diff --git a/salt/elastalert/files/modules/so/hivealerter.py b/salt/elastalert/files/modules/so/thehive.py similarity index 99% rename from salt/elastalert/files/modules/so/hivealerter.py rename to salt/elastalert/files/modules/so/thehive.py index fbe4d6aac..d78a8d050 100644 --- a/salt/elastalert/files/modules/so/hivealerter.py +++ b/salt/elastalert/files/modules/so/thehive.py @@ -7,7 +7,7 @@ from thehive4py.api import TheHiveApi from thehive4py.models import Alert, AlertArtifact, CustomFieldHelper -class HiveAlerter(Alerter): +class TheHiveAlerter(Alerter): """ Use matched data to create alerts containing observables in an instance of TheHive """ diff --git a/salt/elastalert/files/rules/so/nids2hive.yaml b/salt/elastalert/files/rules/so/nids2hive.yaml index 1d4b4ee39..ab0624e13 100644 --- a/salt/elastalert/files/rules/so/nids2hive.yaml +++ b/salt/elastalert/files/rules/so/nids2hive.yaml @@ -1,9 +1,10 @@ +{% set es = salt['pillar.get']('static:masterip', '') %} {% set hivehost = salt['pillar.get']('static:masterip', '') %} {% set hivekey = salt['pillar.get']('static:hivekey', '') %} # hive.yaml # Elastalert rule to forward IDS alerts from Security Onion to a specified TheHive instance. # -es_host: elasticsearch +es_host: {{es}} es_port: 9200 name: TheHive - New IDS Alert! type: frequency @@ -19,7 +20,7 @@ filter: - term: event_type: "ids" -alert: elastalert.modules.so.hivealerter +alert: modules.so.thehive.TheHiveAlerter hive_connection: hive_host: {{hivehost}} diff --git a/salt/elastalert/init.sls b/salt/elastalert/init.sls index b17e657ca..8e8b32ae6 100644 --- a/salt/elastalert/init.sls +++ b/salt/elastalert/init.sls @@ -111,13 +111,13 @@ elastaconf: so-elastalertimage: cmd.run: - - name: docker pull --disable-content-trust=false soshybridhunter/so-elastalert:HH1.1.0 + - name: docker pull --disable-content-trust=false soshybridhunter/so-elastalert:HH1.1.1 so-elastalert: docker_container.running: - require: - so-elastalertimage - - image: soshybridhunter/so-elastalert:HH1.1.0 + - image: soshybridhunter/so-elastalert:HH1.1.1 - hostname: elastalert - name: so-elastalert - user: elastalert @@ -125,14 +125,14 @@ so-elastalert: - binds: - /opt/so/rules/elastalert:/etc/elastalert/rules/:ro - /opt/so/log/elastalert:/var/log/elastalert:rw - - /opt/so/conf/elastalert/modules:/opt/elastalert/elastalert/modules:ro + - /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro - /opt/so/conf/elastalert/elastalert_config.yaml:/etc/elastalert/conf/elastalert_config.yaml:ro - environment: - #- ELASTICSEARCH_HOST: {{ esip }} - #- ELASTICSEARCH_PORT: {{ esport }} + - ELASTICSEARCH_HOST: {{ esip }} + - ELASTICSEARCH_PORT: {{ esport }} - ELASTALERT_CONFIG: /etc/elastalert/conf/elastalert_config.yaml - ELASTALERT_SUPERVISOR_CONF: /etc/elastalert/conf/elastalert_supervisord.conf - #- RULES_DIRECTORY: /etc/elastalert/rules/ + - RULES_DIRECTORY: /etc/elastalert/rules/ - LOG_DIR: /var/log/elastalert {% endif %}