Segregating Servers and Endpoints to have different rules applied to them.

[jaypfe]

Hey! If you guys happen to meander onto this thread and might be able to throw some knowledge my way, I would greatly appreciate it!

This is what I am wanting to do:
I want to build a rule that alerts me when a server has not sent any logs in an hour. Thats easy I can do that with elastalert.

But,
I only want to alert to servers, not endpoints with this rule as Endpoint alerts would drown me in chaff.

The question is:
Is there a good way anyone knows to accomplish this? I have thought about making a new policy for only servers, but if I did that I am still not sure how to only apply that rule that fleet policy. I've thought about just filtering out all the endpoints, but that sounds like a nightmare. Maybe if I can link it to a doc it would not be so bad? I am not sure if that's a possibility.

I am almost positive there is some super easy and supported way of doing this, but I am clueless about it!

Any comments or ideas is appreciated!

[cm-ops]

If you have an Elastalert rule already, have you tried a blacklist rule using observer.name as the compare_key and listing only the servers? https://elastalert2.readthedocs.io/en/latest/ruletypes.html#blacklist

[jaypfe]

Thanks for that suggestion! I will give that a try. I was able to get it to work the way I wanted by filtering on only "server" OS's in the rule. But I think your solution is more elegant.