#   {
#     "channel": "hijack",
#     "message": "The prefix 192.0.2.0/24 is announced by AS64512 instead of AS2914",
#     "timestamp": "2024-01-15T10:30:00Z",
#     "data": { ... }
#   }
# ]
```

--------------------------------

### Integrate BGPalerter with Pushover

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/report-http.md

Example configuration for sending BGPalerter alerts to the Pushover notification service via their API.

```yaml
reports:
  - file: reportHTTP
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
    params:
      templates:
        default: '{"message": "${channel}: ${summary}", "title": "BGPalerter", "priority": "1", "token": "_YOUR_API_TOKEN_HERE_", "user": "_YOUR_USER_KEY_HERE_"}'
      headers:
      isTemplateJSON: true
      showPaths: 0
      hooks:
        default: https://api.pushover.net/1/messages.json
```

--------------------------------

### Configure monitorROAS in BGPalerter

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

Example configuration for defining monitored prefixes and ASNs within the BGPalerter YAML configuration file to enable ROA monitoring.

```yaml
1.2.3.4/24:
   asn: 1234
   description: an example
   ignoreMorespecifics: false
   group: noc1

options:
 monitorASns:
   2914:
     group: noc2
```

--------------------------------

### Docker Compose Setup for BGPalerter

Source: https://context7.com/nttgin/bgpalerter/llms.txt

A docker-compose.yml configuration for deploying BGPalerter in a production environment, including health monitoring and automatic restarts.

```yaml
version: "3.8"

services:
  bgpalerter:
    image: nttgin/bgpalerter:latest
    command: run serve -- --d /opt/bgpalerter/volume/
    container_name: bgpalerter
    ports:
      - '8011:8011'
    volumes:
      - "./volume:/opt/bgpalerter/volume"
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://127.0.0.1:8011/status || exit 1"]
      interval: 60s
      timeout: 2s
      retries: 15
```

--------------------------------

### Monitor RPKI Configuration Example (YAML)

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

This YAML snippet demonstrates how to configure the monitorRPKI module within BGPalerter. It shows how to specify monitored prefixes, associated ASNs, and optional settings like ignoring more specifics. When enabled in `config.yml`, this configuration triggers alerts for RPKI-related issues.

```yaml
103.21.244.0/24:
   asn: 13335
   description: an example
   ignoreMorespecifics: false

options:
  monitorASns:
    13335:
      group: default

```

--------------------------------

### BGPalerter Prefixes Configuration (prefixes.yml)

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Example YAML structure for defining monitored prefixes in BGPalerter. Includes options for description, origin AS (single or multiple), ignoring more specific routes, excluding monitors, path matching, and AS monitoring configuration.

```yaml
# Basic prefix monitoring
165.254.255.0/24:
  description: Rome peering
  asn: 2914
  ignoreMorespecifics: false

# Multiple origin ASes allowed
192.0.2.0/24:
  description: Anycast prefix
  asn:
    - 2914
    - 3333
  ignoreMorespecifics: false

# Exclude specific monitors for a prefix
10.0.0.0/8:
  description: Internal prefix
  asn: 64512
  ignoreMorespecifics: true
  excludeMonitors:
    - withdrawal-detection

# Path matching rules
198.51.100.0/24:
  description: Transit prefix
  asn: 2914
  ignoreMorespecifics: false
  group: noc
  path:
    - match: ".*2194,1234$"
      notMatch: ".*5054.*"
      matchDescription: detected scrubbing center

# AS monitoring configuration
options:
  monitorASns:
    2914:
      group: ntt-noc
      upstreams:
        - 174
        - 3356
      downstreams:
        - 12345
    3333:
      group: ripencc-noc
```

--------------------------------

### Prefix Configuration YAML Structure

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/prefixes.md

An example of the YAML configuration block used for monitoring individual BGP prefixes, detailing mandatory and optional fields.

