Merge pull request #1334 from malinkinsa/issue-in-iris-docs

Fix issue in IRIS docs and alerter required options

CHANGELOG.md

@@ -15,6 +15,8 @@
 - Support hourly index patterns - [#1328](https://github.com/jertel/elastalert2/pull/1328) - @jmacdone
 - Correction in IRIS and GELF alerter [#1331](https://github.com/jertel/elastalert2/pull/1331) - @malinkinsa
 - [Docs] Fix broken search function caused by sphinx upgrade a few releases ago - [#1332](https://github.com/jertel/elastalert2/pull/1332) - @jertel
+- [Docs] Fix mismatch for parameter iris_customer_id - [1334](https://github.com/jertel/elastalert2/pull/1334) @malinkinsa
+- [IRIS] Make parameter iris_customer_id optional with default value - [1334](https://github.com/jertel/elastalert2/pull/1334) @malinkinsa
 
 # 2.15.0
 

docs/source/ruletypes.rst

@@ -2723,10 +2723,10 @@ The alerter requires the following option:
 
 ``iris_api_token``: The API key of the user you created, which will be used to initiate alerts and cases on behalf of this user.
 
-``iris_customer_id``: The user ID associated with the API key mentioned above. You can find it on the same page where the API key is located.
-
 Optional:
 
+``iris_customer_id``: This field represents the unique identifier of the customer for whom an incident/case will be created within the system. Configure and view the existing options in the section ``Advanced -> Customers`` of your IRIS instance. The default value is: ``1``
+
 ``iris_ca_cert``: Set this option to True or a path to a CA cert bundle or directory (eg: /etc/ssl/certs/ca-certificates.crt) to validate the SSL certificate.The default value is: False.
 
 ``iris_ignore_ssl_errors``: Ignore ssl error. The default value is: ``False``.

elastalert/alerters/iris.py

@@ -9,13 +9,13 @@
 
 
 class IrisAlerter(Alerter):
- required_options = set(['iris_host', 'iris_api_token', 'iris_customer_id'])
+ required_options = set(['iris_host', 'iris_api_token'])
 
  def __init__(self, rule):
  super(IrisAlerter, self).__init__(rule)
  self.url = f"https://{self.rule.get('iris_host')}"
  self.api_token = self.rule.get('iris_api_token')
- self.customer_id = self.rule.get('iris_customer_id')
+ self.customer_id = self.rule.get('iris_customer_id', 1)
  self.ca_cert = self.rule.get('iris_ca_cert')
  self.ignore_ssl_errors = self.rule.get('iris_ignore_ssl_errors', False)
  self.description = self.rule.get('iris_description', None)

tests/alerters/iris_test.py

@@ -326,7 +326,6 @@ def test_iris_alert_alert(caplog):
  'type': 'any',
  'iris_host': '127.0.0.1',
  'iris_api_token': 'token 12345',
- 'iris_customer_id': 1,
  'iris_description': 'test description in alert',
  'iris_alert_note': 'test note',
  'iris_alert_tags': 'test, alert',
@@ -413,6 +412,100 @@ def test_iris_alert_alert(caplog):
  assert ('elastalert', logging.INFO, 'Alert sent to Iris') == caplog.record_tuples[0]
 
 
+def test_iris_alert_alert_with_custom_customer_id(caplog):
+ caplog.set_level(logging.INFO)
+ rule = {
+ 'name': 'Test Main',
+ 'type': 'any',
+ 'iris_host': '127.0.0.1',
+ 'iris_api_token': 'token 12345',
+ 'iris_customer_id': 2,
+ 'iris_description': 'test description in alert',
+ 'iris_alert_note': 'test note',
+ 'iris_alert_tags': 'test, alert',
+ 'iris_overwrite_timestamp': True,
+ 'iris_alert_source_link': 'https://example.com',
+ 'iris_iocs': [
+ {
+ 'ioc_description': 'source address',
+ 'ioc_tags': 'ip, ipv4',
+ 'ioc_tlp_id': 1,
+ 'ioc_type_id': 76,
+ 'ioc_value': 'src_ip'
+ },
+ {
+ 'ioc_description': 'target username',
+ 'ioc_tags': 'login, username',
+ 'ioc_tlp_id': 3,
+ 'ioc_type_id': 3,
+ 'ioc_value': 'username'
+ }
+ ],
+ 'iris_alert_context': {'username': 'username', 'ip': 'src_ip', 'login_status': 'event_status'},
+ 'alert': [],
+ }
+
+ rules_loader = FileRulesLoader({})
+ rules_loader.load_modules(rule)
+ alert = IrisAlerter(rule)
+
+ match = {
+ '@timestamp': '2023-10-21 20:00:00.000', 'username': 'evil_user', 'src_ip': '172.20.1.1', 'dst_ip': '10.0.0.1',
+ 'event_type': 'login', 'event_status': 'success'
+ }
+
+ expected_data = {
+ "alert_title": 'Test Main',
+ "alert_description": 'test description in alert',
+ "alert_source": "ElastAlert2",
+ "alert_severity_id": 1,
+ "alert_status_id": 2,
+ "alert_source_event_time": '2023-10-21 20:00:00.000',
+ "alert_note": 'test note',
+ "alert_tags": 'test, alert',
+ "alert_customer_id": 2,
+ "alert_source_link": 'https://example.com',
+ "alert_iocs": [
+ {
+ 'ioc_description': 'source address',
+ 'ioc_tags': 'ip, ipv4',
+ 'ioc_tlp_id': 1,
+ 'ioc_type_id': 76,
+ 'ioc_value': '172.20.1.1'
+ },
+ {
+ 'ioc_description': 'target username',
+ 'ioc_tags': 'login, username',
+ 'ioc_tlp_id': 3,
+ 'ioc_type_id': 3,
+ 'ioc_value': 'evil_user'
+ }
+ ],
+ "alert_context": {
+ 'username': 'evil_user',
+ 'ip': '172.20.1.1',
+ 'login_status': 'success'
+ },
+ }
+ mock_response = mock.Mock()
+ mock_response.status_code = 200
+ with mock.patch('requests.post', return_value=mock_response) as mock_post_request:
+ alert.alert([match])
+
+ mock_post_request.assert_called_once_with(
+ url=f'https://{rule["iris_host"]}/alerts/add',
+ headers={
+ 'Content-Type': 'application/json',
+ 'Authorization': f'Bearer {rule["iris_api_token"]}'
+ },
+ json=mock.ANY,
+ verify=True,
+ )
+
+ assert expected_data == mock_post_request.call_args_list[0][1]['json']
+ assert ('elastalert', logging.INFO, 'Alert sent to Iris') == caplog.record_tuples[0]
+
+
 def test_iris_get_info(caplog):
  caplog.set_level(logging.INFO)
  rule = {