ElastAlert doesnt get any results

[davidjud]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

20

Storage for /

500

Storage for /nsm

100

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello, I configured a ElastAlert rule file which looks like this:

name: blacklist_mail

index: "logs-*"

type: blacklist
es_host: elasticsearch
es_port: 9200

compare key:
 - "event.severity_label"

blacklist:
 - "high"
 - "medium"
 - "low"

filter:
 - wildcard: 
     event_type: "*"

alert:
 - email

email:
- "[email protected]"
smtp_host: "smtp.gmail.com"
smtp_port: 587
smtp_ssl: true
from_addr: "[email protected]"
smtp_auth_file: '/opt/elastalert/rules/smtp_auth_file.txt'

I also startet elastalert with the start command. But when I want to test the file with "so-elastalert-test" I get this result:

"Didn't get any results."

Could it be that i configured something wrong and the blacklist doesnt compare the right compare_key with the correct field?

Thanks in advance

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

What are you trying to do with this rule? Send an email on every alert?

[davidjud]

No, I just forgot to remove the "medium" and "high" values. I just inserted them for testing if I get any results

[cm-ops]

Have you thought about Playbook? You could use something like below, just tweak the yaml and add your email alerter to the file.

Playbook:

title: High Severity Suricata Alert
status: experimental
description: Raises an alert when there is a high severity Suricata alert in Security
  Onion
author: TBD
logsource:
  product: suricata
  service: suricata
detection:
  selection:
    event.dataset: suricata.alert
    event.severity_label: high
  condition: selection
falsepositives:
- None
level: low

Email example: