What are the results of using the following fields? #423
-
|
I have some doubts about usage, the first is this top_count_keys, After I set it, how will it be displayed in the result? In addition, what are the optional fields for category? Will it be included in the results And what is the purpose of kibana configuration? And I want to build a summary table. summary_table_fields: How should its configuration file be written? What are the rules? |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 17 replies
-
|
Beta Was this translation helpful? Give feedback.
-
Did you see it in the documentation? category Category: This value is used to identify the category of the alert. Optionally, this field can be included in any alert type (for example, for use in the subject / body of an email). (Options, strings, default empty string) You can easily understand it by entering some characters and moving it. Why do you hate moving your hands? .. Is there no sense of ownership? .. It's your problem, isn't it? .. am I wrong? |
Beta Was this translation helpful? Give feedback.
-
|
summary_table_fields example of rule name: 'Test'
alert:
- hivealerter
aggregation:
seconds: 15
aggregation_key: aggregation_key
summary_table_fields:
- field1
- field2
filter:
- query:
query_string:
query: "(type:test)"
alert_text: |
{0}
{1}
alert_text_args:
- name
- aggregation_key
- aggregation_summary
hive_alert_config_type: classic
hive_alert_config:
type: 'test'
source: 'elastalert-{rule[name]}'
severity: 3
tags: ['malicious behavior']
tlp: 2
status: 'New'
follow: True
hive_observable_data_mapping:
- ip: "{match[field1]}"
- source: "{match[field2]}"
|
Beta Was this translation helpful? Give feedback.
-
look |
Beta Was this translation helpful? Give feedback.
-
|
Example of using top_count_keys |
Beta Was this translation helpful? Give feedback.
-
|
First of all thank you for your answers. I need to explain. I have read the document many times, but it is difficult to understand "Imagery" with only simple text in the document. I have also done some debugging, but I may not understand the meaning of the document, which leads to configuration errors and no results. |
Beta Was this translation helpful? Give feedback.
-
|
Let me give you an example. I did the test, but I didn’t see the function of the built-in keywords (category,owner,priority,description.....), I think something should be needed to help understand.
Even if we customize a keyword, the result will be printed out. |
Beta Was this translation helpful? Give feedback.
-
|
Did you really read the documentation? .. Owner, Priority, and Description are not features, they are just fields for adding rule owners, priorities, and descriptions. |
Beta Was this translation helpful? Give feedback.
-
|
As an example of how Owner, Priority, and Description are used, we will describe the hearing results from using them. When working with large teams, it's usually a good idea to know who created the rule and a description of the rule. That way, others will be able to understand the context. |
Beta Was this translation helpful? Give feedback.
-
|
This is testing. I don't know what will happen. |
Beta Was this translation helpful? Give feedback.
-
|
In addition, I don’t know why summary always doesn’t push alerts. |
Beta Was this translation helpful? Give feedback.
-
|
I heard that it is different from the first question, what does it mean? .. Did you solve the first question? |
Beta Was this translation helpful? Give feedback.
-
|
Please read the documentation. |
Beta Was this translation helpful? Give feedback.
look
Adding support for generating Kibana Discover app link