Sensor name does not show up when Filebeat is used to process events.

[kamandohl]

I have scored the closed and open issues without any luck. Releated to Issue #76 , but I am not using SELKS. My set-up

Suricata 4.1 --> Filebeat (not the module) reading from eve.json --> Kafka (no transforms) --> Logstash ( adding GeoIP ) --> ES 6.4 <-- Evebox version 0.10.1

Events are showing up in the "Events" Tab. The GeoIP even shows. I have loaded the latest ET ruleset and pointing to it in the yaml to the correct path. /etc/evebox/rules/*.rules Permissions are for evebox:evebox

The rules do not show up in the Alert.
The Sensor Field all say [object Object]

Here is my config yaml Pastebin

Thanks in Advanced.

[jasonish]

Your index is listed as custom. Can you tell me how it differs from a default Logstash template? It could be breaking the aggregations needed for the Inbox/Alert views.

Also, what is adding the "host" field? When Suricata adds it, its a simple string. Can you provide the JSON from an alert?

[kamandohl]

Here is the JSON from an Alert within Elasticsearch.

I will verify the template.

[jasonish]

That pastebin is private. If you can, share it to "jasonish" on pastebin.

[kamandohl]

I made it public. I did not see a way to share to a person. Thanks

[jasonish]

Looks like Logstash or Filebeat is adding "host" as an object which is different than if Suricata added it, in which case it would simply be a string. I'll have to figure out exactly whats adding it.

But this shouldn't affect the inbox/alert view. That is probably more due to a template issue. You should be able to extract it like:

curl http://hostname:9200/nsm-2019.01.28/_mapping

If you haven't, you may want to try the latest development version as well.

[kamandohl]

Here is the mapping. Sorry about the format, I tried to make it "pretty" but for whatever reason, could not.

Mapping

[elhijo]

Hi,
any updates about the [object Object] issue ?
Not a very big deal but it would be nice to have the right value here.
Thanks

[kamandohl]

Nothing yet, I have had to back burner this to get some other things online. Still my top priority.

[jasonish]

Not a very big deal but it would be nice to have the right value here.

Are you using Filebeat and Logstash as well?

What I'll probably end up doing is adding a check in the UI to see if hostname is a string or an object and displaying it properly. Unfortunately if you ever want to search by hostname, you'll have to enter the correct search key yourself.

[jasonish]

So it looks like filebeat overwrites the "host" string field added by Suricata with its own "host" object. Will fix in the UI.

[elhijo]

Yes Filebeat AND logstash.

Will fix in the UI.

Great, thanks !

[jasonish]

This is now fixed in the latest development builds. You will lose the "host" field as added by Suricata as Filebeat is overwriting it.

@kamandohl I updated this issue to only cover the sensor name issue. If you had other issues, please create a new issue.