johnsusek / praeco

Elasticsearch alerting made simple.
GNU General Public License v3.0
548 stars 88 forks source link

IRIS Alerter Support #585

Closed nsano-rururu closed 10 months ago

nsano-rururu commented 1 year ago
alert:
- iris

iris_host: "127.0.0.1"
iris_api_token: "token123456789"
iris_customer_id: 1
iris_description: "Test alert from ElastAlert2"
iris_alert_note: "Alert triggered by opened session"
iris_alert_tags: "test, login, ssh"
iris_alert_context:
  username: username
  ip: src_ip
iris_iocs:
  - ioc_value: src_ip
    ioc_description: source ip address
    ioc_tlp_id: 1
    ioc_type_id: 42
    ioc_tags: ipv4
  - ioc_value: username
    ioc_description: who was connecting
    ioc_tlp_id: 3
    ioc_type_id: 3
    ioc_tags: username