{% set es = salt['pillar.get']('static:masterip', '') %}
{% set hivehost = salt['pillar.get']('static:masterip', '') %}
{% set hivekey = salt['pillar.get']('static:hivekey', '') %}
es_host: {{es}}
es_port: 9200
name: Alert-Name
type: frequency
index: "*:logstash-*"
num_events: 1
timeframe:
    minutes: 10
buffer_time:
    minutes: 10
allow_buffer_time_overlap: true

filter:
- query:
   query_string:
      query: 'select from test'

alert: modules.so.thehive.TheHiveAlerter

hive_connection:
  hive_host: https://{{hivehost}}/thehive/
  hive_apikey: {{hivekey}}

hive_proxies:
  http: ''
  https: ''

hive_alert_config:
  title: '{rule[name]}'
  type: 'external'
  source: 'SecurityOnion'
  description: '`Data:` {match[message]}'
  severity: 2
  tags: ['elastalert', 'SecurityOnion']
  tlp: 3
  status: 'New'
  follow: True
  caseTemplate: '5000'