elastalert/misp-squid.yaml at master · securitydistractions/elastalert · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56


name: MISP High Alert - Squid Proxy v3
type: any
index: sd-squidproxy*

filter:
 - query:
         query_string:
                   query: "misp.tag: Feed-HighAlert"

realert:
        minutes: 5
alert:  hivealerter

hive_connection:
        hive_host: *
        hive_port: 9000
        hive_apikey: *

hive_alert_config:
        title: 'High Alert Indicator of Compromise Found - "{match[destination][domain]}" - "{match[misp][eventinfo][0]}"'
        type: 'Alert'
        source: '{match[_index]}'
        description: >
                There has been a connection to a high confidence indicator of compromise. "{match[destination][domain]}".'


                You can check your [Kibana dashboard](http://****:5606/app/kibana#/dashboard/2b32fe50-c764-11e9-a23e-9f14426a3b25?_a=%28query:%28language:lucene,query:'_id:"{match[_id]}"'%29%29&_g=%28time:%28from:now-3d,mode:quick,to:now%29%29) for more information.


                **The full details of this alert are as follows:


                * **MISP Tag:** "{match[misp][tag][0]}"


                * **MISP Event:** "{match[misp][eventinfo][0]}"


                * **Hostname:** "{match[source][hostname]}"


                * **Destination Domain:** "{match[destination][domain]}"


                * **Full URL:** "{match[url][full]}"

        severity: 3
        tlp: 3
        status: 'New'
        follow: True

hive_observable_data_mapping:
        - fqdn: "{match[source][hostname]}"
        - domain: "{match[destination][domain]}"