Add max_timer about thehive_sla_monitor HOT 11 CLOSED

On Mon, Feb 8, 2021 at 12:32 PM devatnull ***@***.***> wrote: Hello Joshua, When will this be available? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJRBWDUHLOUPWMM2UEP2ZWLS564T7ANCNFSM4XBTEIZA> .

On Mon, 15 Feb 2021, 19:32 Joshua Smeda, ***@***.***> wrote: Is your alert being passed, perhaps a high risk alert? On Mon, 15 Feb 2021, 18:45 devatnull, ***@***.***> wrote: > Max timer on normal alerts work, but the max_timer doesn't work on high > risk word search. It will parse every alert when doing a high risk search. > > SLA_SETTINGS = { > 'THEHIVE_LEVEL3': {'ENABLED': True, > 'LOW_SEVERITY': {'TIMER': 1800, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'MEDIUM_SEVERITY': {'TIMER': 2700, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'HIGH_SEVERITY': {'TIMER': 60, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'HIGH_RISK': {'NOTIFICATION_METHOD': ['TWILIO_SMS']}}, > > 'THEHIVE_LEVEL2': {'ENABLED': False, > 'LOW_SEVERITY': {'TIMER': 1800, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'MEDIUM_SEVERITY': {'TIMER': 2700, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'HIGH_SEVERITY': {'TIMER': 3600, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'HIGH_RISK': {'NOTIFICATION_METHOD': ['TWILIO_SMS']}}, > > 'THEHIVE_LEVEL1': {'ENABLED': False, > 'LOW_SEVERITY': {'TIMER': 1800, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'MEDIUM_SEVERITY': {'TIMER': 2700, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'HIGH_SEVERITY': {'TIMER': 3600, 'NOTIFICATION_METHOD': ['TWILIO_SMS']}, > 'HIGH_RISK': {'NOTIFICATION_METHOD': ['TWILIO_SMS']}} > } > > SYSTEM_SETTINGS = { > 'HIGH_RISK_WORDS': ['SUBAT','Root FS'], > 'HIGH_RISK_WORDS_SEVERITY_LEVEL': 2, > 'LOOP_TIME': 140, > 'MAX_ALERT_DETECTION_ENABLED': True, > 'MAX_ALERT_DETECTION_AGE': 120, > 'HIVE_SERVER_IP': '192.168.122.30', > 'HIVE_SERVER_PORT': 9000, > 'HIVE_FQDN': 'http://192.168.122.30', > 'HIVE_API_KEY': '***********************************', > 'LOG_FILE_LOCATION': 'debug.log' > } > > FLASK_SETTINGS = { > 'ENABLE_WEBSERVER': True, > 'FLASK_WEBSERVER_IP': 'localhost', > 'FLASK_WEBSERVER_PORT': 3002 > } > > TWILIO_SETTINGS = { > 'TWILIO_ENABLED': True, > 'TWILIO_SENDER': '*****************', > 'TWILIO_RTCP': ['*************'], > 'ACCOUNT_SID': '*******************************', > 'AUTH_TOKEN': '************************', > 'TWIMLET_URL': '' > } > > SLACK_SETTINGS = { > 'SLACK_ENABLED': False, > 'SLACK_APP_TOKEN': '', > 'SLACK_CHANNEL': '', > 'SLACK_WEBHOOK_URL': '' > } > > My configuration is below > > — > You are receiving this because you were assigned. > Reply to this email directly, view it on GitHub > < #14 (comment) >, > or unsubscribe > < https://github.com/notifications/unsubscribe-auth/AJRBWDTXOU27SSKC45VHOX3S7FFSRANCNFSM4XBTEIZA > > . > — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJRBWDWVQQWGSTN2XWFG323S7FLBDANCNFSM4XBTEIZA> .

On Wed, 17 Feb 2021, 17:23 devatnull, ***@***.***> wrote: Hello, High risk alerts work fine. But there is a problem with parsing severity 3 alerts, my config on above still the same, I can't seem to query on severity 3 for timer:60. — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#14 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJRBWDWX34AJFESM4XY4RQTS7PNOVANCNFSM4XBTEIZA> .