mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
42 lines
851 B
Plaintext
42 lines
851 B
Plaintext
{% set es = salt['pillar.get']('static:masterip', '') %}
|
|
{% set hivehost = salt['pillar.get']('static:masterip', '') %}
|
|
{% set hivekey = salt['pillar.get']('static:hivekey', '') %}
|
|
es_host: {{es}}
|
|
es_port: 9200
|
|
name: Alert-Name
|
|
type: frequency
|
|
index: "*:logstash-*"
|
|
num_events: 1
|
|
timeframe:
|
|
minutes: 10
|
|
buffer_time:
|
|
minutes: 10
|
|
allow_buffer_time_overlap: true
|
|
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: 'select from test'
|
|
|
|
alert: modules.so.thehive.TheHiveAlerter
|
|
|
|
hive_connection:
|
|
hive_host: https://{{hivehost}}/thehive/
|
|
hive_apikey: {{hivekey}}
|
|
|
|
hive_proxies:
|
|
http: ''
|
|
https: ''
|
|
|
|
hive_alert_config:
|
|
title: '{rule[name]}'
|
|
type: 'external'
|
|
source: 'SecurityOnion'
|
|
description: '`Data:` {match[message]}'
|
|
severity: 2
|
|
tags: ['elastalert', 'SecurityOnion']
|
|
tlp: 3
|
|
status: 'New'
|
|
follow: True
|
|
caseTemplate: '5000'
|