jira/slack integration with Securityonion/Elastalert

[bikesh404]

I have followed jira/slack integration process from SecurityOnion doc "https://docs.securityonion.net/en/2.3/elastalert.html". I am still facing problem with any integration with Securityonion. Can you please help me with proper documentation for Slack or Jira integration in Securityonion?

[weslambert]

Have you tried checking the following logs for clues?

/opt/so/log/elastalert/elastalert.log
/opt/so/log/elastalert/stderr.log

[bikesh404]

yes, i have tried for logs, just find nothing as issue. I think i lack proper documentation like:

1. what code/tricks to be done
2. at what location i should add the code
3. How to check whether the config is ok or not
4. Do securityonion really support Slack/jira or other alerting system like TheHive?

[weslambert]

You state that you are having a problem, but haven't described the problem other than in a general sense, and have not described specifically what actions you have taken and how you've tested or performed troubleshooting.

Could you please be a bit more specific with describing your issue and the steps you've taken to attempt to resolve it?

[bikesh404]

Can you please help me with proper documentation for Slack or Jira integration in Securityonion?

[weslambert]

From the rule configuration perspective, the documentation is the same as it would be for native Elastalert.

For example, the documentation for Elastalert's JIRA integration is found here: https://elastalert2.readthedocs.io/en/latest/ruletypes.html#jira