```yaml
165.254.255.0/24:
  description: Rome peering
  asn: 2914
  ignoreMorespecifics: false
  ignore: false
  group: aUserGroup
  excludeMonitors:
    - withdrawal-detection
  path:
    match: ".*2194,1234$"
    notMatch: ".*5054.*"
    matchDescription: detected scrubbing center
    maxLength: 128
    minLength: 2
```

--------------------------------

### Create systemd Service File for BGPalerter

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/linux-service.md

Defines the systemd service unit file for BGPalerter. This configuration ensures BGPalerter runs as a service, restarts on failure, and starts on boot.

```systemd
[Unit]
Description=BGPalerter
After=network.target

[Service]
Type=simple
Restart=on-failure
RestartSec=30s
User=bgpalerter
WorkingDirectory=/home/bgpalerter
ExecStart=/home/bgpalerter/bgpalerter-linux-x64

[Install]
WantedBy=multi-user.target
```

--------------------------------

### Integrate BGPalerter with Mattermost

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/report-http.md

Example configuration for sending BGPalerter alerts to a Mattermost webhook using a formatted JSON attachment.

```yaml
reports:
  - file: reportHTTP
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
    params:
      templates:
        default: '{"attachments": [{"author_name" : "BGPalerter", "fields": [{"title": "Event type:", "value": "${type}", "short": "true"}, {"title": "First event:", "value": "${earliest} UTC", "short": "true"}, {"title": "Last event:", "value": "${latest} UTC", "short": "true"}], "text": "${channel}: ${summary}", "color": "#ffffff"}]}'
      isTemplateJSON: true
      headers:
      showPaths: 0
      hooks:
        default: WEBHOOK_URL
```

--------------------------------

### GET /alerts/

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Retrieves the list of generated BGP alerts from the BGPalerter instance.

```APIDOC
## GET /alerts/

### Description
Fetches the current list of BGP alerts generated by the system.

### Method
GET

### Endpoint
http://localhost:8011/alerts/

### Response
#### Success Response (200)
- **channel** (string) - The alert channel (e.g., hijack, visibility)
- **message** (string) - Human-readable alert description
- **timestamp** (string) - ISO 8601 timestamp of the alert
- **data** (object) - Detailed alert metadata

#### Response Example
[
  {
    "channel": "hijack",
    "message": "The prefix 192.0.2.0/24 is announced by AS64512 instead of AS2914",
    "timestamp": "2024-01-15T10:30:00Z",
    "data": {}
  }
]
```

--------------------------------

### Configure Routinator as VRP Provider

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/rpki.md

Example configuration to integrate Routinator as a local API provider for VRP data.

```yaml
vrpProvider: api
url: http://127.0.0.1:8323/json
```

--------------------------------

### Define Monitored Prefixes in YAML

Source: https://github.com/nttgin/bgpalerter/wiki/Monitored-prefixes-file-(prefixes.yml)

Example configuration for defining IP prefixes to be monitored by BGPalerter. Each entry specifies the ASN, group, and monitoring flags to determine how the system evaluates routing updates for that prefix.

```yaml
165.254.255.0/24:
  description: Amsterdam PoP
  asn: 15562
  group: default
  ignoreMorespecifics: false
  ignore: false
 
192.147.168.0/24:
  description: Job's home
  asn: 15562
  group: default
  ignoreMorespecifics: false
  ignore: false
```

--------------------------------

### Check BGPalerter Status via API

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Demonstrates how to check the BGPalerter status using curl against the uptime API endpoint. Includes example responses for healthy and unhealthy states.

```bash
# Check BGPalerter status
curl http://localhost:8011/status

# Response when healthy
# {
#   "warning": false,
#   "connectors": [
#     {
#       "name": "ConnectorRIS",
#       "connected": true
#     }
#   ]
# }

# Response with issues (HTTP 503 when useStatusCodes: true)
# {
#   "warning": true,
#   "connectors": [
#     {
#       "name": "ConnectorRIS",
#       "connected": false
#     }
#   ]
# }
```

--------------------------------

### Run BGPalerter Docker Container

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/installation.md

This command runs the latest stable version of BGPalerter in a Docker container. It mounts a local 'volume' directory for persistent data and starts the BGPalerter service in interactive mode.

