IRIS alert context does not work correctly #1348

Areopagit · 2023-12-28T11:27:06Z

Areopagit
Dec 28, 2023

Elasticsearch 7.17.0
ElastAlert2 in Docker - latest (I updated it yesterday)
IRIS: 2.3.7

iris_alert_context:
  hostname: host.hostname
  domain: user.domain
  ip: host.ip
  user: winlog.event_data.TargetUserName
  timestamp: event.created
  message: message
  log: winlog
  tags: tags

hostname, domain, ip, user and timestamp dont work. This fields in IRIS are empty.
But field from a single word (message, winlog, tags) - OK!

The dot somehow gets in the way...

Please, help. All fields of Windows logs contain dot.

Answered by malinkinsa

Jan 8, 2024

@Areopagit hello.
There was an issue with nested JSON within the document. To fix it, I borrowed the approach used in TheHive's alerter. I checked both options - couldn't replicate the problem after the fix. Also expanded the tests.

Regarding IOC and IPs, the problem lies in the fact that your IP data is formatted as a list [] and therefore doesn't pass the IRIS validator. Ideally, you should parse it into a separate field and request that.

@jertel
PR ready, any feedback is welcome.

View full answer

jertel · 2023-12-28T12:44:51Z

jertel
Dec 28, 2023
Maintainer

Please see #11 and format your message appropriately.

1 reply

Areopagit Dec 28, 2023
Author

Did it.

malinkinsa · 2023-12-28T14:34:52Z

malinkinsa
Dec 28, 2023

Hi, @Areopagit

For the test, I used the following document from my test ES:

"username.test.name": "Bob",
"event": "login",
"src_ip": "1.1.1.1",
"is_admin": "No"

And the next block in rule:

iris_host: 127.0.0.1
iris_api_token: token12345
iris_customer_id: 1
iris_type: alert
iris_ignore_ssl_errors: True
iris_description: 'Test issue with dot in key'
iris_alert_note: 'test'
iris_alert_tags: 'test, dot'
iris_alert_context:
  username: username.test.name
  source: _type
  ip: src_ip
iris_iocs:
  - ioc_value: src_ip
    ioc_description: test ioc
    ioc_tlp_id: 1
    ioc_type_id: 2
    ioc_tags: ipv4
  - ioc_value: username.test.name
    ioc_description: user ioc
    ioc_tlp_id: 2
    ioc_type_id: 3
    ioc_tags: username

And result in IRIS

Could you provide more details about your issue? It would be helpful to have an example document and any errors, if they exist, on Iris's side, if possible.

0 replies

Areopagit · 2023-12-29T08:32:35Z

Areopagit
Dec 29, 2023
Author

Hi, @malinkinsa.

I used the following document from my ELK Stack (7.17.0):

"host.hostname": "WS293"
"user.domain": "DOMAIN"
"host.ip": "1.2.3.4"
"winlog.event_data.TargetUserName": "user.name"
"event.created": "Dec 29, 2023 @ 10:43:25.002"
"tags": "winws, beats_input_codec_plain_applied"

This is my rule:

name: RuleName

type: any

index: winws-*

num_events: 1

timeframe:
  hours: 4

filter:
- query:
    query_string:
      query: winlog.event_id.keyword:4624 AND winlog.event_data.TargetUserName.keyword:user.name

alert_text: |
  "User {0} logon in PC {1} in {2}."
alert_text_type: alert_text_only
alert_text_args: ["winlog.event_data.TargetUserName", "host.hostname", "@timestamp_local"]

match_enhancements:
- "elastalert_modules.time_enhancement.TimeEnhancement"

alert:
- telegram
- iris

telegram_bot_token: "token"
telegram_room_id: "ID"

iris_host: 3.4.5.6
iris_api_token: TOKEN
iris_ignore_ssl_errors: True
iris_customer_id: 1
iris_type: alert
iris_description: 'user.name logon in PC'
iris_alert_note: 'Alert of user.name logon in PC'
iris_alert_tags: 'AD, Logon, WorkStation'
iris_alert_status_id: 2
iris_alert_severity_id: 2
iris_alert_context:
  hostname: host.hostname
  domain: user.domain
  ip: host.ip
  user: winlog.event_data.TargetUserName
  timestamp: event.created
  message: message
  log: winlog
  tags: tags

