/es-rules-monitor

Monitoring script to be alerted (by email) when rules failed to execute on Elastic SIEM

Primary LanguageJavaScriptMIT LicenseMIT

Elastic SIEM - Rules monitoring

Get alerted by email when rules failed to execute.

How it works

  1. Fetch Elastic SIEM rules via the Kibana Api
  2. For each rule, check if there is a failure since the last check
  3. Group failures in a human readable table (HTML)
  4. Send email
  5. Repeat each XX seconds

Usage

No need of cron jobs, this script includes a scheduler.

Docker

Edit docker-compose.yml and fill the environment variables with your settings.

docker-compose up --build

NodeJS

Edit .env and fill the environment variables with your settings. Or directly pass the environment variable when you execute the script.

npm run start

OR

node index.js

Configuration

name description type required default
KIBANA_URL URL of Kibana instance String No http://localhost:5601
SCHEDULE_SECOND Time (in seconds) between each checks Integer No 600
MAILER_HOST Mail server address String Yes -
MAILER_PORT Mail server port Integer Yes -
MAILER_SECURE Mail server secure communication Boolean No false
MAILER_USER Mail server username String Yes -
MAILER_PASS Mail server password String Yes -
MAILER_FROM Address used as "from" String Yes -
MAILER_TO Addresses that will receives alerts (separated by comma) String Yes -
MAILER_SUBJECT Mail subject String No [Elastic SIEM] Rules monitoring