Hi All
I have enabled elastic defend and enabled rules to detect security events.
Now I want to generate alerts from the Kibana rule and connector to slack.
I have encountered that Elasticsearch mapping of kibana rule fields are not in that form which I can access it in mustache to generate body of alerts.
for example:
here you can see that field name are in this form kibana.alert.rule.name where as it has to be in json object like
kibana :{
alert : {
.............
}
}
now the dot . containing fields name are not able access in mustache due to especial character.
I want to now how can I access those fields?
Thanks
Rule name can be used as {{rule.name}}. You'll see all available variables that can be accessed by selecting the add variable button just above the textarea in the message field
Hi
Rule name are not usable for me because I'm not gonna manage alerts for particular thread level.
I want to create general alert using Elasticsearch query and wants to access like this
{{#context.hits}}
Time: {{_source.@timestamp}}
Rule Name: {{_source.kibana.alert.rule.name}}
Destination IP and Port: {{_source.destination.ip}} : {{_source.destination.port}}
Destination Country: {{_source.destination.geo.country_name}}
Source IP and Port: {{_source.source.ip}} : {{_source.source.port}}
Source Country: {{_source.source.geo.country_name}}
Event Provider: {{_source.event.provider}}
Event Action: {{context.event.action}}
{{/context.hits}}
as I have mentioned before kibana.alert.rule.name is not parse by elasticsearch itself and not able to fetch its information in mustache. So, is there any way to fix it.
I'm gonna forward your question. In the meantime, have you tried with the fields response as mentioned here ?
As the fields response always returns an array of values for each field, the Mustache template array syntax is used to iterate over these values in your actions as the following example shows:
Yeah I did it rule.name will fetch the title name of alert which is hardcoded means I define it when I do create alert well In my case it's generic and I need to access more fields it was just an example.
Thanks
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
just above the textarea in the message field