Specify elastic creds for playbook alert templates

salt/elastalert/files/modules/so/playbook-es.py

@@ -19,9 +19,14 @@ class PlaybookESAlerter(Alerter):
             today = strftime("%Y.%m.%d", gmtime())
             timestamp = strftime("%Y-%m-%d"'T'"%H:%M:%S"'.000Z', gmtime())
             headers = {"Content-Type": "application/json"}
+
+            creds = None
+            if 'elasticsearch_user' in self.rule and 'elasticsearch_pass' in self.rule:
+                creds = (self.rule['elasticsearch_user'], self.rule['elasticsearch_pass'])
+
             payload = {"rule": { "name": self.rule['play_title'],"case_template": self.rule['play_id'],"uuid": self.rule['play_id'],"category": self.rule['rule.category']},"event":{ "severity": self.rule['event.severity'],"module": self.rule['event.module'],"dataset": self.rule['event.dataset'],"severity_label": self.rule['sigma_level']},"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"event_data": match, "@timestamp": timestamp}
             url = f"https://{self.rule['elasticsearch_host']}/so-playbook-alerts-{today}/_doc/"
-            requests.post(url, data=json.dumps(payload), headers=headers, verify=False)
+            requests.post(url, data=json.dumps(payload), headers=headers, verify=False, auth=creds)
                             
     def get_info(self):
         return {'type': 'PlaybookESAlerter'} 

salt/soctopus/files/templates/es-generic.template

@@ -1,7 +1,11 @@
 {% set ES = salt['pillar.get']('global:managerip', '') %}
+{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
+{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
 
 alert: modules.so.playbook-es.PlaybookESAlerter
 elasticsearch_host: "{{ ES }}:9200"
+elasticsearch_user: "{{ ES_USER }}"
+elasticsearch_pass: "{{ ES_PASS }}"
 play_title: ""
 play_url: "https://{{ ES }}/playbook/issues/6000"
 sigma_level: ""

salt/soctopus/files/templates/generic.template

@@ -1,8 +1,13 @@
 {% set es = salt['pillar.get']('global:url_base', '') %}
+{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
+{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
+
 alert:
 - "modules.so.playbook-es.PlaybookESAlerter"
 
 elasticsearch_host: "{{ es }}:9200"
+elasticsearch_user: "{{ ES_USER }}"
+elasticsearch_pass: "{{ ES_PASS }}"
 play_title: ""
 play_id: ""
 event.module: "playbook"

salt/soctopus/files/templates/osquery.template

@@ -1,8 +1,13 @@
 {% set es = salt['pillar.get']('global:url_base', '') %}
+{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
+{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
+
 alert:
 - "modules.so.playbook-es.PlaybookESAlerter"
  
 elasticsearch_host: "{{ es }}:9200"
+elasticsearch_user: "{{ ES_USER }}"
+elasticsearch_pass: "{{ ES_PASS }}"
 play_title: ""
 event.module: "playbook"
 event.dataset: "alert"

salt/soctopus/init.sls

@@ -21,6 +21,7 @@ soctopus-sync:
     - source: salt://soctopus/files/templates
     - user: 939
     - group: 939
+    - mode: 600
     - template: jinja
 
 soctopusconf: