KeyError: 'agent' when added custom elastalert rule

[utkarshborawake]

The custom elastalert rule is mentioned below. I am getting hits and matches for the rule but at the same time getting the error which is mentioned below the rule.

RULE --> ACDS_cve_id: '' confidence: 90 description: This alert will trigger when Open VPN user is trying to login with invalid passwords. alert:

• debug filter:
  • query: query_string: query: (event.dataset:"vpn" AND event.module:"pfsense" AND event_data.message:"could not authenticate") index: ':so-beats' mitre:
  • attack.persistence
  • attack.T1133 name: ACDS-OVPN-User-Authentication-Failed priority: 1 realert: minutes: 0 rule.category: security type: any verified:
  • attack.persistence
  • attack.T1133 version: 1.0

ERROR --> Traceback (most recent call last):, File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 1298, in alert, return self.send_alert(matches, rule, alert_time=alert_time, retried=retried), File "/usr/local/lib/python3.10/site-packages/elastalert/elastalert.py", line 1375, in send_alert, alert.alert(matches), File "/opt/elastalert/modules/custom/ACDS_alerter.py", line 47, in alert, hostname = match["agent"]["name"], KeyError: 'agent'

[nsano-rururu]

elastalert is not maintained. Please use elastalert2. https://github.com/jertel/elastalert2/discussions

[utkarshborawake]

Okay Thanks