More Playbook Fixes - Issue #1064

salt/elastalert/files/modules/so/playbook-es.py

@@ -16,7 +16,7 @@ class PlaybookESAlerter(Alerter):
             today = strftime("%Y.%m.%d", gmtime())
             timestamp = strftime("%Y-%m-%d"'T'"%H:%M:%S", gmtime())
             headers = {"Content-Type": "application/json"}
-            payload = {"rule.name": self.rule['play_title'],"event.severity": self.rule['event.severity'],"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"event.module": self.rule['event.module'],"event.dataset": self.rule['event.dataset'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"rule.category": self.rule['rule.category'],"alert_data": match, "@timestamp": timestamp}
+            payload = {"rule.name": self.rule['play_title'],"event.severity": self.rule['event.severity'],"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"event.module": self.rule['event.module'],"event.dataset": self.rule['event.dataset'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"rule.category": self.rule['rule.category'],"event_data": match, "@timestamp": timestamp}
             url = f"http://{self.rule['elasticsearch_host']}/so-playbook-alerts-{today}/_doc/"
             requests.post(url, data=json.dumps(payload), headers=headers, verify=False)
                             

salt/elasticsearch/files/ingest/common

@@ -49,6 +49,7 @@
     { "convert":         { "field": "destination.port", "type": "integer",  "ignore_failure": true,  "ignore_missing": true  } },
     { "convert":         { "field": "source.port", "type": "integer",  "ignore_failure": true,  "ignore_missing": true  } },
     { "convert":         { "field": "log.id.uid", "type": "string",  "ignore_failure": true,  "ignore_missing": true  } },
+    { "convert":         { "field": "agent.id", "type": "string",  "ignore_failure": true,  "ignore_missing": true  } },
     { "convert":         { "field": "event.severity", "type": "integer",  "ignore_failure": true,  "ignore_missing": true  } },
     { 
         "remove": {

salt/soctopus/files/templates/generic.template

@@ -1,7 +1,9 @@
 {% set es = salt['pillar.get']('global:managerip', '') %}
 {% set hivehost = salt['pillar.get']('global:managerip', '') %}
 {% set hivekey = salt['pillar.get']('global:hivekey', '') %}
-alert: hivealerter
+alert:
+- "modules.so.playbook-es.PlaybookESAlerter"
+- "hivealerter"
 
 hive_connection:
   hive_host: http://{{hivehost}}
@@ -24,7 +26,6 @@ hive_alert_config:
   follow: True
   caseTemplate: '5000'
 
-alert: modules.so.playbook-es.PlaybookESAlerter
 elasticsearch_host: "{{ es }}:9200"
 play_title: ""
 event.module: "playbook"

salt/soctopus/files/templates/osquery.template

@@ -1,7 +1,9 @@
 {% set es = salt['pillar.get']('global:managerip', '') %}
 {% set hivehost = salt['pillar.get']('global:managerip', '') %}
 {% set hivekey = salt['pillar.get']('global:hivekey', '') %}
-alert: hivealerter
+alert:
+- "modules.so.playbook-es.PlaybookESAlerter"
+- "hivealerter"
 
 hive_connection:
   hive_host: http://{{hivehost}}
@@ -31,7 +33,6 @@ hive_alert_config:
   caseTemplate: '5000'
   
  
-alert: modules.so.playbook-es.PlaybookESAlerter
 elasticsearch_host: "{{ es }}:9200"
 play_title: ""
 event.module: "playbook"