Alert provisioning fixes (#158)
* Update monitoring alert URL in provision.py * Add ALERT_FORWARDING_IP configuration * Update alert forwarding IP in provision.py * Fix SSL verification issue when sending webhooks to Copilot * precommit fixes
taylor_socfortress committed
Feb 15, 2024 at 09:56 UTC
6cbbaaf31b3b6b159bc1f935faf195e3caa95791
4 files changed
+21
-9
.env.example
+5
@@ -1,6 +1,11 @@
1
# Leave this as is if connecting from a remote machine
2
SERVER_IP=0.0.0.0
3
4
+# ! ALERT FORWARDING IP
5
+# Set this to the IP of the host running CoPilot. This is used by Graylog to forward alerts to CoPilot
6
+# ! Ensure Graylog is able to reach this IP and port 5000
7
+ALERT_FORWARDING_IP=0.0.0.0
8
+
9
# Connector Credentials
10
# ! SETTING UP YOUR CONNECTORS DEMOs https://www.youtube.com/@taylorwalton_socfortress/videos! #
11
WAZUH_INDEXER_URL=https://1.1.1.1:9200
backend/app/connectors/graylog/schema/monitoring.py
+3
-3
@@ -1,7 +1,7 @@
1
+from typing import Any
2
+from typing import Dict
3
from typing import List
4
from typing import Optional
3
-from typing import Dict
4
-from typing import Any
5
6
from pydantic import BaseModel
7
from pydantic import Field
@@ -90,7 +90,7 @@ class GraylogEventNotificationsNotification(BaseModel):
90
id: str
91
title: str
92
description: str
93
- #config: GraylogEventNotificationsConfig
93
+ # config: GraylogEventNotificationsConfig
94
config: Optional[Dict[str, Any]]
95
96
backend/app/integrations/monitoring_alert/services/provision.py
+10
-6
@@ -265,15 +265,17 @@ async def provision_wazuh_monitoring_alert(
265
)
266
notification_exists = await check_if_event_notification_exists("SEND TO COPILOT")
267
if not notification_exists:
268
+ # ! Unfortunately Graylog does not support disabling SSL verification when sending webhooks
269
+ # ! Therefore, we need to send to API port of Copilot over HTTP
270
url_whitelisted = await check_if_url_whitelist_entry_exists(
269
- f"http://{os.getenv('SERVER_IP')}:5000/monitoring_alert/create",
271
+ f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
272
)
273
if not url_whitelisted:
274
logger.info("Provisioning URL Whitelist")
275
whitelisted_urls = await build_url_whitelisted_entries(
276
whitelist_url_model=GraylogUrlWhitelistEntryConfig(
277
id=await generate_random_id(),
276
- value=f"http://{os.getenv('SERVER_IP')}:5000/monitoring_alert/create",
278
+ value=f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
279
title="SEND TO COPILOT",
280
type="literal",
281
),
@@ -286,7 +288,7 @@ async def provision_wazuh_monitoring_alert(
288
title="SEND TO COPILOT",
289
description="Send alert to Copilot",
290
config={
289
- "url": f"http://{os.getenv('SERVER_IP')}:5000/monitoring_alert/create",
291
+ "url": f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
292
"type": "http-notification-v1",
293
},
294
),
@@ -381,15 +383,17 @@ async def provision_suricata_monitoring_alert(
383
)
384
notification_exists = await check_if_event_notification_exists("SEND TO COPILOT")
385
if not notification_exists:
386
+ # ! Unfortunately Graylog does not support disabling SSL verification when sending webhooks
387
+ # ! Therefore, we need to send to API port of Copilot over HTTP
388
url_whitelisted = await check_if_url_whitelist_entry_exists(
385
- f"http://{os.getenv('SERVER_IP')}:5000/monitoring_alert/create",
389
+ f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
390
)
391
if not url_whitelisted:
392
logger.info("Provisioning URL Whitelist")
393
whitelisted_urls = await build_url_whitelisted_entries(
394
whitelist_url_model=GraylogUrlWhitelistEntryConfig(
395
id=await generate_random_id(),
392
- value=f"http://{os.getenv('SERVER_IP')}:5000/monitoring_alert/create",
396
+ value=f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
397
title="SEND TO COPILOT",
398
type="literal",
399
),
@@ -402,7 +406,7 @@ async def provision_suricata_monitoring_alert(
406
title="SEND TO COPILOT",
407
description="Send alert to Copilot",
408
config={
405
- "url": f"http://{os.getenv('SERVER_IP')}:5000/monitoring_alert/create",
409
+ "url": f"http://{os.getenv('ALERT_FORWARDING_IP')}:5000/api/monitoring_alert/create",
410
"type": "http-notification-v1",
411
},
412
),
docker-compose.yml
+3
@@ -3,6 +3,9 @@ version: "2"
3
services:
4
copilot-backend:
5
image: ghcr.io/socfortress/copilot-backend:latest
6
+ # Only expose if you want to access the docs
7
+ #ports:
8
+ # - "5000:5000"
9
volumes:
10
- ./data/copilot-backend-data/logs:/opt/logs
11
# Mount the copilot.db file to persist the database