Comments (5)
Hmm, yeah I wonder if that is the problem. I've only used Elastalert for live traffic, but I don't know how it works with events that are coming in "out of order" or with an older time frame. That might be a shortcoming of that tool. I will try to get some time to do some more research on that. Sorry I don't have a more ready answer for you.
from malcolm.
One question, is your traffic "live" traffic (being captured "now"-ish by Malcolm) or are these historical PCAPs you're uploading? I'm seeing my alerts okay when I do debugging.
In my test rule file I've got alert_text_type: alert_text_only
, and alert_text
and alert_text_args
set. Then periodically I see:
elastalert_1 | 12:53:34.259Z INFO elastalert-server:
elastalert_1 | ProcessController: Network traffic captured by filebeat generated a dns log for ['dns'] traffic with action ['INTERNET A']: "['Success']"
Depending on what your alert_text
is.
You could try resetting the elastalert database and see if that helps, by running this in the Malcolm directory:
docker-compose stop elastalert; docker-compose exec -T -u curator curator curl -sSL -X DELETE "elasticsearch:9200/elastalert*?pretty" ; docker-compose restart elastalert
from malcolm.
my traffic is composed of "historical" PCAPS, could it be that i configured the time that elastalert looks backwards wrong?
how do i configure it correctly?
ill also try to change the alert text rules -
thanks for the help.
from malcolm.
Thanks for the report, I'll check it out this next week and get back to you.
from malcolm.
The next major release of malcolm is going to replace elastalert with open distro for elastic (see issue #15).
from malcolm.
Related Issues (20)
- during auth_setup "all" operation, do required operations without prompting if the files don't already exist
- Why is there no configuration in Malcolm to enable real-time capture of Arkime on demand HOT 3
- Malcolm manages PCAP files HOT 4
- some containers need resource request specified for Kubernetes HOT 1
- kubernetes manifest for netbox refers to netbox-netmap-json configmap which no longer exists
- fluent-bit-setup.ps1 helper script needs updated URLs
- add "public" pseudo-segments for public IP addresses HOT 1
- The memory usage of Malcolm is over 30GB, even set only 10G for Opensearch. HOT 3
- Bug: After uploading a pcap file, the dashboard and Arkime cannot function properly HOT 1
- PCAP Download - Malcolm + Hedgehog HOT 2
- improvements to control script: wipe, reingest
- Missing cracklib-runtime package prevents password from being updated by non-root user HOT 2
- Does Malcolm support the use of remote logstash instances? HOT 2
- update watchdog package to 5.0.0
- review Trivy report
- Configure-Capture crashes after selecting Zeek file carving mode HOT 5
- include netbox-topology plugin by default HOT 1
- filtering on hunt ID in Arkime not working
- arkime start log HOT 5
- integrate Zeek IEC104 parser
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from malcolm.