Dashboards and searches are interesting, but you can also use automation in Helix to monitor for specific activities in the incoming IOC Streaming hit data stream. When the condition for this monitor is met, you can configure an activity, such as generating an alert. The basis of the monitor is the query that it will match to. You can arrive at this query by drilling down in the WebUI from an Index Search until you land on the criteria for your monitor. To configure the monitor, do the following:
Assuming that you are in the Index Search and have refined your query to the match terms that you are monitoring, select Save as.
Select Rule.
Provide details on this rule with the Query text pre-populated from the Index Search.
You can enable an alert based on this condition, or with satisfied prior conditions. You can further specify the characteristics of the alert. Refer the Helix documentation for details.