Hello,
I have installed the elastalert2. I have created a rule to trigger an alert when the sudo command is executed
index: .ds-logs-auditd.log-default-*
type: any
filter:
- term:
process.executable: "/usr/bin/sudo"
alert:
- "email"
email:
- "[email protected]"
smtp_host: smtphost
smtp_port: 8025
smtp_auth_file: smtp_auth.yaml
realert:
minutes: 0
Whenever i run the below command
python -m elastalert.elastalert --verbose --rule examples/rules/test_rule.yaml
I'm receiving the email alert as it have to run it in background right so that whenever the sudo command is executed i will be receiving the email alert.
if i created another rule how to run both of them!
Please Help!
Thanks in advance!