New DHCP Client Detected on Network - Elasticsearch Alerting Watch

packetbeat-dhcpv4-nak-decline.json

POST _xpack/watcher/watch/packetbeat-dhcpv4-nak-decline
{
  "metadata": {
    "window_period": "1m",
    "index_pattern": "packetbeat-*"
  },
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": [
          "packetbeat-*"
        ],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-{{ctx.metadata.window_period}}"
                    }
                  }
                },
                {
                  "terms": {
                    "type": [
                      "dhcpv4"
                    ]
                  }
                },
                {
                  "terms": {
                    "dhcpv4.option.message_type": [
                      "decline",
                      "nak"
                    ]
                  }
                }
              ]
            }
          },
          "aggs": {
            "client_macs": {
              "terms": {
                "field": "dhcpv4.client_mac",
                "size": 1000
              },
              "aggs": {
                "hostname": {
                  "terms": {
                    "field": "dhcpv4.option.hostname",
                    "size": 1000
                  }
                },
                "class_identifier": {
                  "terms": {
                    "field": "dhcpv4.option.class_identifier",
                    "size": 1000
                  }
                }
              }
            }
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "log": {
      "logging": {
        "text": "executed at {{ctx.execution_time}}"
      }
    },
    "notify-slack": {
      "slack": {
        "account": "monitoring",
        "message": {
          "from": "Packetbeat",
          "text": "DHCP NAK/Decline Detected",
          "attachments": [
            {
              "title": "Errors Found",
              "text": "Encountered {{ctx.payload.hits.total}} event(s) in the last {{ctx.metadata.window_period}}. See <https://kibana:5601/app/kibana#/dashboard/a7b35890-8baa-11e8-9676-ef67484126fb?_a=(query:(language:lucene,query:'dhcpv4.option.message_type:nak OR dhcpv4.option.message_type:decline'))|DHCP Dashboard>.",
              "color": "warning"
            }
          ]
        }
      }
    }
  }
}

packetbeat-new-dhcp-client-detected.json

POST _xpack/watcher/watch/packetbeat-dhcpv4-new-client-mac
{
    "metadata": {
      "window_period": "1m",
      "index_pattern": "packetbeat-*"
    },
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "chain": {
        "inputs": [
          {
            "dhcpv4_clients": {
              "search": {
                "request": {
                  "indices": [
                    "packetbeat-*"
                  ],
                  "body": {
                    "query": {
                      "bool": {
                        "must": [
                          {
                            "range": {
                              "@timestamp": {
                                "gte": "now-{{ctx.metadata.window_period}}"
                              }
                            }
                          },
                          {
                            "term": {
                              "type": {
                                "value": "dhcpv4"
                              }
                            }
                          }
                        ]
                      }
                    },
                    "aggs": {
                      "client_macs": {
                        "terms": {
                          "field": "dhcpv4.client_mac",
                          "size": 1000
                        },
                        "aggs": {
                          "hostname": {
                            "terms": {
                              "field": "dhcpv4.option.hostname",
                              "size": 1000
                            }
                          },
                          "class_identifier": {
                            "terms": {
                              "field": "dhcpv4.option.class_identifier",
                              "size": 1000
                            }
                          }
                        }
                      }
                    },
                    "size": 0
                  }
                }
              }
            }
          },
          {
            "history_dhcpv4_clients": {
              "search": {
                "request": {
                  "indices": [
                    "packetbeat-*"
                  ],
                  "body": {
                    "query": {
                      "bool": {
                        "must": [
                          {
                            "terms": {
                              "dhcpv4.client_mac": [
                                "{{#ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets}}{{key}}",
                                "{{/ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets}}"
                              ]
                            }
                          },
                          {
                            "range": {
                              "@timestamp": {
                                "lt": "now-{{ctx.metadata.window_period}}"
                              }
                            }
                          },
                          {
                            "term": {
                              "type": {
                                "value": "dhcpv4"
                              }
                            }
                          }
                        ]
                      }
                    },
                    "aggs": {
                      "client_macs": {
                        "terms": {
                          "field": "dhcpv4.client_mac",
                          "size": 10
                        }
                      }
                    },
                    "size": 0
                  }
                }
              }
            }
          }
        ]
      }
    },
    "condition": {
      "script": {
        "source": """
def history=ctx.payload.history_dhcpv4_clients.aggregations.client_macs.buckets.stream().map(p -> p.key).collect(Collectors.toList());
def new_starts=ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets.stream().map(e -> e.key).filter(p -> !history.contains(p)).collect(Collectors.toList());
return new_starts.size() > 0;
"""
      }
    },
    "transform": {
      "script": {
        "source": """
def history=ctx.payload.history_dhcpv4_clients.aggregations.client_macs.buckets.stream().map(p -> p.key).collect(Collectors.toList());
def new_starts=ctx.payload.dhcpv4_clients.aggregations.client_macs.buckets.stream().map(e -> e.key).filter(p -> !history.contains(p));
return new_starts.map(p -> ["mac": p]).collect(Collectors.toList());
"""
      }
    },
    "actions": {
      "notify-slack": {
        "slack": {
          "account": "monitoring",
          "message": {
            "from": "Packetbeat",
            "text": "New DHCP clients detected on network.",
            "dynamic_attachments": {
              "list_path": "ctx.payload._value",
              "attachment_template": {
                "color": "warning",
                "title": "MAC",
                "text": "<https://kibana:5601/app/kibana#/dashboard/a7b35890-8baa-11e8-9676-ef67484126fb?_a=(query:(language:lucene,query:'dhcpv4.client_mac:%22{{mac}}%22'))|{{mac}}>"
              }
            }
          }
        }
      }
    }
  }