Merge remote-tracking branch 'remotes/origin/dev' into issue/1049

salt/elastalert/files/modules/so/playbook-es.py

@@ -16,7 +16,7 @@ class PlaybookESAlerter(Alerter):
             today = strftime("%Y.%m.%d", gmtime())
             timestamp = strftime("%Y-%m-%d"'T'"%H:%M:%S", gmtime())
             headers = {"Content-Type": "application/json"}
-            payload = {"rule.name": self.rule['play_title'],"event.severity": self.rule['event.severity'],"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"event.module": self.rule['event.module'],"event.dataset": self.rule['event.dataset'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"rule.category": self.rule['rule.category'],"alert_data": match, "@timestamp": timestamp}
+            payload = {"rule.name": self.rule['play_title'],"event.severity": self.rule['event.severity'],"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"event.module": self.rule['event.module'],"event.dataset": self.rule['event.dataset'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"rule.category": self.rule['rule.category'],"event_data": match, "@timestamp": timestamp}
             url = f"http://{self.rule['elasticsearch_host']}/so-playbook-alerts-{today}/_doc/"
             requests.post(url, data=json.dumps(payload), headers=headers, verify=False)
                             

salt/elasticsearch/files/ingest/common

@@ -49,6 +49,7 @@
     { "convert":         { "field": "destination.port", "type": "integer",  "ignore_failure": true,  "ignore_missing": true  } },
     { "convert":         { "field": "source.port", "type": "integer",  "ignore_failure": true,  "ignore_missing": true  } },
     { "convert":         { "field": "log.id.uid", "type": "string",  "ignore_failure": true,  "ignore_missing": true  } },
+    { "convert":         { "field": "agent.id", "type": "string",  "ignore_failure": true,  "ignore_missing": true  } },
     { "convert":         { "field": "event.severity", "type": "integer",  "ignore_failure": true,  "ignore_missing": true  } },
     { 
         "remove": {

salt/elasticsearch/files/ingest/sysmon

@@ -4,6 +4,7 @@
     {"community_id":   {"if": "ctx.winlog.event_data?.Protocol != null", "field":["winlog.event_data.SourceIp","winlog.event_data.SourcePort","winlog.event_data.DestinationIp","winlog.event_data.DestinationPort","winlog.event_data.Protocol"],"target_field":"network.community_id"}},    
     { "set":           { "field": "event.code", "value": "{{winlog.event_id}}", "override": true }  },     
     { "set":           { "field": "event.module", "value": "sysmon", "override": true }  },   
+    { "set":           { "if": "ctx.winlog?.computer_name != null",   "field": "observer.name", "value": "{{winlog.computer_name}}", "override": true }  },
     { "set":           { "if": "ctx.event?.code == '3'",   "field": "event.category", "value": "host,process,network", "override": true }  },
     { "set":           { "if": "ctx.event?.code == '1'",   "field": "event.category", "value": "host,process", "override": true }  },
     { "set":          { "if": "ctx.event?.code == '1'",   "field": "event.dataset", "value": "process_creation", "override": true }  },

salt/elasticsearch/files/ingest/win.eventlogs

@@ -3,6 +3,7 @@
   "processors" : [ 
     { "set":           { "if": "ctx.winlog?.channel != null",   "field": "event.module", "value": "windows_eventlog", "override": false, "ignore_failure": true }  },
     { "set":           { "if": "ctx.winlog?.channel != null",   "field": "event.dataset", "value": "{{winlog.channel}}", "override": true }  },
+    { "set":           { "if": "ctx.winlog?.computer_name != null",   "field": "observer.name", "value": "{{winlog.computer_name}}", "override": true }  },
     { "rename": 	   { "field": "winlog.event_data.SubjectUserName", 			  "target_field": "user.name",		"ignore_missing": true 	} },
     { "rename": 	   { "field": "winlog.event_data.User", 			            "target_field": "user.name",		"ignore_missing": true 	} }
   ]

salt/elasticsearch/templates/so/so-common-template.json

@@ -387,8 +387,16 @@
         },
         "winlog":{
           "type":"object",
-          "dynamic": true
+          "dynamic": true,
-        },
+          "properties":{
+            "event_id":{
+              "type":"long"
+            },
+            "event_data":{
+              "type":"object"
+            }
+        }
+      },
         "x509":{
           "type":"object",
           "dynamic": true

salt/soctopus/files/templates/generic.template

@@ -1,7 +1,9 @@
 {% set es = salt['pillar.get']('global:managerip', '') %}
 {% set hivehost = salt['pillar.get']('global:managerip', '') %}
 {% set hivekey = salt['pillar.get']('global:hivekey', '') %}
-alert: hivealerter
+alert:
+- "modules.so.playbook-es.PlaybookESAlerter"
+- "hivealerter"
 
 hive_connection:
   hive_host: http://{{hivehost}}
@@ -24,7 +26,6 @@ hive_alert_config:
   follow: True
   caseTemplate: '5000'
 
-alert: modules.so.playbook-es.PlaybookESAlerter
 elasticsearch_host: "{{ es }}:9200"
 play_title: ""
 event.module: "playbook"

salt/soctopus/files/templates/osquery.template

@@ -1,7 +1,9 @@
 {% set es = salt['pillar.get']('global:managerip', '') %}
 {% set hivehost = salt['pillar.get']('global:managerip', '') %}
 {% set hivekey = salt['pillar.get']('global:hivekey', '') %}
-alert: hivealerter
+alert:
+- "modules.so.playbook-es.PlaybookESAlerter"
+- "hivealerter"
 
 hive_connection:
   hive_host: http://{{hivehost}}
@@ -31,7 +33,6 @@ hive_alert_config:
   caseTemplate: '5000'
   
  
-alert: modules.so.playbook-es.PlaybookESAlerter
 elasticsearch_host: "{{ es }}:9200"
 play_title: ""
 event.module: "playbook"