testwatcher

PUT _watcher/watch/winlogs
{
  "metadata": {
    "window_period": "15m"
  },
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": "winlogbeat-*",
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-{{ctx.metadata.window_period}}"
                    }
                  }
                }
              ],
              "should": [
                {
                 "terms": {
                   "event.code": [
                     "4720",
                     "4726",
                     "4624"
                   ]
                 } 
                }
              ]
            }
          },
          "aggs": {
            "event_types": {
              "filters": {
                "filters": {
                  "add": {
                    "term": {
                      "event.code": {
                        "value": "4720"
                      }
                    }
                  },
                  "remove": {
                    "term": {
                      "event.code": {
                        "value": "4726"
                      }
                    }
                  },
                  "login": {
                    "term": {
                      "event.code": {
                        "value": "4624"
                      }
                    }
                  }
                }
              },
              "aggs": {
                "users": {
                  "terms": {
                    "field": "winlog.event_data.TargetUserName",
                    "size": 1000
                  }
                }
              }
            }
          },
          "size": 0
        }
      }
    }
  },
  "condition": {
    "script": {
        "source": """
        def removes=ctx.payload.aggregations.event_types.buckets.remove.users.buckets.stream().map(p -> p.key).collect(Collectors.toList());
        def logins=ctx.payload.aggregations.event_types.buckets.login.users.buckets.stream().map(p -> p.key).collect(Collectors.toList());
        return ctx.payload.aggregations.event_types.buckets.add.users.buckets.stream().map(p -> p.key).filter(p -> removes.contains(p)).filter(p -> logins.contains(p)).toArray().length > 0;
      """,
  "lang": "painless"
    }
  },
  "transform": {
    "script": {
      "source": """
            def docs = [];
            def removes=ctx.payload.aggregations.event_types.buckets.remove.users.buckets.stream().map(p -> p.key).collect(Collectors.toList());
            def logins=ctx.payload.aggregations.event_types.buckets.login.users.buckets.stream().map(p -> p.key).collect(Collectors.toList());
            def hits = ctx.payload.aggregations.event_types.buckets.add.users.buckets;
            for (hit in hits){
              def document = [
                '@timestamp':ctx.execution_time,
                'origin host': ctx.payload.aggregations.event_types.buckets.add.users.buckets.stream().map(o -> o.host.ip).filter(o -> removes.contains(o)).filter(o -> logins.contains(o)).toArray(), 
                'usernames' :  ctx.payload.aggregations.event_types.buckets.add.users.buckets.stream().map(u -> u.key).filter(u -> removes.contains(u)).filter(u -> logins.contains(u)).toArray()
                ];
                docs.add(document);
            }
            return ['_doc':docs];
          """,
      "lang": "painless"
    }
  },
  "throttle_period": "15m",
  "actions": {
    "index_payload": {
      "foreach": "ctx.payload._doc",
      "max_iterations": 100,
      "index": {
        "index": "winlogtest"
      }
    }
  }
}