jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
426 stars 67 forks source link

Execute custom actions on alerts #82

Closed sgabe closed 4 years ago

sgabe commented 5 years ago

I wanted an easy way to add the source IP address of an alert to an address list on a MikroTik router, hence I decided to fork your repository and add the missing pieces.

I ended up with the routeros Go client library for accessing MikroTik devices using the RouterOS API. The idea is to add or remove the source IP address of an alert to or from an address list on a MikroTik device by invoking the RouterOS API when an alert is escalated or de-escalated.

The above serves me well, however, it would be nice to have a general approach (e.g. some kind of plugin system or just a Go interface for a start) to implement custom actions for alerts that could be triggered from the web interface or via an API call.

jasonish commented 4 years ago

Closing as right now I feel this is out of scope.