Merge pull request #98 from weslambert/elastalert

update config for Elastalert to use custom modules

salt/elastalert/files/modules/so/thehive.py

@@ -7,7 +7,7 @@ from thehive4py.api import TheHiveApi
 from thehive4py.models import Alert, AlertArtifact, CustomFieldHelper
 
 
-class HiveAlerter(Alerter):
+class TheHiveAlerter(Alerter):
     """
     Use matched data to create alerts containing observables in an instance of TheHive
     """

salt/elastalert/files/rules/so/nids2hive.yaml

@@ -1,9 +1,10 @@
+{% set es = salt['pillar.get']('static:masterip', '') %}
 {% set hivehost = salt['pillar.get']('static:masterip', '') %}
 {% set hivekey = salt['pillar.get']('static:hivekey', '') %}
 # hive.yaml
 # Elastalert rule to forward IDS alerts from Security Onion to a specified TheHive instance.
 #
-es_host: elasticsearch
+es_host: {{es}}
 es_port: 9200
 name: TheHive - New IDS Alert!
 type: frequency
@@ -19,7 +20,7 @@ filter:
 - term:
     event_type: "ids"
 
-alert: elastalert.modules.so.hivealerter
+alert: modules.so.thehive.TheHiveAlerter
 
 hive_connection:
   hive_host: {{hivehost}}

salt/elastalert/init.sls

@@ -111,13 +111,13 @@ elastaconf:
 
 so-elastalertimage:
  cmd.run:
-   - name: docker pull --disable-content-trust=false soshybridhunter/so-elastalert:HH1.1.0
+   - name: docker pull --disable-content-trust=false soshybridhunter/so-elastalert:HH1.1.1
 
 so-elastalert:
   docker_container.running:
     - require:
       - so-elastalertimage
-    - image: soshybridhunter/so-elastalert:HH1.1.0
+    - image: soshybridhunter/so-elastalert:HH1.1.1
     - hostname: elastalert
     - name: so-elastalert
     - user: elastalert
@@ -125,14 +125,14 @@ so-elastalert:
     - binds:
       - /opt/so/rules/elastalert:/etc/elastalert/rules/:ro
       - /opt/so/log/elastalert:/var/log/elastalert:rw
-      - /opt/so/conf/elastalert/modules:/opt/elastalert/elastalert/modules:ro
+      - /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro
       - /opt/so/conf/elastalert/elastalert_config.yaml:/etc/elastalert/conf/elastalert_config.yaml:ro
     - environment:
-      #- ELASTICSEARCH_HOST: {{ esip }}
-      #- ELASTICSEARCH_PORT: {{ esport }}
+      - ELASTICSEARCH_HOST: {{ esip }}
+      - ELASTICSEARCH_PORT: {{ esport }}
       - ELASTALERT_CONFIG: /etc/elastalert/conf/elastalert_config.yaml
       - ELASTALERT_SUPERVISOR_CONF: /etc/elastalert/conf/elastalert_supervisord.conf
-      #- RULES_DIRECTORY: /etc/elastalert/rules/
+      - RULES_DIRECTORY: /etc/elastalert/rules/
       - LOG_DIR: /var/log/elastalert
 
 {% endif %}