Hello,
I've got a standalone elastic-agent deployed on localhost where my MISP instance is running.
I'm trying to integrate MISP IOC's to Elastic in order to use the dashboard.
I don't understand why i don't receive any logs in data stream panel of integration while
when i look at the elastic-agent logs everything seems to going alright (small extract):
{
"log.level": "info",
"@timestamp": "2023-03-21T16:50:48.976+0100",
"message": "Process another repeated request.",
"component": {
"binary": "filebeat",
"dataset": "elastic_agent.filebeat",
"id": "httpjson-default",
"type": "httpjson"
},
"log": {
"source": "httpjson-default"
},
"ecs.version": "1.6.0",
"log.logger": "input.httpjson-cursor",
"id": "httpjson-ti_misp.threat-e53c4180-4444-4379-9a7f-8d739dcc0980",
"input_source": "https://localhost/events/restSearch",
"input_url": "https://localhost/events/restSearch",
"log.origin": {
"file.line": 132,
"file.name": "httpjson/input.go"
},
"service.name": "filebeat"
}
{
"log.level": "info",
"@timestamp": "2023-03-21T16:49:49.083+0100",
"message": "request finished: 40 events published",
"component": {
"binary": "filebeat",
"dataset": "elastic_agent.filebeat",
"id": "httpjson-default",
"type": "httpjson"
},
"log": {
"source": "httpjson-default"
},
"log.logger": "input.httpjson-cursor",
"service.name": "filebeat",
"input_source": "https://localhost/events/restSearch",
"input_url": "https://localhost/events/restSearch",
"ecs.version": "1.6.0",
"log.origin": {
"file.line": 445,
"file.name": "httpjson/request.go"
},
"id": "httpjson-ti_misp.threat-e53c4180-4444-4379-9a7f-8d739dcc0980"
}
Here is the configuration of my elastic-agent:
id: 21c71600-c7ef-11ed-8ee2-b3eb91e32567
revision: 2
outputs:
default:
type: elasticsearch
hosts:
- 'http://localhost:9200'
username: 'elastic'
password: 'changeme'
output_permissions:
default:
_elastic_agent_monitoring:
indices: []
_elastic_agent_checks:
cluster:
- monitor
e53c4180-4444-4379-9a7f-8d739dcc0980:
indices:
- names:
- logs-ti_misp.threat-default
privileges:
- auto_configure
- create_doc
agent:
download:
sourceURI: 'https://artifacts.elastic.co/downloads/'
monitoring:
enabled: false
logs: false
metrics: false
inputs:
- id: httpjson-ti_misp-e53c4180-4444-4379-9a7f-8d739dcc0980
name: MISP Integration
revision: 1
type: httpjson
use_output: default
meta:
package:
name: ti_misp
version: 1.10.1
data_stream:
namespace: default
package_policy_id: e53c4180-4444-4379-9a7f-8d739dcc0980
streams:
- id: httpjson-ti_misp.threat-e53c4180-4444-4379-9a7f-8d739dcc0980
data_stream:
dataset: ti_misp.threat
type: logs
config_version: '2'
interval: 2m
request.method: POST
request.url: 'https://localhost/events/restSearch'
request.ssl:
verification_mode: none
request.timeout: 30s
request.body: null
request.transforms:
- set:
target: header.Authorization
value: BEpdSXuPb2lRyhVjNy9nHiA7EApYdD9ajMRafBZQ
- set:
target: body.limit
value: 1
- set:
target: body.returnFormat
value: json
- set:
target: body.timestamp
value: '[[.cursor.timestamp]]'
default: '[[ formatDate (now (parseDuration "-6000h")) "UnixDate" ]]'
response.split:
target: body.response
split:
target: body.Event.Attribute
ignore_empty_value: true
keep_parent: true
split:
target: body.Event.Object
keep_parent: true
split:
target: body.Event.Object.Attribute
keep_parent: true
cursor:
timestamp:
value: '[[.last_event.Event.timestamp]]'
tags:
- preserve_original_event
- forwarded
- misp-threat
publisher_pipeline.disable_host: true
