From 26b5a3991252753226e8b64528d9e7ab6fe3354d Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Mon, 13 May 2024 12:59:17 -0400
Subject: [PATCH 1/3] Change index to detections.alerts

---
 salt/elastalert/files/modules/so/securityonion-es.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/salt/elastalert/files/modules/so/securityonion-es.py b/salt/elastalert/files/modules/so/securityonion-es.py
index 0a82bdce6..d9bb8009e 100644
--- a/salt/elastalert/files/modules/so/securityonion-es.py
+++ b/salt/elastalert/files/modules/so/securityonion-es.py
@@ -56,8 +56,8 @@ class SecurityOnionESAlerter(Alerter):
                 "event_data": match,
                 "@timestamp": timestamp
             }
-            url = f"https://{self.rule['es_host']}:{self.rule['es_port']}/logs-playbook.alerts-so/_doc/"
+            url = f"https://{self.rule['es_host']}:{self.rule['es_port']}/logs-detections.alerts-so/_doc/"
             requests.post(url, data=json.dumps(payload), headers=headers, verify=False, auth=creds)
 
     def get_info(self):
-        return {'type': 'SecurityOnionESAlerter'}
\ No newline at end of file
+        return {'type': 'SecurityOnionESAlerter'}

From c8870eae65dc395cf5f2165c4b8772dc41f8cca6 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Mon, 13 May 2024 14:23:47 -0400
Subject: [PATCH 2/3] Add detection alerts template

---
 salt/elasticsearch/defaults.yaml | 62 ++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 156483b03..e54d58c3b 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -3591,6 +3591,68 @@ elasticsearch:
               set_priority:
                 priority: 50
             min_age: 30d
+    so-logs-detections_x_alerts:
+      index_sorting: false
+      index_template:
+        composed_of:
+        - so-data-streams-mappings
+        - so-fleet_globals-1
+        - so-fleet_agent_id_verification-1
+        - so-logs-mappings
+        - so-logs-settings
+        data_stream:
+          allow_custom_routing: false
+          hidden: false
+        index_patterns:
+        - logs-detections.alerts-*
+        priority: 501
+        template:
+          mappings:
+            _meta:
+              managed: true
+              managed_by: security_onion
+              package:
+                name: elastic_agent
+          settings:
+            index:
+              lifecycle:
+                name: so-logs-detections.alerts-so
+              mapping:
+                total_fields:
+                  limit: 5001
+              number_of_replicas: 0
+              sort:
+                field: '@timestamp'
+                order: desc
+      policy:
+        _meta:
+          managed: true
+          managed_by: security_onion
+          package:
+            name: elastic_agent
+        phases:
+          cold:
+            actions:
+              set_priority:
+                priority: 0
+            min_age: 60d
+          delete:
+            actions:
+              delete: {}
+            min_age: 365d
+          hot:
+            actions:
+              rollover:
+                max_age: 1d
+                max_primary_shard_size: 50gb
+              set_priority:
+                priority: 100
+            min_age: 0ms
+          warm:
+            actions:
+              set_priority:
+                priority: 50
+            min_age: 30d
     so-logs-elastic_agent:
       index_sorting: false
       index_template:

From d606f259d12b049d620d3f200085b91821995643 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Mon, 13 May 2024 14:25:11 -0400
Subject: [PATCH 3/3] Add detection alerts

---
 salt/elasticsearch/soc_elasticsearch.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/elasticsearch/soc_elasticsearch.yaml b/salt/elasticsearch/soc_elasticsearch.yaml
index cc92493fb..000fd60b7 100644
--- a/salt/elasticsearch/soc_elasticsearch.yaml
+++ b/salt/elasticsearch/soc_elasticsearch.yaml
@@ -394,6 +394,7 @@ elasticsearch:
     so-logs-darktrace_x_ai_analyst_alert: *indexSettings
     so-logs-darktrace_x_model_breach_alert: *indexSettings
     so-logs-darktrace_x_system_status_alert: *indexSettings
+    so-logs-detections_x_alerts: *indexSettings
     so-logs-f5_bigip_x_log: *indexSettings
     so-logs-fim_x_event: *indexSettings
     so-logs-fortinet_x_clientendpoint: *indexSettings