Skip to main content

Security Onion Playbook Lookback

Step 1​

Copy default Elastalert config to local to set custom setting​

sudo cp /opt/so/saltstack/default/salt/elastalert/defaults.yaml /opt/so/saltstack/local/salt/elastalert/defaults.yaml

Step 2​

Change buffer_time from minutes to days and set value to 365 in local Elastalert config​

sudo vi /opt/so/saltstack/local/salt/elastalert/defaults.yaml

Step 3​

Delete Elastalert indexes tracking last query​

curl -s -K /opt/so/conf/elasticsearch/curl.config -k https://localhost:9200/_cat/indices | awk '{print $3}' | grep "elastalert" | xargs -i curl -s -K /opt/so/conf/elasticsearch/curl.config -k -XDELETE https://localhost:9200/{}

Step 4​

Restart elastalert for settings to take effect​

sudo so-elastalert-restart