And result in IRIS:

hostname:
domain:
ip:
user:
timestamp:
message: *confidential information*
log: *confidential information*
tags: 0: winws
        1: beats_input_codec_plain_applied

I don't see any errors, an alert is being created, but some fields are empty...
Approximately the same configuration for The Hive works without problems.

hive_connection:
  hive_host: http://localhost
  hive_port: 9000
  hive_apikey: KEY

hive_alert_config:
  follow: True
  severity: 2
  status: 'New'
  source: 'elastalert-docker'
  tags: ['Create', 'Enable', 'PC']
  title: 'Create PC'
  tlp: 3
  type: 'AD'

hive_observable_data_mapping:
  - hostname: host.hostname
  - domain: winlog.event_data.TargetDomainName
  - ip: host.ip
  - admin: winlog.event_data.SubjectUserName
  - computer: winlog.event_data.TargetUserName
  - timestamp: event.created

I am just considering the transition from TheHive to IRIS.

But my IOCs worked:

iris_iocs:
  - ioc_value: host.hostname
    ioc_description: hostname
    ioc_tlp_id: 2
    ioc_type_id: 3
    ioc_tags: hostname
  - ioc_value: winlog.event_data.TargetUserName
    ioc_description: user
    ioc_tlp_id: 3
    ioc_type_id: 3
    ioc_tags: username

5 replies

malinkinsa Dec 29, 2023

Thanks, I'll try to replicate that and look into it soon.
We also moved to Iris from TheHive.

malinkinsa Dec 30, 2023

My lab:
ES: 7.10.0
IRIS: 2.3.3
ElastAlert2: 2.15.0

RAW Json from Kibana

{
  "_index": "issue_test",
  "_type": "_doc",
  "_id": "1",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2023-12-30T15:37:23.922047060Z",
    "host.hostname": "WS293",
    "user.domain": "DOMAIN",
    "host.ip": "1.2.3.4",
    "winlog.event_data.TargetUserName": "user.name",
    "event.created": "Dec 29, 2023 @ 10:43:25.002",
    "tags": "winws, beats_input_codec_plain_applied"
  },
  "fields": {
    "@timestamp": [
      "2023-12-30T15:37:23.922Z"
    ]
  },
  "highlight": {
    "host.hostname": [
      "@kibana-highlighted-field@WS293@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1703950643922
  ]
}

Rule .yaml file:

name: One more test
is_enabled: true

type: any

filter:
- query:
    query_string:
      query: 'host.hostname:WS293'


index: issue*

alert_subject: "One more test"

alert:
  - debug
  - iris

iris_host: 10.0.0.1
iris_api_token: token12345
iris_ignore_ssl_errors: True
iris_customer_id: 1
iris_type: alert
iris_description: 'user.name logon in PC'
iris_alert_note: 'Alert of user.name logon in PC'
iris_alert_tags: 'AD, Logon, WorkStation'
iris_alert_status_id: 2
iris_alert_severity_id: 2
iris_alert_context:
  hostname: host.hostname
  domain: user.domain
  ip: host.ip
  user: winlog.event_data.TargetUserName
  tags: tags

alert_text_type: alert_text_only

And result in IRIS in attachment

malinkinsa Dec 30, 2023

I'll try to update my ES version and give it another shot, but that might happen only after the 2nd or 3rd of January. Also, could you confirm if these fields are correctly transferred to Telegram on your end? I noticed it's being used there too?

malinkinsa Dec 30, 2023

If you want, you can write to me on Telegram, my username is identical. Perhaps debugging based on your data could be done right away.

Areopagit Dec 30, 2023
Author

My RAW Json from Kibana:

