From 62187807f01ca156d8eab7163623259b1f81a45d Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 14 Jun 2021 14:08:14 -0400
Subject: [PATCH] Specify elastic creds for playbook alert templates

---
 salt/elastalert/files/modules/so/playbook-es.py   | 7 ++++++-
 salt/soctopus/files/templates/es-generic.template | 4 ++++
 salt/soctopus/files/templates/generic.template    | 5 +++++
 salt/soctopus/files/templates/osquery.template    | 5 +++++
 salt/soctopus/init.sls                            | 1 +
 5 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/salt/elastalert/files/modules/so/playbook-es.py b/salt/elastalert/files/modules/so/playbook-es.py
index ab2327ab7..5b1835bac 100644
--- a/salt/elastalert/files/modules/so/playbook-es.py
+++ b/salt/elastalert/files/modules/so/playbook-es.py
@@ -19,9 +19,14 @@ class PlaybookESAlerter(Alerter):
             today = strftime("%Y.%m.%d", gmtime())
             timestamp = strftime("%Y-%m-%d"'T'"%H:%M:%S"'.000Z', gmtime())
             headers = {"Content-Type": "application/json"}
+
+            creds = None
+            if 'elasticsearch_user' in self.rule and 'elasticsearch_pass' in self.rule:
+                creds = (self.rule['elasticsearch_user'], self.rule['elasticsearch_pass'])
+
             payload = {"rule": { "name": self.rule['play_title'],"case_template": self.rule['play_id'],"uuid": self.rule['play_id'],"category": self.rule['rule.category']},"event":{ "severity": self.rule['event.severity'],"module": self.rule['event.module'],"dataset": self.rule['event.dataset'],"severity_label": self.rule['sigma_level']},"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"event_data": match, "@timestamp": timestamp}
             url = f"https://{self.rule['elasticsearch_host']}/so-playbook-alerts-{today}/_doc/"
-            requests.post(url, data=json.dumps(payload), headers=headers, verify=False)
+            requests.post(url, data=json.dumps(payload), headers=headers, verify=False, auth=creds)
                             
     def get_info(self):
         return {'type': 'PlaybookESAlerter'} 
\ No newline at end of file
diff --git a/salt/soctopus/files/templates/es-generic.template b/salt/soctopus/files/templates/es-generic.template
index 8183a5af4..6e50a3f3e 100644
--- a/salt/soctopus/files/templates/es-generic.template
+++ b/salt/soctopus/files/templates/es-generic.template
@@ -1,7 +1,11 @@
 {% set ES = salt['pillar.get']('global:managerip', '') %}
+{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
+{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
 
 alert: modules.so.playbook-es.PlaybookESAlerter
 elasticsearch_host: "{{ ES }}:9200"
+elasticsearch_user: "{{ ES_USER }}"
+elasticsearch_pass: "{{ ES_PASS }}"
 play_title: ""
 play_url: "https://{{ ES }}/playbook/issues/6000"
 sigma_level: ""
diff --git a/salt/soctopus/files/templates/generic.template b/salt/soctopus/files/templates/generic.template
index f956eb8a6..33d8b7ea5 100644
--- a/salt/soctopus/files/templates/generic.template
+++ b/salt/soctopus/files/templates/generic.template
@@ -1,8 +1,13 @@
 {% set es = salt['pillar.get']('global:url_base', '') %}
+{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
+{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
+
 alert:
 - "modules.so.playbook-es.PlaybookESAlerter"
 
 elasticsearch_host: "{{ es }}:9200"
+elasticsearch_user: "{{ ES_USER }}"
+elasticsearch_pass: "{{ ES_PASS }}"
 play_title: ""
 play_id: ""
 event.module: "playbook"
diff --git a/salt/soctopus/files/templates/osquery.template b/salt/soctopus/files/templates/osquery.template
index 0410cb288..22c29193a 100644
--- a/salt/soctopus/files/templates/osquery.template
+++ b/salt/soctopus/files/templates/osquery.template
@@ -1,8 +1,13 @@
 {% set es = salt['pillar.get']('global:url_base', '') %}
+{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
+{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
+
 alert:
 - "modules.so.playbook-es.PlaybookESAlerter"
  
 elasticsearch_host: "{{ es }}:9200"
+elasticsearch_user: "{{ ES_USER }}"
+elasticsearch_pass: "{{ ES_PASS }}"
 play_title: ""
 event.module: "playbook"
 event.dataset: "alert"
diff --git a/salt/soctopus/init.sls b/salt/soctopus/init.sls
index c2c8dc1ac..984ff45a9 100644
--- a/salt/soctopus/init.sls
+++ b/salt/soctopus/init.sls
@@ -21,6 +21,7 @@ soctopus-sync:
     - source: salt://soctopus/files/templates
     - user: 939
     - group: 939
+    - mode: 600
     - template: jinja
 
 soctopusconf: