Unable to get generate_kibana_discover_url to work

[Psyhil89]

Hi All,

I am able to get email alerts as required however unable to generate URL for kibana dashboard in alerts.
Below is an example of a test rule and its output. May I please ask some one to guide me on what I did wrong here?
Thank you in advance!

# description: Detects suspicious PowerShell download command(Invoke-webrequest)
alert:
- "email"
# (required, email specific)
# a list of email addresses to send alerts to
email:
- "redacted"
filter:
- query:
    query_string:
      query: ((event.code:"4104" AND (winlog.event_data.ScriptBlockText:IWR* OR winlog.event_data.ScriptBlockText:Invoke-WebRequest*)) OR (event.code:"4103" AND winlog.event_data.Payload:*Invoke-WebRequest*) OR (event.code:"800" AND winlog.event_data.param1:Invoke-WebRequest*) OR (event.code:"4100" AND winlog.event_data.Payload:*InvokeWebRequestCommand*))
index: winlogbeat-*
name: suspicious-powershell-download by Invoke-webrequest test
priority: 3
realert:
  minutes: 0
type: any
generate_kibana_discover_url: true
kibana_discover_app_url: redacted:5601/app/discover#/
kibana_discover_version: '7.13'
include:
  - winlog.computer_name
  - winlog.user.name
  - winlog.user.domain
  - winlog.event_data.ScriptBlockText

Alert Output

suspicious-powershell-download by Invoke-webrequest

@timestamp: 2021-10-19T13:29:10.849Z
_id: T-W9mHwBHRjHKVhtZxXj
_index: winlogbeat-7.8.0-000001
_type: _doc
num_hits: 3
num_matches: 3
winlog: {
    "computer_name": "redacted",
    "event_data": {
        "ScriptBlockText": "Invoke-WebRequest -Uri 'http://www.google.com'"
    },
    "user": {
        "domain": "redacted",
        "name": "redacted"
    }
}

[nsano-rururu]

Read the documentation
https://elastalert2.readthedocs.io/en/latest/ruletypes.html#generate-kibana-discover-url

kibana_discover_app_url
kibana_discover_version
kibana_discover_index_pattern_id
generate_kibana_discover_url: true

[nsano-rururu]

look
#257

[Psyhil89]

Thank you so much @nsano-rururu for guiding.
Going through them and will try.

[Psyhil89]

It seems I do not have an index patter_id
Tried with steps in #257
The only index-pattern under saved objects show up as winlogbeat-* and the exported file is missing the ID for same

{"attributes":{"fieldAttrs":"{\"event.code\":{\"count\":69},\"message\":{\"count\":20},\"winlog.event_data.ProcessId\":{\"count\":2},\"winlog.event_data.TaskName\":{\"count\":18},\"winlog.event_data.CommandLine\":{\"count\":18},\"winlog.event_data.CurrentDirectory\":{\"count\":12},\"winlog.event_data.Image\":{\"count\":36},\"winlog.event_data.ParentCommandLine\":{\"count\":12},\"agent.name\":{\"count\":4},\"agent.hostname\":{\"count\":10},\"winlog.event_data.SourceImage\":{\"count\":31},\"winlog.event_data.TargetUserName\":{\"count\":106},\"winlog.event_data.Company\":{\"count\":3},\"winlog.event_data.ImageLoaded\":{\"count\":7},\"winlog.event_data.Product\":{\"count\":4},\"winlog.event_data.DestinationHostname\":{\"count\":3},\"winlog.event_data.DestinationIp\":{\"count\":3},\"winlog.event_data.DestinationPortName\":{\"count\":1},\"winlog.event_data.SourceIp\":{\"count\":2},\"winlog.event_data.TargetFilename\":{\"count\":6},\"winlog.user.name\":{\"count\":5},\"host.name\":{\"count\":4},\"winlog.event_data.OriginalFileName\":{\"count\":2},\"event.provider\":{\"count\":8},\"winlog.event_data.param1\":{\"count\":33},\"winlog.event_data.param2\":{\"count\":2},\"@version\":{\"count\":1},\"winlog.event_data.PrivilegeList\":{\"count\":1},\"winlog.event_data.ProcessName\":{\"count\":4},\"winlog.event_data.SubjectUserName\":{\"count\":4},\"winlog.event_data.ApplicableGPOList\":{\"count\":2},\"winlog.event_data.Description\":{\"count\":3},\"winlog.event_data.DestinationPort\":{\"count\":3},\"winlog.provider_name\":{\"count\":15},\"winlog.event_data.SourceHostname\":{\"count\":1},\"winlog.event_data.User\":{\"count\":2},\"winlog.event_data.Details\":{\"count\":2},\"winlog.event_data.WorkstationName\":{\"count\":9},\"winlog.event_data.IpAddress\":{\"count\":1},\"winlog.event_data.param3\":{\"count\":3},\"winlog.user_data.SubjectUserName\":{\"count\":1},\"winlog.task\":{\"count\":1},\"@timestamp\":{\"count\":2},\"winlog.event_data.Hashes\":{\"count\":2},\"winlog.event_data.SourcePort\":{\"count\":1},\"winlog.event_data.AuditPolicyChanges\":{\"count\":5},\"winlog.event_data.CategoryId\":{\"count\":1},\"winlog.event_data.SubcategoryId\":{\"count\":3},\"winlog.channel\":{\"count\":4},\"winlog.event_data.Payload\":{\"count\":2},\"winlog.event_data.LogonProcessName\":{\"count\":1},\"event.action\":{\"count\":1},\"winlog.event_data.PipeName\":{\"count\":1},\"winlog.event_data.param11\":{\"count\":1},\"winlog.event_data.SubStatus\":{\"count\":1},\"winlog.event_data.Path\":{\"count\":1},\"winlog.event_data.TargetImage\":{\"count\":4},\"winlog.computer_name\":{\"count\":2}}","fields":"[]","runtimeFieldMap":"{}","timeFieldName":"@timestamp","title":"winlogbeat-*","typeMeta":"{}"},"coreMigrationVersion":"7.15.0","id":"winlogbeat-*","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"type":"index-pattern","updated_at":"2021-10-14T18:21:16.691Z","version":"Wzg0NDcyLDRd"} {"excludedObjects":[],"excludedObjectsCount":0,"exportedCount":1,"missingRefCount":0,"missingReferences":[]}

Alternatively I also tried below
GET winlogbeat-7.8.0-000001/doc/index-pattern-id
output
{ "_index" : "winlogbeat-7.8.0-000001", "_type" : "doc", "_id" : "index-pattern-id", "found" : false }
Does it mean the index-pattern-id is not set?

[nsano-rururu]

@Psyhil89

Did you really add the index pattern on the kibana screen?

[nsano-rururu]

@Psyhil89

There is an id. Liar. It's terrible

"id":"winlogbeat-*"

[Psyhil89]

double face palm... I was looking for a long string of alpha numeric character... my bad.
I will try the config now.

[Psyhil89]

It all worked like a charm!
Kibana dashboard URL is now generated.
My humble thanks to you.