{
  "_index": "winws-000343",
  "_type": "_doc",
  "_id": "H6jXvIwBnIlN7Nl0bgA3",
  "_version": 1,
  "_score": 1,
  "_source": {
    "log": {
      "level": "info"
    },
    "winlog": {
      "keywords": [
        "success"
      ],
      "logon": {
        "id": "0x4cb9c48c",
        "type": "Unlock"
      },
      "api": "wineventlog",
      "opcode": "info",
      "event_data": {
        "TargetUserName": "user.name",
        "TargetDomainName": "mydomain",
        "ImpersonationLevel": "%%1833",
        "ElevatedToken": "%%1843",
        "LmPackageName": "-",
        "SubjectUserSid": "S-1-5-18",
        "SubjectLogonId": "0x3e7",
        "TargetUserSid": "S-1-5-21-3268738738-942520571-1760952555-3835",
        "SubjectUserName": "WS293$",
        "RestrictedAdminMode": "-",
        "IpAddress": "-",
        "TargetOutboundUserName": "-",
        "TargetLogonId": "0x4cb9c48c",
        "LogonType": "7",
        "LogonGuid": "{38ba2586-81f3-9fa7-39c3-d160999c6322}",
        "TargetOutboundDomainName": "-",
        "LogonProcessName": "Negotiat",
        "SubjectDomainName": "mydomain",
        "KeyLength": "0",
        "IpPort": "-",
        "VirtualAccount": "%%1843",
        "TransmittedServices": "-",
        "TargetLinkedLogonId": "0x0",
        "AuthenticationPackageName": "Negotiate"
      },
      "computer_name": "WS293.mydomain.local",
      "channel": "Security",
      "task": "Logon",
      "version": 2,
      "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}",
      "record_id": 4436568,
      "event_id": "4624",
      "provider_name": "Microsoft-Windows-Security-Auditing",
      "process": {
        "pid": 784,
        "thread": {
          "id": 7460
        }
      }
    },
    "ecs": {
      "version": "1.11.0"
    },
    "host": {
      "id": "fc6563a9-a963-44cc-93fa-5b4fc6c46fda",
      "hostname": "WS293",
      "os": {
        "kernel": "10.0.19041.3803 (WinBuild.160101.0800)",
        "version": "10.0",
        "build": "19045.3803",
        "type": "windows",
        "name": "Windows 10 Pro",
        "platform": "windows",
        "family": "windows"
      },
      "architecture": "x86_64",
      "mac": [
        "7a:4b:de:cf:48:a0"
      ],
      "ip": [
        "1.2.3.4"
      ],
      "name": "WS293.mydomain.local"
    },
    "@timestamp": "2023-12-30T22:28:01.907Z",
    "message": "confidential information",
    "tags": [
      "winws",
      "beats_input_codec_plain_applied"
    ],
    "agent": {
      "version": "7.15.1",
      "type": "winlogbeat",
      "hostname": "WS293",
      "ephemeral_id": "d57de21f-31a3-409b-8def-8b5d330b5c94",
      "id": "df98b09f-83d8-42c2-9784-82e473762506",
      "name": "WS293"
    },
    "related": {
      "user": [
        "user.name",
        "WS293$"
      ]
    },
    "@version": "1",
    "user": {
      "name": "user.name",
      "id": "S-1-5-21-3268738738-942520571-1760952555-3835",
      "domain": "mydomain"
    },
    "event": {
      "kind": "event",
      "type": [
        "start"
      ],
      "outcome": "success",
      "created": "2023-12-30T22:28:03.684Z",
      "category": [
        "authentication"
      ],
      "action": "logged-in",
      "module": "security",
      "provider": "Microsoft-Windows-Security-Auditing",
      "code": "4624"
    },
    "source": {
      "domain": "WS293"
    },
    "process": {
      "executable": "C:\\Windows\\System32\\lsass.exe",
      "name": "lsass.exe",
      "pid": 784
    }
  },
  "fields": {
    "winlog.event_data.AuthenticationPackageName": [
      "Negotiate"
    ],
    "agent.version.keyword": [
      "7.15.1"
    ],
    "event.category": [
      "authentication"
    ],
    "host.name.keyword": [
      "WS293.mydomain.local"
    ],
    "winlog.event_data.IpAddress": [
      "-"
    ],
    "event.outcome.keyword": [
      "success"
    ],
    "host.hostname": [
      "WS293"
    ],
    "winlog.event_data.TargetOutboundUserName.keyword": [
      "-"
    ],
    "host.mac": [
      "7a:4b:de:cf:48:a0"
    ],
    "winlog.process.pid": [
      784
    ],
    "winlog.event_data.KeyLength": [
      "0"
    ],
    "winlog.event_data.TargetDomainName.keyword": [
      "mydomain"
    ],
    "host.os.version": [
      "10.0"
    ],
    "winlog.logon.id": [
      "0x4cb9c48c"
    ],
