Watcher alerts not triggered

Elastic Stack Elasticsearch
1

Hi,

I have my basic watch to alert of log on failures. When I stimulated the watch it worked and generated a Slack message but the watch never triggered even though the conditions are met. Please find my alert below.

{
  "trigger": {
    "schedule": {
      "interval": "60m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "auth.log"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": {
                "match": {
                  "message": "failure"
                }
              },
              "filter": {
                "range": {
                  "@timestamp": {
                    "from": "now-5m",
                    "to": "now"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 3
      }
    }
  },
  "actions": {
    "notify-slack": {
      "slack": {
        "message": {
          "to": [
            "#slack-alert-from-siem"
          ],
          "text": "there is multiple logon failures within the last 3 mins"
        }
      }
    }
  }
}
2

Hey,

please format your messages properly using markdown. Just pasting JSON makes it super hard to read.

Can you include the watch history for this watch? The query below allows you to query the last watch exeuctions. Should be sufficient to only the most recent one for now by using "size": 1 in the query as well.

GET .watcher-history-*/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "watch_id": "my_watch"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "trigger_event.triggered_time": {
        "order": "desc"
      }
    }
  ]
}
3

Hi,

My apologies for the messy code. I edited my initial question. Please find the picture below for the watch history. It is the last very bottom watch and hasn't triggered at all.

Screenshot%20from%202018-06-27%2018-48-47
Screenshot from 2018-06-27 18-48-47.png1108×453 38.6 KB

4

Hey,

that screenshot does not really help, please include the output from the query that I asked for. There is one watch marked as disabled - I have n idea however if that is the watch you are talking about. Did you maybe deactivate it? You can either activate it, or just delete it and put it again and see if that makes the watch trigger.

Hope this helps.

--Alex

5

Hi Alex,

The watch I am talking about is the very last one.

6

I found out it is the problem with the logic. I should have had my "Interval" : "1m" instead of "60m" --> interval refers to how often I want my watch to run

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.