Skip to content

Commit ee300d3

Browse files
codeyourwebcodeyourweb
committed
elasticsearch datastream configuration and normalize indexes and elastalert detection
1 parent ea2b0d7 commit ee300d3

File tree

12 files changed

+76
-82
lines changed

12 files changed

+76
-82
lines changed

‎config/docker-config/backend-entrypoint.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ setup_symfony() {
3030
3131
rm -rf /var/www/html/var/cache
3232
rm -rf /var/www/html/public/bundles
33-
rm -rf /detection-rules/elastalert/*
3433
3534
3635
if ! check_composer_changes || [ ! -d "/var/www/html/vendor" ] || [ ! -f "/var/www/html/vendor/autoload.php" ]; then

‎config/elastalert/defaults.yml‎

Lines changed: 18 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,43 @@
11
# Default shared configuration for all Elastalert rules
22
# This file can be imported in other rules with "import:"
33

4-
# Elasticsearch connection parameters
5-
es_conn_timeout: 30
6-
max_query_size: 1000
7-
8-
# Timing parameters
9-
buffer_time:
10-
minutes: 1
11-
realert:
12-
minutes: 1
13-
144
# Index parameters
155
use_strftime_index: false
166
timestamp_field: '@timestamp'
17-
7+
aggregation:
8+
minutes: 1
9+
aggregation_key: '@timestamp'
1810
# Alert parameters
19-
priority: 1
11+
priority: 4
2012
type: any
13+
index: 'sentinelkit*'
2114

2215
# Fields to include in alerts
2316
include:
2417
- _index
2518
- _id
2619
- '@timestamp'
27-
- source
28-
- message
2920

30-
# Default alert template
21+
# Default alert template with reliable metadata
3122
alert_text: |
32-
🚨 Sentinel-Kit Alert
33-
=====================
34-
Rule: {rule_name}
23+
Sentinel-Kit Security Alert
24+
==============================
3525
Index: {0}
3626
Document ID: {1}
37-
Timestamp: {2}
38-
Source: {3}
39-
Message: {4}
4027
4128
alert_text_args:
4229
- _index
4330
- _id
4431
- '@timestamp'
45-
- source
46-
- message
4732

48-
# Configuration for debug alerts
33+
# Configuration for debug alerter with full metadata display
4934
alert:
50-
- debug
35+
- debug
36+
37+
include_rule_params_in_matches:
38+
- name
39+
- description
40+
- filter
41+
- priority
42+
43+
alert_subject: "Sentinel-Kit Alert: {0}"

‎config/elastalert/elastalert_config.yml‎

Lines changed: 1 addition & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -14,47 +14,7 @@ alert_time_limit:
1414
days: 2
1515
prometheus_port: 9091
1616
prometheus_host: 0.0.0.0
17-
1817
es_conn_timeout: 60
1918
max_query_size: 10000
20-
max_aggregation: 10000
19+
max_aggregation: 1000
2120
scroll_keepalive: 1m
22-
23-
# Default configuration for all rules
24-
global_defaults:
25-
# Elasticsearch connection
26-
es_conn_timeout: 30
27-
max_query_size: 1000
28-
29-
# Timing
30-
buffer_time:
31-
minutes: 1
32-
realert:
33-
minutes: 1
34-
35-
# Index settings
36-
use_strftime_index: false
37-
timestamp_field: '@timestamp'
38-
39-
# Alert settings
40-
priority: 1
41-
type: any
42-
43-
# Fields to include in alerts
44-
include:
45-
- _index
46-
- _id
47-
- '@timestamp'
48-
49-
# Default alert template
50-
alert_text: |
51-
Sentinel-Kit Alert
52-
Rule: {rule_name}
53-
Index: {0}
54-
Document ID: {1}
55-
Timestamp: {2}
56-
57-
alert_text_args:
58-
- _index
59-
- _id
60-
- '@timestamp'