    "agent.name": [
      "WS293"
    ],
    "event.outcome": [
      "success"
    ],
    "user.id": [
      "S-1-5-21-3268738738-942520571-1760952555-3835"
    ],
    "host.os.type": [
      "windows"
    ],
    "winlog.event_data.RestrictedAdminMode": [
      "-"
    ],
    "winlog.event_data.TargetUserSid": [
      "S-1-5-21-3268738738-942520571-1760952555-3835"
    ],
    "agent.id.keyword": [
      "df98b09f-83d8-42c2-9784-82e473762506"
    ],
    "winlog.event_data.LmPackageName.keyword": [
      "-"
    ],
    "agent.hostname": [
      "WS293"
    ],
    "winlog.event_data.LogonType.keyword": [
      "7"
    ],
    "tags": [
      "winws",
      "beats_input_codec_plain_applied"
    ],
    "related.user": [
      "user.name",
      "WS293$"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "event.provider": [
      "Microsoft-Windows-Security-Auditing"
    ],
    "event.code": [
      "4624"
    ],
    "winlog.event_data.TransmittedServices": [
      "-"
    ],
    "winlog.event_data.LogonProcessName.keyword": [
      "Negotiat"
    ],
    "agent.id": [
      "df98b09f-83d8-42c2-9784-82e473762506"
    ],
    "winlog.provider_name.keyword": [
      "Microsoft-Windows-Security-Auditing"
    ],
    "winlog.event_data.LogonGuid": [
      "{38ba2586-81f3-9fa7-39c3-d160999c6322}"
    ],
    "winlog.event_data.LogonGuid.keyword": [
      "{38ba2586-81f3-9fa7-39c3-d160999c6322}"
    ],
    "winlog.event_data.TransmittedServices.keyword": [
      "-"
    ],
    "winlog.event_data.SubjectUserSid": [
      "S-1-5-18"
    ],
    "winlog.api.keyword": [
      "wineventlog"
    ],
    "winlog.process.thread.id": [
      7460
    ],
    "winlog.event_data.TargetLinkedLogonId": [
      "0x0"
    ],
    "tags.keyword": [
      "winws",
      "beats_input_codec_plain_applied"
    ],
    "winlog.event_data.ElevatedToken": [
      "%%1843"
    ],
    "user.name": [
      "user.name"
    ],
    "source.domain": [
      "WS293"
    ],
    "host.ip": [
      "1.2.3.4"
    ],
    "agent.type": [
      "winlogbeat"
    ],
    "event.type.keyword": [
      "start"
    ],
    "host.os.kernel.keyword": [
      "10.0.19041.3803 (WinBuild.160101.0800)"
    ],
    "winlog.event_data.SubjectLogonId": [
      "0x3e7"
    ],
    "winlog.event_data.TargetLogonId": [
      "0x4cb9c48c"
    ],
    "winlog.api": [
      "wineventlog"
    ],
    "event.provider.keyword": [
      "Microsoft-Windows-Security-Auditing"
    ],
    "user.domain": [
      "mydomain"
    ],
    "host.id": [
      "fc6563a9-a963-44cc-93fa-5b4fc6c46fda"
    ],
    "winlog.event_data.RestrictedAdminMode.keyword": [
      "-"
    ],
    "winlog.event_data.ImpersonationLevel": [
      "%%1833"
    ],
    "agent.type.keyword": [
      "winlogbeat"
    ],
    "agent.ephemeral_id.keyword": [
      "d57de21f-31a3-409b-8def-8b5d330b5c94"
    ],
    "source.domain.keyword": [
      "WS293"
    ],
    "winlog.event_data.TargetLogonId.keyword": [
      "0x4cb9c48c"
    ],
    "agent.name.keyword": [
      "WS293"
    ],
    "winlog.logon.type": [
      "Unlock"
    ],
    "process.executable.keyword": [
      "C:\\Windows\\System32\\lsass.exe"
    ],
    "winlog.event_data.LogonProcessName": [
      "Negotiat"
    ],
    "winlog.event_data.ElevatedToken.keyword": [
      "%%1843"
    ],
    "winlog.event_data.TargetLinkedLogonId.keyword": [
      "0x0"
    ],
    "event.action": [
      "logged-in"
    ],
    "@timestamp": [
      "2023-12-30T22:28:01.907Z"
    ],
    "winlog.event_data.LogonType": [
      "7"
    ],
    "winlog.channel": [
      "Security"
    ],
    "host.os.platform": [
      "windows"
    ],
    "winlog.event_data.TargetDomainName": [
      "mydomain"
    ],
    "winlog.opcode": [
      "инфо"
    ],
    "agent.ephemeral_id": [
      "d57de21f-31a3-409b-8def-8b5d330b5c94"
    ],
    "winlog.event_data.KeyLength.keyword": [
      "0"
    ],
    "winlog.event_data.SubjectDomainName": [
      "mydomain"
    ],
    "winlog.event_id.keyword": [
      "4624"
    ],
    "winlog.event_data.SubjectLogonId.keyword": [
      "0x3e7"
    ],
    "host.architecture.keyword": [
      "x86_64"
    ],
    "winlog.logon.type.keyword": [
      "Unlock"
    ],
    "event.category.keyword": [
      "authentication"
    ],
    "winlog.provider_name": [
      "Microsoft-Windows-Security-Auditing"