```bash
docker run -i --name bgpalerter \
  -v $(pwd)/volume:/opt/bgpalerter/volume \
  nttgin/bgpalerter:latest run serve -- --d /opt/bgpalerter/volume/
```

--------------------------------

### Configure Prefix Options

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/prefixes.md

Shows how to implement the optional 'options' entry to set specific monitoring groups for individual ASNs.

```yaml
options:
  monitorASns:
    2914:
      group: default
```

--------------------------------

### GET /status

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/process-monitors.md

Retrieves the current operational status of BGPalerter components.

```APIDOC
## GET /status

### Description
Returns a JSON summary of the status of various BGPalerter components. If any component encounters an issue, the 'warning' attribute is set to true.

### Method
GET

### Endpoint
http://localhost:8011/status

### Parameters
#### Query Parameters
- **useStatusCodes** (boolean) - Optional - If set to true in config, enables HTTP status codes in the response.

### Response
#### Success Response (200)
- **warning** (boolean) - Indicates if any component is experiencing issues.
- **connectors** (array) - List of active connectors and their connection status.

#### Response Example
{
    "warning": false,
    "connectors": [
            {
                "name": "ConnectorRIS",
                "connected": true
            }
        ]
}
```

--------------------------------

### Programmatic BGPalerter Integration

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Shows how to initialize and control BGPalerter as an NPM library. It includes setting up custom configurations, starting/stopping the service, and handling alert events for custom incident response logic.

```javascript
const BGPalerter = require('bgpalerter');

// Initialize with custom configuration
const alerter = new BGPalerter({
  configFile: './config.yml',
  volume: './data/'
});

// Start monitoring
alerter.start();

// Listen for alerts programmatically
alerter.on('alert', (alert) => {
  console.log(`[${alert.channel}] ${alert.message}`);

  // Custom processing
  if (alert.channel === 'hijack') {
    // Trigger incident response
    notifySecurityTeam(alert);
  }
});

// Stop monitoring
alerter.stop();
```

--------------------------------

### BGPalerter CLI Execution

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Demonstrates common command-line operations for BGPalerter, including version checking, custom configuration loading, and prefix list generation. These commands are essential for deployment and testing in isolated or containerized environments.

```bash
# Show version
./bgpalerter-linux-x64 -v

# Show help
./bgpalerter-linux-x64 -h

# Use custom config file
./bgpalerter-linux-x64 -c /etc/bgpalerter/config.yml

# Specify volume directory (for Docker/isolated environments)
./bgpalerter-linux-x64 -d /var/lib/bgpalerter/

# Test configuration with fake alerts
./bgpalerter-linux-x64 -t

# Generate prefix list with all options
./bgpalerter-linux-x64 generate \
  -a 2914,3333 \
  -o prefixes.yml \
  -i \
  -m \
  -u \
  -n \
  -g noc \
  -H
```

--------------------------------

### Monitor RPKI Parameters Configuration (YAML)

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

This YAML snippet outlines the configurable parameters for the monitorRPKI module. These parameters allow fine-tuning of the alerting mechanism, including options to check for uncovered prefixes (`checkUncovered`), disappearing ROAs (`checkDisappearing`), minimum peer thresholds (`thresholdMinPeers`), notification intervals, and data sample limits.

```yaml
monitorRPKI:
  checkUncovered: true
  checkDisappearing: false
  thresholdMinPeers: 3
  notificationIntervalSeconds: 3600
  maxDataSamples: 1000
  cacheValidPrefixesSeconds: 604800

```

--------------------------------

### Configure BGPalerter Path Matching Rules

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

This YAML configuration demonstrates how to define AS_PATH matching rules for a specific prefix. It uses regular expressions to match or exclude paths, allowing for granular alert triggers based on path content.

