Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
New DHCP Client Detected on Network - Elasticsearch Alerting Watch
POST _xpack/watcher/watch/packetbeat-dhcpv4-nak-decline
{
"metadata": {
"window_period": "1m",
"index_pattern": "packetbeat-*"
},
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"indices": [
"packetbeat-*"
],
"body": {
"query": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.window_period}}"
}
}
},
{
"terms": {
"type": [
"dhcpv4"
]
}
},
{
"terms": {
"dhcpv4.option.message_type": [
"decline",
"nak"
]
}
}
]
}
},
"aggs": {
"client_macs": {
"terms": {
"field": "dhcpv4.client_mac",
"size": 1000
},
"aggs": {
"hostname": {
"terms": {
"field": "dhcpv4.option.hostname",
"size": 1000
}
},
"class_identifier": {
"terms": {
"field": "dhcpv4.option.class_identifier",
"size": 1000
}
}
}
}
},
"size": 0
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"log": {
"logging": {
"text": "executed at {{ctx.execution_time}}"
}
},
"notify-slack": {
"slack": {
"account": "monitoring",
"message": {
"from": "Packetbeat",
"text": "DHCP NAK/Decline Detected",
"attachments": [
{
"title": "Errors Found",
"text": "Encountered {{ctx.payload.hits.total}} event(s) in the last {{ctx.metadata.window_period}}. See <https://kibana:5601/app/kibana#/dashboard/a7b35890-8baa-11e8-9676-ef67484126fb?_a=(query:(language:lucene,query:'dhcpv4.option.message_type:nak OR dhcpv4.option.message_type:decline'))|DHCP Dashboard>.",
"color": "warning"
}
]
}
}
}
}
}
POST _xpack/watcher/watch/packetbeat-dhcpv4-new-client-mac
{
"metadata": {
"window_period": "1m",
"index_pattern": "packetbeat-*"
},
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"chain": {
"inputs": [
{
"dhcpv4_clients": {
"search": {
"request": {
"indices": [
"packetbeat-*"
],
"body": {
"query": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.window_period}}"
}
}
},
{
"term": {
"type": {
"value": "dhcpv4"
}
}
}
]
}
},
"aggs": {
"client_macs": {
"terms": {
"field": "dhcpv4.client_mac",
"size": 1000
},
"aggs": {
"hostname": {
"terms": {
"field": "dhcpv4.option.hostname",
"size": 1000
}
},
"class_identifier": {
"terms": {
"field": "dhcpv4.option.class_identifier",
"size": 1000
}
}
}
}
},
"size": 0
}
}
}
}
},
{
"history_dhcpv4_clients": {
"search": {
"request": {
"indices": [
"packetbeat-*"
],
"body": {
"query": {
"bool": {
"must": [
{
"terms": {
"dhcpv4.client_mac": [
"{{#ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets}}{{key}}",
"{{/ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets}}"
]
}
},
{
"range": {
"@timestamp": {
"lt": "now-{{ctx.metadata.window_period}}"
}
}
},
{
"term": {
"type": {
"value": "dhcpv4"
}
}
}
]
}
},
"aggs": {
"client_macs": {
"terms": {
"field": "dhcpv4.client_mac",
"size": 10
}
}
},
"size": 0
}
}
}
}
}
]
}
},
"condition": {
"script": {
"source": """
def history=ctx.payload.history_dhcpv4_clients.aggregations.client_macs.buckets.stream().map(p -> p.key).collect(Collectors.toList());
def new_starts=ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets.stream().map(e -> e.key).filter(p -> !history.contains(p)).collect(Collectors.toList());
return new_starts.size() > 0;
"""
}
},
"transform": {
"script": {
"source": """
def history=ctx.payload.history_dhcpv4_clients.aggregations.client_macs.buckets.stream().map(p -> p.key).collect(Collectors.toList());
def new_starts=ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets.stream().map(e -> e.key).filter(p -> !history.contains(p));
return new_starts.map(p -> ["mac": p]).collect(Collectors.toList());
"""
}
},
"actions": {
"notify-slack": {
"slack": {
"account": "monitoring",
"message": {
"from": "Packetbeat",
"text": "New DHCP clients detected on network.",
"dynamic_attachments": {
"list_path": "ctx.payload._value",
"attachment_template": {
"color": "warning",
"title": "MAC",
"text": "<https://kibana:5601/app/kibana#/dashboard/a7b35890-8baa-11e8-9676-ef67484126fb?_a=(query:(language:lucene,query:'dhcpv4.client_mac:%22{{mac}}%22'))|{{mac}}>"
}
}
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment