From 96195806ab1c6b92ed8e62ca87490dfd87ffe545 Mon Sep 17 00:00:00 2001 From: weslambert Date: Tue, 6 Jun 2023 20:50:10 -0400 Subject: [PATCH 1/7] Update version to 2.4.0-kilo --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 35cee72dc..7f2e97617 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4.3 +2.4.0-kilo From c4be56ec7b193cace7056054ac58f04b00cc6352 Mon Sep 17 00:00:00 2001 From: weslambert Date: Tue, 6 Jun 2023 20:51:03 -0400 Subject: [PATCH 2/7] Update host syntax --- salt/elastalert/map.jinja | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elastalert/map.jinja b/salt/elastalert/map.jinja index 7cec262d0..cc395d8ee 100644 --- a/salt/elastalert/map.jinja +++ b/salt/elastalert/map.jinja @@ -8,7 +8,7 @@ {% set elastalert_pillar = salt['pillar.get']('elastalert:config', {}) %} -{% do ELASTALERTDEFAULTS.elastalert.config.update({'es_hosts': 'https://' + GLOBALS.manager + ':' + ELASTALERTDEFAULTS.elastalert.config.es_port|string}) %} +{% do ELASTALERTDEFAULTS.elastalert.config.update({'es_host': GLOBALS.manager}) %} {% do ELASTALERTDEFAULTS.elastalert.config.update({'es_username': pillar.elasticsearch.auth.users.so_elastic_user.user}) %} {% do ELASTALERTDEFAULTS.elastalert.config.update({'es_password': pillar.elasticsearch.auth.users.so_elastic_user.pass}) %} From f172a74fbc5983f00616d5428a5c82e80740f5a6 Mon Sep 17 00:00:00 2001 From: weslambert Date: Tue, 6 Jun 2023 20:51:29 -0400 Subject: [PATCH 3/7] Remove EQL setting --- salt/elastalert/defaults.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/salt/elastalert/defaults.yaml b/salt/elastalert/defaults.yaml index c073e4ee6..a01c80952 100644 --- a/salt/elastalert/defaults.yaml +++ b/salt/elastalert/defaults.yaml @@ -13,7 +13,6 @@ elastalert: es_port: 9200 es_conn_timeout: 55 max_query_size: 5000 - eql: true use_ssl: true verify_certs: false writeback_index: elastalert From 96b60fa39a03b6cb423b29363083bd60828ab2cc Mon Sep 17 00:00:00 2001 From: weslambert Date: Tue, 6 Jun 2023 20:53:05 -0400 Subject: [PATCH 4/7] Restore original URL syntax, but use data stream --- salt/elastalert/files/modules/so/playbook-es.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/elastalert/files/modules/so/playbook-es.py b/salt/elastalert/files/modules/so/playbook-es.py index 373154d73..3b38fcf57 100644 --- a/salt/elastalert/files/modules/so/playbook-es.py +++ b/salt/elastalert/files/modules/so/playbook-es.py @@ -31,7 +31,7 @@ class PlaybookESAlerter(Alerter): creds = (self.rule['es_username'], self.rule['es_password']) payload = {"rule": { "name": self.rule['play_title'],"case_template": self.rule['play_id'],"uuid": self.rule['play_id'],"category": self.rule['rule.category']},"event":{ "severity": self.rule['event.severity'],"module": self.rule['event.module'],"dataset": self.rule['event.dataset'],"severity_label": self.rule['sigma_level']},"kibana_pivot": self.rule['kibana_pivot'],"soc_pivot": self.rule['soc_pivot'],"play_url": self.rule['play_url'],"sigma_level": self.rule['sigma_level'],"event_data": match, "@timestamp": timestamp} - url = f"{self.rule['es_hosts']}/logs-playbook.alerts-so/_doc/" + url = f"https://{self.rule['es_host']}:{self.rule['es_port']}/logs-playbook.alerts-so/_doc/" requests.post(url, data=json.dumps(payload), headers=headers, verify=False, auth=creds) def get_info(self): From 8b350021693a3659a770a3fb590cd7cd47ec6c26 Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Wed, 7 Jun 2023 13:44:37 -0400 Subject: [PATCH 5/7] EQL Refactor --- salt/soctopus/files/templates/generic.template | 2 -- 1 file changed, 2 deletions(-) diff --git a/salt/soctopus/files/templates/generic.template b/salt/soctopus/files/templates/generic.template index 74b40bef9..df120fd81 100644 --- a/salt/soctopus/files/templates/generic.template +++ b/salt/soctopus/files/templates/generic.template @@ -20,5 +20,3 @@ realert: minutes: 0 type: any filter: -- query: - query_string: From 932054e9dacf7cb315ce3ecac31798e209cd5cb8 Mon Sep 17 00:00:00 2001 From: weslambert Date: Thu, 8 Jun 2023 11:04:45 -0400 Subject: [PATCH 6/7] Update version to 2.4.0 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 7f2e97617..197c4d5c2 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4.0-kilo +2.4.0 From 8ccb24dda21532c29cb47e5dacb2ad39305604d1 Mon Sep 17 00:00:00 2001 From: weslambert Date: Thu, 8 Jun 2023 11:05:05 -0400 Subject: [PATCH 7/7] Update version to 2.4.3 --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 197c4d5c2..35cee72dc 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4.0 +2.4.3