```yaml
165.254.255.0/24:
  asn: 15562
  description: an example on path matching
  ignoreMorespecifics: false
  path:
    - match: ".*2194,1234$"
      notMatch: ".*5054.*"
      matchDescription: detected scrubbing center
    - match: ".*123$"
      notMatch: ".*5056.*"
      matchDescription: other match
```

--------------------------------

### Docker Compose with Health Check for BGPalerter

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/installation.md

A docker-compose configuration for BGPalerter that includes a health check. This setup allows Docker to automatically restart the container if the uptime API indicates a failure.

```yaml
version: "3.8"

services:
  bgpalerter:
    image: nttgin/bgpalerter:latest
    command: run serve -- --d /opt/bgpalerter/volume/
    container_name: bgpalerter
    ports:
      - '8011:8011'
    volumes:
      - "$(pwd)/volume:/opt/bgpalerter/volume"
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "wget --quiet --tries=1 --spider http://127.0.0.1:8011/status || exit 1"]
      interval: 60s
      timeout: 2s
      retries: 15
```

--------------------------------

### Advanced AS_PATH Matching with Positive Lookaheads

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/path-matching.md

Demonstrates how to use positive lookaheads in regular expressions for specifying multiple conditions (AND logic) within a single 'match' parameter for AS_PATHs. This allows for more complex matching criteria.

```regex
(?=.*exp1)(?=.*exp2)
```

```regex
(?!.*exp)
```

--------------------------------

### Define Prefix Monitoring Attributes

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/prefixes.md

Demonstrates how to define an array of ASNs within the BGPalerter configuration file using YAML syntax.

```yaml
asn:
- 2914
- 3333
```

--------------------------------

### Configure Microsoft Teams HTTP Reporting

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/report-http.md

Configures BGPalerter to send alerts to Microsoft Teams using an Adaptive Card template. This setup requires a webhook URL and uses the reportHTTP module with isTemplateJSON enabled.

```yaml
reports:
  - file: reportHTTP
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
    params:
      templates:
        default: '{"type": "message", "attachments": [{"contentType": "application/vnd.microsoft.card.adaptive", "contentUrl": null, "content": {"$schema": "http://adaptivecards.io/schemas/adaptive-card.json", "type": "AdaptiveCard", "version": "1.2", "body": [{"type": "TextBlock", "text": "BGPalerter", "weight": "Bolder", "size": "Medium"}, {"type": "TextBlock", "text": "${channel}", "isSubtle": true, "wrap": true}, {"type": "FactSet", "facts": [{"title": "Summary", "value": "${summary}"}, {"title": "Event type", "value": "${type}"}, {"title": "First event", "value": "${earliest} UTC"}, {"title": "Last event", "value": "${latest} UTC"}]}]}}]}'
      isTemplateJSON: true
      hooks:
        default: https://WEBHOOK_URL
```

--------------------------------

### Configure RPKI Validation Sources

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Set up RPKI validation by specifying different VRP providers, including NTT's service, Cloudflare, rpki-client, a custom API endpoint, or a local VRP file.

```yaml
# Use NTT's public VRP service (default)
rpki:
  vrpProvider: ntt
  refreshVrpListMinutes: 15

# Use Cloudflare's public VRP service
rpki:
  vrpProvider: cloudflare
  refreshVrpListMinutes: 15

# Use rpki-client with expiration data
rpki:
  vrpProvider: rpkiclient
  refreshVrpListMinutes: 15
  markDataAsStaleAfterMinutes: 120

# Use your own Routinator instance
rpki:
  vrpProvider: api
  url: http://routinator.example.org:8323/json
  refreshVrpListMinutes: 15

# Use a local VRP file
rpki:
  vrpProvider: external
  vrpFile: /path/to/vrps.json
  refreshVrpListMinutes: 15
```

--------------------------------

### Define User Groups for Alerts

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Configure user groups in a `groups.yml` file to route alerts to specific teams via email, Slack webhooks, or Telegram chat IDs. Shows examples for NOC, Security, and Management groups.

