Hi,
Below is my watcher alert. I have the index section working with it creating multi docs based on the few fields ive fed it in the transform.
The next challenge is to access the relevent data within the teams action. ctx.metadata.title is the only thing that is working at the moment, the ctx.payload.hits.total did work until i added the transforms in, now that shows no value.
I have tried a number of permutations but run out of ideas now. Any suggestions on how to change the format to access the relevent fields?
{
"trigger": {
"schedule": {
"interval": "30m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"winlogbeat-*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"filter": [
{
"query_string": {
"query": "(process.name:cmdkey.exe AND process.args:"/list")"
}
},
{
"range": {
"@timestamp": {
"gte": "now-90m"
}
}
}
]
}
},
"size": 100,
"_source": [
"host.name",
"process.name",
"process.args",
"@timestamp"
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"teams_webhook": {
"webhook": {
"scheme": "https",
"host": "outlook.office.com",
"port": 443,
"method": "post",
"path": "/webhook/",
"params": {},
"headers": {
"Content-Type": "application/json"
},
"body": "{"text": "{{ctx.payload.hits.total}} hits {{ctx.payload.hits.hits.0._source.process.args}} on {{ctx.payload.hits.hits.0._source['host.name']}} {{ctx.metadata.title}} "}"
}
},
"index_payload": {
"transform": {
"script": {
"source": "return ['_doc':ctx.payload._value];",
"lang": "painless"
}
},
"index": {
"index": "alerts",
"doc_type": "watch_alert",
"execution_time_field": "execution_time_timestamp"
}
}
},
"metadata": {
"query": "(process.name:cmdkey.exe AND process.args:/list)",
"description": "Detects usage of cmdkey to look for cached credentials",
"title": "Cmdkey Cached Credentials Recon",
"tags": [
"attack.credential_access",
"attack.t1003"
]
},
"transform": {
"script": {
"source": "return ctx.payload.hits.hits.stream().map(d -> ['@timestamp':d._source['@timestamp'],'process.args':d._source.process.args,'host.name':d._source['host.name']]).collect(Collectors.toList());",
"lang": "painless"
}
}
}