SO 2.4.60 Elastalert/Playbook Email Setup

[8inaryMata1eao]

After struggling to try to figure out how to get Playbook emails without having to manually modify every rule once made "active", I have found a solution. Thanks to a few previous Q&A discussions in here, I would like to share my findings with the community. It seems peculiar that this isn't in the standard documentation of SO but maybe it is a 'business' decision not to.

Previously another user had mentioned to edit the file /opt/so/rules/elastalert/playbook/generic.template. But when they let it sit, salt syncs and the file returns to default. In other SO documentation they say to copy default files from /opt/so/saltstack/default/salt/ and place them in /opt/so/saltstack/local/salt/ to make changes permanent. So to setup automated emails for all new playbook alerts the following is needed.

1. Copy the default template to the local salt path
   cp /opt/so/saltstack/default/salt/soctopus/files/templates/generic.template /opt/so/saltstack/local/salt/soctopus/files/templates/
2. Modify that new file to define your email settings like so.

alert:
- "modules.so.playbook-es.PlaybookESAlerter"
- "email"
email:
- "[email protected]"
smtp_host: "myemail.server.com"
smtp_port: 25
from_addr: "[email protected]"

elasticsearch_host: "{{ GLOBALS.url_base }}:9200"
play_title: ""
play_id: ""
event.module: "playbook"
event.dataset: "playbook.alert"
event.severity:
rule.category:
play_url: "https://{{ GLOBALS.url_base }}/playbook/issues/6000"
kibana_pivot: "https://{{ GLOBALS.url_base }}/kibana/app/kibana#/discover?_g=()&_a=(columns:!(_source),interval:auto,query:(language:lucene,query:'_id:{[_id]}'),sort:!('@timestamp',desc))"
soc_pivot: "https://{{ GLOBALS.url_base }}/#/hunt"
sigma_level: ""

index: '.ds-logs-*'
name: EQL
priority: 3
realert:
  minutes: 0
type: any
filter:

3. This file will be copied by salt to /opt/so/rules/elastalert/playbook/generic.template.
4. Validate permissions are correct and check file contents that it matches the previous file we updated.
   -rw-r--r--. 1 socore socore 696 May 2 21:02 /opt/so/rules/elastalert/playbook/generic.template
5. Now any rule you activate will have this default email configuration setup. Its pretty large and ugly, I haven't cleaned up the email output yet but this gets you the alerts so IR can take place when not monitoring the dashboard.

NOTE: You will have to disable and re-enable any rules that are already active as they will not have the new configuration.
I hope this helps anyone like it did me and my deployments. And thank you to the SO team for making a great platform we all can benefit from.