CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #671 from Security-Onion-Solutions/bugfix/elastalert

Browse Source 
Elastalert --> TheHive fixes
This commit is contained in:
Josh Brower
2020-05-13 16:35:22 -04:00
committed by GitHub
parent 92bb1499c4 6e4ee26a58
commit 48ee1fe016
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elastalert/files/elastalert_config.yaml
View File

@@ -2,7 +2,7 @@
{% set esport = salt['pillar.get']('master:es_port', '') %} {% set esport = salt['pillar.get']('master:es_port', '') %}
# This is the folder that contains the rule yaml files # This is the folder that contains the rule yaml files
# Any .yaml file will be loaded as a rule # Any .yaml file will be loaded as a rule
rules_folder: /etc/elastalert/rules/ rules_folder: /opt/elastalert/rules/
# Sets whether or not ElastAlert should recursively descend # Sets whether or not ElastAlert should recursively descend
# the rules directory - true or false # the rules directory - true or false

4
salt/elastalert/files/rules/so/nids2hive.yaml
View File

@@ -23,11 +23,11 @@ filter:
query_string: query_string:
query: "event.module: suricata" query: "event.module: suricata"
alert: modules.so.thehive.TheHiveAlerter alert: hivealerter
hive_connection: hive_connection:
hive_host: http://{{hivehost}} hive_host: http://{{hivehost}}
hive_port: 9000 hive_port: 9000/thehive
hive_apikey: {{hivekey}} hive_apikey: {{hivekey}}
hive_proxies: hive_proxies:

2
salt/elastalert/init.sls
View File

@@ -118,7 +118,7 @@ so-elastalert:
- user: elastalert - user: elastalert
- detach: True - detach: True
- binds: - binds:
- /opt/so/rules/elastalert:/opt/rules/:ro - /opt/so/rules/elastalert:/opt/elastalert/rules/:ro
- /opt/so/log/elastalert:/var/log/elastalert:rw - /opt/so/log/elastalert:/var/log/elastalert:rw
- /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro - /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro
- /opt/so/conf/elastalert/elastalert_config.yaml:/opt/config/elastalert_config.yaml:ro - /opt/so/conf/elastalert/elastalert_config.yaml:/opt/config/elastalert_config.yaml:ro