config/elasticsearch/ca-setup.sh renamed to config/elasticsearch/es-setup.sh

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,4 +51,40 @@ echo "Waiting for Elasticsearch availability";
5151
until curl -s --cacert config/certs/ca/ca.crt https://sentinel-kit-db-elasticsearch-es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
5252
echo "Setting kibana_system password";
5353
until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTICSEARCH_PASSWORD}" -H "Content-Type: application/json" https://sentinel-kit-db-elasticsearch-es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"s3nt1n3lkit_k1b4n4_syst3m_p4sswd\"}" | grep -q "^{}"; do sleep 10; done;
54+
55+
echo "Creating sentinelkit-logs index template with higher priority";
56+
curl -s -X PUT --cacert config/certs/ca/ca.crt -u "elastic:${ELASTICSEARCH_PASSWORD}" \
57+
-H "Content-Type: application/json" \
58+
https://sentinel-kit-db-elasticsearch-es01:9200/_index_template/sentinelkit-logs \
59+
-d '{
60+
"index_patterns": ["sentinelkit-*"],
61+
"priority": 300,
62+
"data_stream": {},
63+
"template": {
64+
"settings": {
65+
"index.lifecycle.name": "logs"
66+
}
67+
},
68+
"composed_of": ["logs@settings", "logs@mappings", "ecs@mappings"]
69+
}';
70+
71+
echo "Sentinelkit logs template created successfully";
72+
73+
echo "Waiting for Kibana availability";
74+
until curl -s http://sentinel-kit-utils-kibana:5601/api/status | grep -q '"level":"available"'; do sleep 10; done;
75+
76+
echo "Creating Kibana data view for sentinelkit-* logs";
77+
curl -s -X POST "http://sentinel-kit-utils-kibana:5601/api/data_views/data_view" \
78+
-H "Content-Type: application/json" \
79+
-H "kbn-xsrf: true" \
80+
-u "elastic:${ELASTICSEARCH_PASSWORD}" \
81+
-d '{
82+
"data_view": {
83+
"title": "sentinelkit-*",
84+
"name": "Sentinel-Kit Logs",
85+
"timeFieldName": "@timestamp"
86+
}
87+
}';
88+
89+
echo "Kibana data view created successfully";
5490
echo "All done!"

‎config/fluentbit_server/logs-auditd.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
Port 9200
2323
Buffer_Size 5M
2424
Logstash_Format On
25-
Logstash_Prefix ingest-auditd
25+
Logstash_Prefix sentinelkit-ingest-auditd
2626
Logstash_DateFormat %Y.%m.%d
2727
Type _doc
2828
Time_Key @timestamp

‎config/fluentbit_server/logs-csv.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
Port 9200
3434
Buffer_Size 5M
3535
Logstash_Format On
36-
Logstash_Prefix ingest-csv
36+
Logstash_Prefix sentinelkit-ingest-csv
3737
Logstash_DateFormat %Y.%m.%d
3838
Type _doc
3939
Time_Key @timestamp

‎config/fluentbit_server/logs-evtx.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
Port 9200
3434
Buffer_Size 5M
3535
Logstash_Format On
36-
Logstash_Prefix ingest-evtx
36+
Logstash_Prefix sentinelkit-ingest-evtx
3737
Logstash_DateFormat %Y.%m.%d
3838
Type _doc
3939
Time_Key @timestamp

‎config/fluentbit_server/set_target_index.lua‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ function set_target_index(tag, timestamp, record)
22
local exit_code = 0
33

44
if record["target_index"] == nil then
5-
record["target_index"] = "undefined-index"
5+
record["target_index"] = "sentinelkit-undefined-index"
66
exit_code = 1
77
end
88

‎docker-compose.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,9 +228,9 @@ services:
228228
restart: on-failure
229229
volumes:
230230
- sentinel-kit_certificates_elasticsearch:/usr/share/elasticsearch/config/certs
231-
- ./config/elasticsearch/ca-setup.sh:/usr/share/elasticsearch/ca-setup.sh:ro
231+
- ./config/elasticsearch/es-setup.sh:/usr/share/elasticsearch/es-setup.sh:ro
232232
user: "0"
233-
command: 'sh -c "/usr/share/elasticsearch/ca-setup.sh"'
233+
command: 'sh -c "/usr/share/elasticsearch/es-setup.sh"'
234234
environment:
235235
- ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD}
236236
- ELASTICSEARCH_CLUSTER_MODE=${ELASTICSEARCH_CLUSTER_MODE}

‎launcher.ps1‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -301,9 +301,14 @@ switch ($Command.ToLower()) {
301301
$serviceMap = @{
302302
'backend' = 'sentinel-kit-app-backend'
303303
'frontend' = 'sentinel-kit-app-frontend'
304-
'mysql' = 'sentinel-kit-mysql'
305-
'elasticsearch' = 'sentinel-kit-elasticsearch'
306-
'kibana' = 'sentinel-kit-kibana'
304+
'mysql' = 'sentinel-kit-db-mysql'
305+
'elasticsearch' = 'sentinel-kit-db-elasticsearch-es01'
306+
'kibana' = 'sentinel-kit-utils-kibana'
307+
'scanner' = 'sentinel-kit-server-rules-scanner'
308+
'forwarder' = 'sentinel-kit-server-fluentbit'
309+
'caddy' = 'sentinel-kit-server-caddy'
310+
'grafana' = 'sentinel-kit-utils-grafana'
311+
'prometheus' = 'sentinel-kit-utils-prometheus'
307312
}
308313

309314
if ($ServiceName) {

0 commit comments

Comments
 (0)