Custom index for detections

[dgmyr]

Version

2.4.120

Installation Method

Network installation on Ubuntu (unsupported)

Description

configuration

Installation Type

Distributed

Location

other (please provide detail below)

Hardware Specs

other (please provide detail below)

CPU

6

RAM

16

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

It's possible to customize index for all enabled detections (without losing them from detections tab in SOC console) in order to optimize resource consumption of elastalert?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

Can you give a bit more info one what you are hoping to achieve?

What do you mean by customizing the detections index for resource management?

[dgmyr]

I mean if it's possible to customize index in enabled sigma detections that are located in /opt/so/rules/elastalert/rules/ in order to optimize resource consumption when you enable all avaliable rules. For exmple change index: .ds-logs-* to .ds-logs-ossec-so-sysmon-*. If I change it manually in files, after next sync of detections all changes disappear.