Cant view elastalert debug alerts about malcolm HOT 5 CLOSED

Hmm, yeah I wonder if that is the problem. I've only used Elastalert for live traffic, but I don't know how it works with events that are coming in "out of order" or with an older time frame. That might be a shortcoming of that tool. I will try to get some time to do some more research on that. Sorry I don't have a more ready answer for you.

from malcolm.

One question, is your traffic "live" traffic (being captured "now"-ish by Malcolm) or are these historical PCAPs you're uploading? I'm seeing my alerts okay when I do debugging.

In my test rule file I've got alert_text_type: alert_text_only, and alert_text and alert_text_args set. Then periodically I see:

elastalert_1     | 12:53:34.259Z  INFO elastalert-server:
elastalert_1     |     ProcessController:  Network traffic captured by filebeat generated a dns log for ['dns'] traffic with action ['INTERNET A']: "['Success']"

Depending on what your alert_text is.

You could try resetting the elastalert database and see if that helps, by running this in the Malcolm directory:

docker-compose stop elastalert; docker-compose exec -T -u curator curator curl -sSL -X DELETE "elasticsearch:9200/elastalert*?pretty" ; docker-compose restart elastalert

from malcolm.

my traffic is composed of "historical" PCAPS, could it be that i configured the time that elastalert looks backwards wrong?
how do i configure it correctly?
ill also try to change the alert text rules -
thanks for the help.

from malcolm.

Thanks for the report, I'll check it out this next week and get back to you.

from malcolm.

The next major release of malcolm is going to replace elastalert with open distro for elastic (see issue #15).

from malcolm.