```yaml
# groups.yml
noc:
  emails:
    - noc@example.org
    - oncall@example.org
  slackWebhook: https://hooks.slack.com/services/T00/B00/NOC
  telegramChatId: -1001234567890

security:
  emails:
    - security@example.org
  slackWebhook: https://hooks.slack.com/services/T00/B00/SECURITY

management:
  emails:
    - cto@example.org
```

```yaml
# Reference in config.yml
groupsFile: groups.yml
```

--------------------------------

### Distribute Notifications Across Different Reporting Mechanisms by User Group in YAML

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/usergroups.md

This YAML configuration demonstrates how to route different types of alerts (e.g., 'newprefix' via email, 'hijack' via Slack) to specific user groups using distinct reporting modules. This enables flexible alert management across various communication channels.

```yaml
reports:
  - file: reportEmail
    channels:
      - newprefix
    params:
      notifiedEmails:
        default:
          - admin@org.com
        group1:
          - joh@example.com
          - max@example.com

  - file: reportSlack
    channels:
      - hijack
    params:
      hooks:
        default: _SLACK_WEBOOK_FOR_ADMIN_
        group2: _SLACK_WEBOOK_FOR_GROUP2_
```

--------------------------------

### Generate BGPalerter Prefix List

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/prefixes.md

Commands to automatically generate a monitored prefixes configuration file based on announced prefixes from specific AS numbers.

```bash
./bgpalerter-linux-x64 generate -a 2914 -o prefixes.yml
```

```bash
npm run generate-prefixes -- --a 2914 --o prefixes.yml
```

--------------------------------

### Generate Prefixes for AS Numbers

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Command-line options for generating prefix lists for BGPalerter. Supports single or multiple AS numbers, AS monitoring, exclusion of delegated prefixes, and user group assignment.

```bash
# Generate prefixes for a single AS
./bgpalerter-linux-x64 generate -a 2914 -o prefixes.yml

# Generate for multiple ASes with AS monitoring enabled
./bgpalerter-linux-x64 generate -a 2914,3333 -o prefixes.yml -m

# Exclude specific monitors for a prefix and enable upstream/downstream detection
./bgpalerter-linux-x64 generate -a 2914 -o prefixes.yml -i -m -u -n

# Generate with specific user group assignment
./bgpalerter-linux-x64 generate -a 2914 -o prefixes.yml -g noc

# Append to existing configuration
./bgpalerter-linux-x64 generate -a 3333 -o prefixes.yml -A
```

--------------------------------

### monitorHijack Configuration

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/configuration.md

Configuration and logic for the hijack detection monitor.

```APIDOC
## monitorHijack

### Description
Detects BGP hijacks by comparing origin ASNs and prefix specificity against configured values.

### Parameters
- **thresholdMinPeers** (integer) - Required - Minimum peers required to trigger alert
- **notificationIntervalSeconds** (integer) - Optional - Override for global notification interval
- **maxDataSamples** (integer) - Optional - Max BGP messages collected before threshold is met (Default: 1000)

### Logic
- Triggers if origin AS differs from configuration.
- Triggers if a more specific prefix is announced by an unauthorized AS.
- Triggers if an AS_SET contains an unauthorized AS.
```

--------------------------------

### Report Configuration

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/reports.md

This section describes the general concept of reports in BGPalerter and how to test their configuration.

```APIDOC
## Reports Overview

Reports are used to send and store alerts, potentially including the data that triggered them. They can be configured for various destinations like email or files.

### Testing Report Configuration

After configuring a report module, you can test it using the BGPalerter binary with the `-t` option. This will generate fake alerts to verify the setup.

Refer to [installation.md#bgpalerter-parameters](installation.md#bgpalerter-parameters) for more details on the `-t` option.

### Default User Group

By default, all communications are sent to the default user group. This means configuring a specific user group is not mandatory for basic operation. However, for filtering administrative or error communications, creating a separate user group is recommended, as described in [usergroups.md](usergroups.md).

