TheHive alert problem when customField

[p1kusmie]

Hi
When I use customFields in hive_alert_config then the alert doesn't work. What am I doing wrong?
error:
elastalert_error - {'message': 'Error while running alert hivealerter: Error posting to TheHive: 404 Client Error: Not Found for url: http://hive.soc.my.domain.pl:9000/api/alert', 'traceback': ['Traceback (most recent call last):', ' File "/home/user/.local/lib/python3.8/site-packages/elastalert/alerters/thehive.py", line 123, in alert', ' response.raise_for_status()', ' File "/usr/lib/python3/dist-packages/requests/models.py", line 940, in raise_for_status', ' raise HTTPError(http_error_msg, response=self)', 'requests.exceptions.HTTPError: 404 Client Error: Not Found for url: http://hive.soc.my.domain.pl:9000/api/alert', '', 'During handling of the above exception, another exception occurred:', '', 'Traceback (most recent call last):', ' File "/home/user/.local/lib/python3.8/site-packages/elastalert/elastalert.py", line 1633, in send_alert', ' alert.alert(matches)', ' File "/home/user/.local/lib/python3.8/site-packages/elastalert/alerters/thehive.py", line 125, in alert', ' raise EAException(f"Error posting to TheHive: {e}")', 'elastalert.util.EAException: Error posting to TheHive: 404 Client Error: Not Found for url: http://hive.soc.my.domain.pl:9000/api/alert'], 'data': {'rule': 'SIEM alert to TheHive'}}

'rule_name': 'SIEM alert to TheHive', 'alert_info': {'type': 'hivealerter', 'hive_host': 'http://hive.soc.my.domain.pl'}, 'alert_sent': False, 'alert_time': datetime.datetime(2021, 12, 1, 13, 9, 36, 839345, tzinfo=tzutc()), 'match_time': '2021-11-25T14:15:41.038Z', 'alert_exception': 'Error posting to TheHive: 404 Client Error: Not Found for url: http://hive.soc.my.domain.pl:9000/api/alert'}

config:

name: "SIEM alert to TheHive"
index: .siem-signals-default-*
type: any
realert:
  minutes: 0
filter:
- query:
    query_string:
      query: "signal.status:open AND kibana.alert.rule.rule_id:d574bb32-b02c-45c5-ac1c-f34204dd6b41"

alert_subject_args: ["signal.reason"]
alert_subject: "{0}"
alert_text_args: ["signal.rule.threat", "signal.reason", "ext"]
alert_text_type: alert_text_only
alert_text: "{1}"

match_enhancements:
- "elastalert_modules.bluecoat.Bluecoat"

alert:
- hivealerter

hive_connection:
  hive_host: http://hive.soc.my.domain.pl #https://hive.soc.my.domain.pl
  #hive_port: 443
  hive_apikey: apikey

hive_alert_config:
  customFields:
    - name: destination.ip
      type: string
      value: destination_ip_ext
  type: 'SIEM'
  source: 'elastalert'
  severity: 1
  tags: [ 'user.name', 'host.hostname', 'process.name', 'source_ip_ext', 'destination_ip_ext', 'parent_sha256_ext' ]
  tlp: 2
  status: 'New'
  follow: True

[jertel]

It's trying to reach this URL: http://hive.soc.my.domain.pl:9000/api/alert. Have you tried curling that same URL from the host or container that is running ElastAlert 2, to rule out a network/DNS related issue?

[p1kusmie]

Curl return:
{"type":"AuthenticationError","message":"Authentication failure"}

I don't know how to pass api key in curl

[p1kusmie]

curl -X GET \
  'http://hive.soc.my.domain.pl:9000/api/alert' \
  -H 'Authorization: Bearer apikey'
[{"_id":"~82006112","id":"~82006112","createdBy":"elastalert@domain.pl","updatedBy":null,"createdAt":1638367763440,"updatedAt":null,"_type":"alert","type":"external","source":"instance1","sourceRef":"3333b3","externalLink":null,"case":null,"title":"New Alert","description":"N/A","severity":2,"date":1638367763000,"tags":["TheHive4Py","sample"],"tlp":3,"pap":2,"status":"New","follow":true,"customFields":{"destination-ip":{"string":"8.8.8.8"}},"caseTemplate":null,"artifacts":[{"_id":"~82010208","id":"~82010208","createdBy":"elastalert@assecobs.pl","createdAt":1638367763452,"_type":"case_artifact","dataType":"ip","data":"8.8.8.8","startDate":1638367763452,"tlp":2,"tags":[],"ioc":false,"sighted":false,"reports":{},"stats":{}},{"_id":"~82014304","id":"~82014304","createdBy":"elastalert@domain.pl","createdAt":1638367763459,"_type":"case_artifact","dataType":"domain","data":"google.com","startDate":1638367763459,"tlp":2,"tags":[],"ioc":false,"sighted":false,"reports":{},"stats":{}}],"similarCases":[]}]                                                                                                                                                                                                

[jertel]

That's a good sign. The next step is to use tcpdump -A on the Elastalert host (or container) to see the actual request and response. Also, check TheHive log to see if it's complaining about something in particular.

See a similar discussion here: #563

[p1kusmie]

Thank for help. Iit was a problem with the data I tried to pass to the custom field.