From 7d29787512c093e57259e5c38901487fad5f4c90 Mon Sep 17 00:00:00 2001
From: Josh Brower <josh@defensivedepth.com>
Date: Thu, 7 Nov 2019 11:44:08 -0500
Subject: [PATCH] Update nids2hive.yaml

---
 salt/elastalert/files/rules/so/nids2hive.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/salt/elastalert/files/rules/so/nids2hive.yaml b/salt/elastalert/files/rules/so/nids2hive.yaml
index 92de99537..019a0844f 100644
--- a/salt/elastalert/files/rules/so/nids2hive.yaml
+++ b/salt/elastalert/files/rules/so/nids2hive.yaml
@@ -15,7 +15,7 @@ timeframe:
 buffer_time:
     minutes: 10
 allow_buffer_time_overlap: true
-query_key: alert
+query_key: ["alert", "ips"]
 realert:
     days: 1
 
@@ -36,11 +36,11 @@ hive_proxies:
 
 hive_alert_config:
   title: '{match[alert]}'
-  type: 'external'
+  type: 'NIDS'
   source: 'SecurityOnion'
   description: "`NIDS Dashboard:` \n\n <https://{{es}}/kibana/app/kibana#/dashboard/ed6f7e20-e060-11e9-8f0c-2ddbf5ed9290?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(columns:!(_source),index:'*:logstash-*',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'sid:{match[sid]}')),sort:!('@timestamp',desc))> \n\n `IPs: `{match[source_ip]}:{match[source_port]} --> {match[destination_ip]}:{match[destination_port]} \n\n `Signature:` {match[rule_signature]}"
   severity: 2
-  tags: ['elastalert', 'SecurityOnion', 'NIDS','{match[sid]}']
+  tags: ['{match[sid]}','{match[source_ip]}','{match[destination_ip]}']
   tlp: 3
   status: 'New'
   follow: True