   alarm: 1min_suricata_status_gcap
      on: suricata_local.status 
  lookup: average -1m of status                     
      os: linux                                                  
   every: 1m        
    crit: $this != 1
   units: boolean                                                                       
   delay: down 15m multiplier 1.5 max 1h                                                     
    info: suricata status down
      to: sysadmin

