Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The organisation where I work makes extensive use of the integration between TheHive and ElastAlert, and we have noticed several issues with the current alerter. These are:
customFields
alert_text
I have refactored the alerter extensively and am opening this PR to propose integrating the refactored alerter upstream.
As part of this change I have:
alert
function into several smaller functions that are easier to reason aboutThis is a breaking change, and some TheHive rules already written will need (minor) refactoring to continue working. Wherever possible, I have attempted to minimise such changes. I do believe that the refactored alerter will be easier to work with over the long-term than the previous version.
The refactored alerter has been tested in a local environment against multiple rule types.