    ],
    "winlog.provider_guid": [
      "{54849625-5478-4994-a5ba-3e3b0328c30d}"
    ],
    "host.os.build.keyword": [
      "19045.3803"
    ],
    "winlog.event_data.SubjectUserName.keyword": [
      "WS293$"
    ],
    "process.pid": [
      784
    ],
    "event.code.keyword": [
      "4624"
    ],
    "winlog.computer_name": [
      "WS293.mydomain.local"
    ],
    "user.id.keyword": [
      "S-1-5-21-3268738738-942520571-1760952555-3835"
    ],
    "winlog.event_data.TargetUserSid.keyword": [
      "S-1-5-21-3268738738-942520571-1760952555-3835"
    ],
    "agent.hostname.keyword": [
      "WS293"
    ],
    "ecs.version.keyword": [
      "1.11.0"
    ],
    "host.ip.keyword": [
      "1.2.3.4"
    ],
    "winlog.keywords": [
      "Аудит успеха"
    ],
    "winlog.record_id": [
      4436568
    ],
    "winlog.keywords.keyword": [
      "Аудит успеха"
    ],
    "winlog.event_data.TargetUserName.keyword": [
      "user.name"
    ],
    "winlog.event_data.VirtualAccount": [
      "%%1843"
    ],
    "event.kind.keyword": [
      "event"
    ],
    "host.os.name": [
      "Windows 10 Pro"
    ],
    "log.level": [
      "сведения"
    ],
    "event.action.keyword": [
      "logged-in"
    ],
    "host.id.keyword": [
      "fc6563a9-a963-44cc-93fa-5b4fc6c46fda"
    ],
    "host.name": [
      "WS293.mydomain.local"
    ],
    "event.kind": [
      "event"
    ],
    "host.os.version.keyword": [
      "10.0"
    ],
    "winlog.version": [
      2
    ],
    "winlog.event_data.TargetUserName": [
      "user.name"
    ],
    "winlog.event_data.IpPort": [
      "-"
    ],
    "winlog.event_data.SubjectDomainName.keyword": [
      "mydomain"
    ],
    "@version.keyword": [
      "1"
    ],
    "process.name": [
      "lsass.exe"
    ],
    "process.name.keyword": [
      "lsass.exe"
    ],
    "ecs.version": [
      "1.11.0"
    ],
    "winlog.event_data.LmPackageName": [
      "-"
    ],
    "event.created": [
      "2023-12-30T22:28:03.684Z"
    ],
    "host.hostname.keyword": [
      "WS293"
    ],
    "event.module.keyword": [
      "security"
    ],
    "agent.version": [
      "7.15.1"
    ],
    "winlog.event_data.SubjectUserSid.keyword": [
      "S-1-5-18"
    ],
    "host.os.family": [
      "windows"
    ],
    "user.domain.keyword": [
      "mydomain"
    ],
    "log.level.keyword": [
      "info"
    ],
    "winlog.computer_name.keyword": [
      "WS293.mydomain.local"
    ],
    "winlog.event_data.TargetOutboundUserName": [
      "-"
    ],
    "host.os.build": [
      "19045.3803"
    ],
    "event.module": [
      "security"
    ],
    "host.os.kernel": [
      "10.0.19041.3803 (WinBuild.160101.0800)"
    ],
    "@version": [
      "1"
    ],
    "host.os.name.keyword": [
      "Windows 10 Pro"
    ],
    "winlog.event_data.IpPort.keyword": [
      "-"
    ],
    "winlog.provider_guid.keyword": [
      "{54849625-5478-4994-a5ba-3e3b0328c30d}"
    ],
    "process.executable": [
      "C:\\Windows\\System32\\lsass.exe"
    ],
    "winlog.event_data.TargetOutboundDomainName.keyword": [
      "-"
    ],
    "winlog.task": [
      "Logon"
    ],
    "winlog.task.keyword": [
      "Logon"
    ],
    "winlog.event_data.ImpersonationLevel.keyword": [
      "%%1833"
    ],
    "winlog.event_data.AuthenticationPackageName.keyword": [
      "Negotiate"
    ],
    "host.mac.keyword": [
      "7a:4b:de:cf:48:a0"
    ],
    "winlog.event_data.SubjectUserName": [
      "WS293$"
    ],
    "winlog.event_data.VirtualAccount.keyword": [
      "%%1843"
    ],
    "message": [
      "confidential information"
    ],
    "winlog.event_data.TargetOutboundDomainName": [
      "-"
    ],
    "winlog.logon.id.keyword": [
      "0x4cb9c48c"
    ],
    "winlog.event_id": [
      "4624"
    ],
    "winlog.channel.keyword": [
      "Security"
    ],
    "host.os.family.keyword": [
      "windows"
    ],
    "host.os.type.keyword": [
      "windows"
    ],
    "winlog.event_data.IpAddress.keyword": [
      "-"
    ],
    "host.os.platform.keyword": [
      "windows"
    ],
    "event.type": [
      "start"
    ],
    "winlog.opcode.keyword": [
      "Сведения"
    ],
    "user.name.keyword": [
      "user.name"
    ],
    "related.user.keyword": [
      "user.name",
      "WS293$"
    ]
  }
}