### Available Report Modules:

- `reportFile`: Sends alerts as verbose logs.
- `reportEmail`: Sends alerts via email.
- `reportSlack`: Sends alerts to Slack.
- `reportKafka`: Sends alerts to Kafka.
- `reportSyslog`: Sends alerts to a Syslog server.
- `reportAlerta`: Sends alerts to Alerta.
- `reportWebex`: Sends alerts to Webex.
- `reportHTTP`: Sends alerts via HTTP POST requests.
- `reportTelegram`: Sends alerts to Telegram.
- `reportPullAPI`: Sends alerts via a Pull API.
- `reportMatrix`: Sends alerts to Matrix.
```

--------------------------------

### Configure Upstream-Only Monitoring

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/path-neighbors.md

Demonstrates how to monitor only upstream neighbors by omitting the downstreams key. This allows for granular control over which path directions are validated.

```yaml
options:
  monitorASns:
    100:
      group: noc
      upstreams:
        - 99
        - 98
```

--------------------------------

### Configure External VRP File

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/rpki.md

Settings to use a local JSON file as the source for VRP data. BGPalerter monitors this file for changes.

```yaml
rpki:
  vrpProvider: external
  vrpFile: myfile.json
```

--------------------------------

### Run BGPalerter Docker with Port Mapping

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/installation.md

This command runs BGPalerter in Docker, exposing port 8011 to allow external monitoring of the uptime API. It includes volume mounting for persistent data.

```bash
docker run -i --name bgpalerter \
  -v $(pwd)/volume:/opt/bgpalerter/volume \
  -p 8011:8011 \
  nttgin/bgpalerter:latest run serve -- --d /opt/bgpalerter/volume/
```

--------------------------------

### Configure HTTP Webhook Reports

Source: https://context7.com/nttgin/bgpalerter/llms.txt

Set up alerts to be sent to any HTTP endpoint using customizable JSON templates and methods. Supports various alert channels and authentication headers.

```yaml
reports:
  - file: reportHTTP
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
      - roa
    params:
      method: post
      isTemplateJSON: true
      showPaths: 5
      headers:
        Authorization: Bearer your-api-token
        Content-Type: application/json
      templates:
        default: '{"text": "${summary}", "channel": "${channel}", "timestamp": "${earliest}"}'
        hijack: '{"alert": "hijack", "prefix": "${prefix}", "expected_asn": "${asn}", "detected_asn": "${neworigin}"}'
      hooks:
        default: https://api.example.org/bgp-alerts
        noc: https://api.example.org/noc-alerts
```

--------------------------------

### BGPalerter Basic Configuration (config.yml)

Source: https://context7.com/nttgin/bgpalerter/llms.txt

A placeholder for the basic configuration file of BGPalerter, which is used to set up connectors, monitors, and reporting with notification settings.

```yaml
# Basic Configuration
# Configure connectors, monitors, and reports with notification settings.

```

--------------------------------

### Define BGPalerter Alert Templates

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/report-http.md

Sets up JSON templates for different alert channels, allowing for dynamic message content based on alert types.

```yaml
isTemplateJSON: true
templates:
  default: '{"message": "${summary}", "color": "blue"}'
  visibility: '{"message": "${summary}", "color": "orange"}'
```

--------------------------------

### Split Alert Notifications by Channel and User Group in YAML

Source: https://github.com/nttgin/bgpalerter/blob/main/docs/usergroups.md

This YAML configuration illustrates how to split notifications for different alert channels (e.g., 'hijack', 'newprefix') across various user groups using the same reporting mechanism (e.g., reportSlack). This allows for granular control over who receives which type of alert.

```yaml
reports:
  - file: reportSlack
    channels:
      - hijack
    params:
      hooks:
        default: _SLACK_WEBOOK_FOR_ADMIN_
        group1: _SLACK_WEBOOK_FOR_GROUP2_

  - file: reportSlack
    channels:
      - newprefix
    params:
      hooks:
        default: _SLACK_WEBOOK_FOR_ADMIN_
        group2: _SLACK_WEBOOK_FOR_GROUP1_
```