forked from Cyb3rWard0g/HELK
-
Notifications
You must be signed in to change notification settings - Fork 0
/
elastalert_any_v2.yml
43 lines (39 loc) · 1.67 KB
/
elastalert_any_v2.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
postprocessing:
- type: template
template: |+
name: {{ rule.id }}
description: {{ rule.title }}
owner: {{ rule.author }}
type: any
priority:{% set priority = ({"critical":4, "high":3, "medium":2, "low":1, "informational":0 })%} {{ priority["%s" % rule.level]}}
alert:
- debug
{% macro index() -%}
{% if rule.logsource.product == 'windows' -%}
{% if rule.logsource.service == 'application' -%}
{% set index = 'logs-endpoint-winevent-application-*' -%}
{% elif rule.logsource.service == 'security' -%}
{% set index = 'logs-endpoint-winevent-security-*' -%}
{% elif rule.logsource.category == 'sysmon' or rule.logsource.service == 'sysmon' -%}
{% set index = 'logs-endpoint-winevent-sysmon-*' -%}
{% elif rule.logsource.service == 'system' -%}
{% set index = 'logs-endpoint-winevent-system-*' -%}
{% elif rule.logsource.category == 'wmi_event' or rule.logsource.service == 'wmi' -%}
{% set index = 'logs-endpoint-winevent-wmiactivity-*' -%}
{% elif rule.logsource.category in ['ps_classic_start','ps_module','ps_script'] or rule.logsource.service in ['powershell','powershell-classic'] -%}
{% set index = 'logs-endpoint-winevent-powershell-*' -%}
{% endif -%}
{% set index = 'logs-endpoint-winevent-*' -%}
{% elif rule.logsource.product == 'linux' -%}
{% set index = 'linux-*' -%}
{% else -%}
{% set index = 'logs-*' -%}
{% endif -%}
{{- index }}{% endmacro -%}
index: {{ index() }}
filter:
- query:
query_string:
query: '{{ query }}'
finalizers:
- type: concat