Log from IRIS:

...................................
{"log":"server=10.6.10.60//socket.io/ client=172.19.0.3:47022 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:45090 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:36892 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:46568 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:50258 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:36926 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:37388 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:48420 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:33452 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:54092 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:56046 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:47118 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:33180 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:33610 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:53158 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:56676 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:60096 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:40224 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:43904 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:51682 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:49416 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:49740 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:50208 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:50630 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:51064 socket shutdown error: [Errno 9] Bad file descriptor2023-12-30 22:06:56 :: INFO :: module_handler :: call_modules_hook :: Calling module iris_check_module asynchronously for hook on_postload_alert_create :: None\n","stream":"stderr","time":"2023-12-30T22:06:56.915019014Z"}
{"log":"2023-12-30 22:06:56 :: INFO :: tracker :: track_activity :: administrator [#1] :: Case None :: Created alert #25 - userlogon (iris)\n","stream":"stderr","time":"2023-12-30T22:06:56.925155889Z"}
...................................

And result in IRIS:

hostname:
domain:
ip:
user:
timestamp:
message: *confidential information*
log: *confidential information*
tags: 0: winws
      1: beats_input_codec_plain_applied

The problem is the same...
In TheHive and Telegram fields are transferred correctly.

Areopagit · 2023-12-30T10:37:26Z

Areopagit
Dec 30, 2023
Author

Sorry to bother you, I also found that IOCs about IP-address are not working (marked #):

iris_iocs:
  - ioc_value: host.hostname
    ioc_description: Hostname
    ioc_tlp_id: 2
    ioc_type_id: 3
    ioc_tags: hostname
  - ioc_value: user.domain
    ioc_description: Domain
    ioc_tlp_id: 2
    ioc_type_id: 20
    ioc_tags: domain
#  - ioc_value: host.ip
#    ioc_description: Destination ip
#    ioc_tlp_id: 2
#    ioc_type_id: 77
#    ioc_tags: dst_ip
#  - ioc_value: source.ip
#    ioc_description: Source ip
#    ioc_tlp_id: 2
#    ioc_type_id: 79
#    ioc_tags: src_ip
  - ioc_value: winlog.event_data.TargetUserName
    ioc_description: User
    ioc_tlp_id: 2
    ioc_type_id: 3
    ioc_tags: user
  - ioc_value: event.created
    ioc_description: Timestamp
    ioc_tlp_id: 2
    ioc_type_id: 16
    ioc_tags: timestamp

More precisely, when using them, the alert is not sent at all with error 400. I didn't find anything about this error in the documentation.
I tried changing "ioc_type_id" and others parameters of these IOCs - always error 400.
That's why I've commented them out so far temporarily.

