# This is the folder that contains the rule yaml files
# This can also be a list of directories
# Any .yaml file will be loaded as a rule
rules_folder: /opt/elastalert/rules

# How often ElastAlert will query Elasticsearch
# The unit can be anything from weeks to seconds
run_every:
  minutes: 1

# ElastAlert will buffer results from the most recent
# period of time, in case some log sources are not in real time
buffer_time:
  minutes: 15

# The Elasticsearch hostname for metadata writeback
# Note that every rule can have its own Elasticsearch host
es_host: 192.168.2.71

# The Elasticsearch port
es_port: 9200

# The AWS region to use. Set this when using AWS-managed elasticsearch
#aws_region: us-east-1

# The AWS profile to use. Use this if you are using an aws-cli profile.
# See http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
# for details
#profile: test

# Optional URL prefix for Elasticsearch
#es_url_prefix: elasticsearch

# Optional prefix for statsd metrics
#statsd_instance_tag: elastalert

# Optional statsd host
#statsd_host: dogstatsd

# Connect with TLS to Elasticsearch
use_ssl: True

# Verify TLS certificates
verify_certs: True

# Show TLS or certificate related warnings
ssl_show_warn: True

# GET request with body is the default option for Elasticsearch.
# If it fails for some reason, you can pass 'GET', 'POST' or 'source'.
# See https://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport
# for details
#es_send_get_body_as: GET

# Option basic-auth username and password for Elasticsearch
es_username: elastic
es_password: 4RQwIyVNCBznV4zXGDhX

# Use SSL authentication with client certificates client_cert must be
# a pem file containing both cert and key for client
ca_certs: /opt/elastalert/certs/ca.crt
#client_cert: /etc/elasticsearch/certs/elasticsearch.crt
#client_key: /etc/elasticsearch/certs/elasticsearch.key

# The index on es_host which is used for metadata storage
# This can be a unmapped index, but it is recommended that you run
# elastalert-create-index to set a mapping
writeback_index: elastalert_status

# If an alert fails for some reason, ElastAlert will retry
# sending the alert until this time period has elapsed
alert_time_limit:
  days: 1

name: "Shannon-Alert-Test"
type: "frequency"
index: "wazuh-*"
is_enabled: true
buffer_time: # 查詢 elasticsearch 的時間區間
  minutes: 5

# 5分鐘內相同的報警不會重複發送
realert:
  minutes: 1
terms_size: 50 # 每個查詢返回的最大數量 default 50

# 頻率觸發設定
# 當 48 小時內，滿足 authorization 
num_events: 1 # 將觸發警報的事件數量（含）
timeframe: # 在 timeframe 時間內內必須發生 num_events 次數
  hours: 64
timestamp_field: "@timestamp"
timestamp_type: "iso"
use_strftime_index: false # 

# 警告訊息
alert_subject: "Alert! {0} ! AgentID: {1} in time ({2})"
alert_subject_args:
  - "rule.groups"
  - "agent.id"
  - "@timestamp"
alert_text: "主要原因: {0}"
alert_text_args:
  - "full_log"

# 用於查找事件的 Elasticsearch 過濾器列表
filter:
  - query:
      query_string:
        query: "@timestamp:*"
  - query:
      wildcard:
        rule.groups: "*authentication_fail*"

# 透過什麼方式進行通知
alert:
  - "slack"
slack_webhook_url: 'https://hooks.slack.com/services/xxxxx' # 請使用你自己的 webhook url 
slack_msg_color: "warning"
slack_parse_override: "none"

version: '3.4'
services:
  elastalert:
    container_name: elastalert2
    image: jertel/elastalert2
    volumes:
      - /opt/elastalert/config/config.yaml:/opt/elastalert/config.yaml
      - /opt/elastalert/rules:/opt/elastalert/rules
      - /opt/elastalert/certs:/opt/elastalert/certs
    command: --verbose
    restart: always
    networks:
      - es_default
    ports:
      - "3030:3030"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3030"]
      interval: 30s
      timeout: 15s
      retries: 3
      start_period: 40s

networks:
  es_default:
    external: true