Conversation
@lorenzo please do check if alarms.py matches with ones in your open PR. Further these are minor additions
github-actions
bot
added
docker
Roughly equals outflanknl#137 on the main RedELK branch of outflanknl
|
Should this be merged, or are we waiting for another commit? |
|
|
||
| def alarm_check(self): | ||
| # This check queries for IP's that aren't listed in any iplist* but do talk to c2* paths on redirectors\n | ||
| q = "NOT tags:iplist_* AND redir.backend.name:c2* AND tags:enriched_* AND NOT tags:%s"%(info['submodule']) |
There was a problem hiding this comment.
Should be self.info and not info, that's the bug I think
There was a problem hiding this comment.
info is fine, the dict is global.
| LOG_LEVEL = logging.DEBUG | ||
| if localconfig.DEBUG: | ||
| LOG_LEVEL = logging.DEBUG | ||
| else: | ||
| LOG_LEVEL = logging.INFO |
There was a problem hiding this comment.
I would add a loglevel variable in the config, so we can have more than just info and debug
There was a problem hiding this comment.
@MarcOverIP this still needs to be addressed before merging
There was a problem hiding this comment.
agree. let's implant a config.DEBUGLEVEL
This was just a quick fix to avoid disk from filling 100% in days
|
|
||
| def alarm_dummy(self): | ||
| q = "c2.log.type:ioc AND NOT tags:%s"%(info['submodule']) | ||
| q = "c2.log.type:ioc AND NOT tags:alarm_*" |
There was a problem hiding this comment.
I would keep the submodule name so it will alert for everything that has not been alerted by alarm_dummy before (to keep the behavior consistent with other alarms.
| qSub = qSub + ") " | ||
| #q = "%s AND redir.backendname:c2* AND tags:enrich_* AND NOT tags:alarm_* "%qSub | ||
| q = "%s AND redir.backend.name:c2* AND NOT tags:%s"%(qSub,info['submodule']) | ||
| q = "%s AND redir.backend.name:c2* AND NOT tags:alarm_useragent" % qSub |
There was a problem hiding this comment.
Use the submodule name instead of hardcoding alarm_useragent
There was a problem hiding this comment.
true, likely has to be self.info as mentioned in some other item.
Signed-off-by: fastlorenzo <git@bernardi.be>
|
approved @xychix 🤣 |
|
Obsolete due to PR #117 |
4 participants
@lorenzo please do check if alarms.py matches with ones in your open PR. Further these are minor additions