3 replies

malinkinsa Dec 30, 2023

You can always find a more detailed error in the IRIS log. In your case, it's likely a mismatch between the IOC type and the incoming data. Try setting the value ioc_type_id for both to 76 if there are just IP addresses there

Areopagit Dec 30, 2023
Author

Set it on 76. The problem is the same...

Log from IRIS:

{"log":"server=10.6.10.60//socket.io/ client=172.19.0.3:48218 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:58848 socket shutdown error: [Errno 9] Bad file descriptorserver=10.6.10.60//socket.io/ client=172.19.0.3:44700 socket shutdown error: [Errno 9] Bad file descriptor2023-12-30 23:04:02 :: ERROR :: alerts_routes :: alerts_add_route :: {2: {'ioc_value': ['Not a valid string.']}}\n","stream":"stderr","time":"2023-12-30T23:04:02.526471842Z"}
{"log":"Traceback (most recent call last):\n","stream":"stderr","time":"2023-12-30T23:04:02.526516025Z"}
{"log":"  File \"/iriswebapp/app/blueprints/alerts/alerts_routes.py\", line 176, in alerts_add_route\n","stream":"stderr","time":"2023-12-30T23:04:02.526521562Z"}
{"log":"    iocs = ioc_schema.load(iocs_list, many=True)\n","stream":"stderr","time":"2023-12-30T23:04:02.526526222Z"}
{"log":"  File \"/opt/venv/lib/python3.9/site-packages/marshmallow_sqlalchemy/load_instance_mixin.py\", line 96, in load\n","stream":"stderr","time":"2023-12-30T23:04:02.526543969Z"}
{"log":"    return super().load(data, **kwargs)\n","stream":"stderr","time":"2023-12-30T23:04:02.526548487Z"}
{"log":"  File \"/opt/venv/lib/python3.9/site-packages/marshmallow/schema.py\", line 719, in load\n","stream":"stderr","time":"2023-12-30T23:04:02.526552628Z"}
{"log":"    return self._do_load(\n","stream":"stderr","time":"2023-12-30T23:04:02.526556961Z"}
{"log":"  File \"/opt/venv/lib/python3.9/site-packages/marshmallow/schema.py\", line 904, in _do_load\n","stream":"stderr","time":"2023-12-30T23:04:02.526561174Z"}
{"log":"    raise exc\n","stream":"stderr","time":"2023-12-30T23:04:02.526565474Z"}
{"log":"marshmallow.exceptions.ValidationError: {2: {'ioc_value': ['Not a valid string.']}}\n","stream":"stderr","time":"2023-12-30T23:04:02.52656971Z"}

My type of "host.ip" and "source.ip" in kibana - "text" and "keyword" (automapping).
But there are no problems with this in either TheHive or Telegram, only in IRIS.

malinkinsa Jan 6, 2024

I've successfully replicated it. I'll consider the best way to implement the changes.

malinkinsa · 2024-01-08T13:59:04Z

malinkinsa
Jan 8, 2024

@Areopagit hello.
There was an issue with nested JSON within the document. To fix it, I borrowed the approach used in TheHive's alerter. I checked both options - couldn't replicate the problem after the fix. Also expanded the tests.

Regarding IOC and IPs, the problem lies in the fact that your IP data is formatted as a list [] and therefore doesn't pass the IRIS validator. Ideally, you should parse it into a separate field and request that.

@jertel
PR ready, any feedback is welcome.

1 reply

Areopagit Jan 9, 2024
Author

@malinkinsa, Hi!
Yes, the docker build "latest" works correctly. All fields are transmitted in "Context".
I understood about IOCs, I will additionally parse the logs.

Many thanks to all those who responded!!!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

IRIS alert context does not work correctly #1348

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 5 comments 10 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

IRIS alert context does not work correctly #1348

Replies: 5 comments · 10 replies

jertel Dec 28, 2023 Maintainer

Areopagit Dec 28, 2023 Author

Areopagit Dec 29, 2023 Author

Areopagit Dec 30, 2023 Author

Areopagit Dec 30, 2023 Author

Areopagit Dec 30, 2023 Author

Areopagit Jan 9, 2024 Author

Replies: 5 comments 10 replies

jertel
Dec 28, 2023
Maintainer

Areopagit Dec 28, 2023
Author

Areopagit
Dec 29, 2023
Author

Areopagit Dec 30, 2023
Author

Areopagit
Dec 30, 2023
Author

Areopagit Dec 30, 2023
Author

Areopagit Jan 9, 2024
Author