Open tgocoh opened 4 years ago
Replaced alerts.py with v0.2.0's alerts.py that works fine. v0.2.1 was not tested TheHive related changes.
Do you have a proxy pass in your nginx config to port 9000 (TheHive)?
@tgocoh this rule worked fine for me
name: Elastalert to Thehive Test
type: frequency
index: .siem-signals-*
num_events: 1
timeframe: minutes: 500
filter:
- query: query_string: {query: "alert_name: 'test - unique src IP count is greater than 20'"}
alert: hivealerter
hive_connection: hive_host: https://aaa.aaa.aaa/ hive_port: 443 hive_apikey: m7yDdYy8m45WtUY5e2rXaMcNk8Rt4e82
hive_alert_config: title: 'testing' type: 'external' source: 'elastalert' description: 'Sample description' severity: 2 tags: ['tag1', 'test'] tlp: 3 status: 'New' follow: True
TheHive alert is attempting access to TheHive host's 80 port it seems cannot get value from hive_port. Nginx is working on TheHive server.
Config is: