insights-eda-rulebook-jt.yml

---
- name: Ruleset - Listen for Red Hat Insights events - call jt
  hosts: localhost
  sources:
    - redhatinsights.eda.insights:
        host: 0.0.0.0
        port: 5000
  rules:
    - name: Match Malware detected-malware event
      condition:
        event.payload.application == "malware-detection"
        and event.payload.event_type == "detected-malware"
      action:
        run_job_template:
          name: "EDA - Create Malware Incident"
          organization: Default
          job_args: 
            extra_vars: "{{ event.payload }}"