Performance and Integration

Topics

Monitoring Alert Performance
Slow Alert Processing
Troubleshooting Alert Rules
Integration with Other Modules
Next Steps

Monitoring Alert Performance

Navigation: ELS Console → SIEM → Alert Rules

Check:

Processing time.
Last run status.
Total alerts generated.

Slow Alert Processing

Optimization: Add to /etc/alert/alert.yml:

alert:
  processing:
    threads: 8
    batch_size: 1000

Verification:

Restart alert service.
Monitor processing time.

Troubleshooting Alert Rules

Alerts Not Firing

Diagnostic steps:

Check rule syntax - Verify Elasticsearch DSL.
Test with smaller dataset - Use Discovery to test query logic.
Verify index patterns - Ensure data exists in specified indices.
Check time ranges - Confirm events fall within detection window.
Review logs - Check ELS logs for processing errors.

Debug configuration:

troubleshooting:
  debug_mode: true
  log_level: "DEBUG"
  trace_queries: true
  performance_profiling: true

High False Positive Rate

Solutions:

Tune alert thresholds - Increase event counts or severity levels.
Add exclusions - Filter out known good activities.
Refine time windows - Adjust detection time frames.
Use risk scoring - Focus on high-risk events only.

Integration with Other Modules

External System Integration

UI Notification

Email: Sends information about an alert to defined email addresses.

email:
  smtp_host: "smtp.company.com"
  smtp_port: 587
  recipients: ["soc-team@company.com"]
  subject: "SECURITY ALERT: {alert_name}"
  html_body: true
  attach_kibana_discover_url: true

User: Sends information about an alert to defined system users.
Command: Performs system tasks, e.g., triggers a script to create a new event in the customer ticket system.

Example of an alert rule definition using the “command” alert method:

index: op5-*
name: change-op5-hoststate
type: change

compare_key: hoststate
ignore_null: true
query_key: hostname

filter:
- query_string:
    query: "_exists_: hoststate AND datatype: \"HOSTPERFDATA\" AND _exists_: hostname"

realert:
  minutes: 0
alert: "command"
command: ["/opt/alert/send_request_change.sh", "5", "%(hostname)s", "SYSTEM_DOWN", "HOST", "Application Collection", "%(hoststate)s", "%(@timestamp)s"]

The Hive: Creates an Incident in The Hive.

Configuration:

Edit /opt/alert/config.yaml:

hive_host: https://127.0.0.1/base
hive_apikey: APIKEY

Rule definition options:
- Alert type: Type of alert (alert or Case)
- Follow: If enabled, updates set status to Updated and update related case.
- Title: The title of alert.
- Description: Description of the alert.
- Type: The type of the alert.
- Source: The source of the alert.
- Status: The status of the alert (New, Ignored, Updated, Imported).
- Severity: The severity of alert (low, medium, high, critical).
- TLP: The Traffic Light Protocol (white, green, amber, red).
- Tags: Tags attached to alert.
- Observable data mapping: Key and value observable data mapping.
- Alert text: Text content of the alert.

RSA Archer: Forwards alert information to RSA Archer via Command alert method.

Configuration steps:

Save scripts to /opt/alert/bin:
- ucf.sh (SYSLOG):

#!/usr/bin/env bash
base_url="http://localhost/Archer" ##set the appropriate Archer URL

logger -n $base_url -t logger -p daemon.alert -T "CEF:0|LogServer|LogServer|${19}|${18}| TimeStamp=$1 DeviceVendor/Product=$2-$3 Message=$4 TransportProtocol=$5 Aggregated:$6 AttackerAddress=$7 AttackerMAC=$8 AttackerPort=$9 TargetMACAddress=${10} TargetPort=${11} TargetAddress=${12} FlexString1=${13} Link=${14} ${15} $1 ${16} $7 ${17}"

ucf2.sh (REST API):

#!/usr/bin/env bash
base_url="http://localhost/Archer" ##set the appropriate Archer URL
instance_name="Archer"
username="apiuser"
password="Archer"

curl -k -u $username:$password -H "Content-Type: application/xml" -X POST "$base_url:50105/$instance_name" -d {
"CEF":"0","Server":"LogServer","Version":"${19}","NameEvent":"${18}","TimeStamp":"$1","DeviceVendor/Product":"$2-$3","Message":"$4","TransportProtocol":"$5","Aggregated":"$6","AttackerAddress":"$7","AttackerMAC":"$8","AttackerPort":"$9","TargetMACAddress":"${10}","TargetPort":"${11}","TargetAddress":"${12}","FlexString1":"${13}","Link":"${14}","EventID":"${15}","EventTime":"${16}","RawEvent":"${17}"
}

Alert rule definition:

index: alert*
name: alert-sent-to-rsa
type: any

filter:
- query:
    query_string:
      query: "_exists_: endTime AND _exists_: deviceVendor AND _exists_: deviceProduct AND _exists_: message AND _exists_: transportProtocol AND _exists_: correlatedEventCount AND _exists_: attackerAddress AND _exists_: attackerMacAddress AND _exists_: attackerPort AND _exists_: targetMacAddress AND _exists_: targetPort AND _exists_: targetAddress AND _exists_: flexString1 AND _exists_: deviceCustomString4 AND _exists_: eventId AND _exists_: applicationProtocol AND _exists_: rawEvent"

include:
- endTime
- deviceVendor
- deviceProduct
- message
- transportProtocol
- correlatedEventCount
- attackerAddress
- attackerMacAddress
- attackerPort
- targetMacAddress
- targetPort
- targetAddress
- flexString1
- deviceCustomString4
- eventId
- applicationProtocol
- rawEvent

realert:
  minutes: 0

Alert Method: command
Path to script/command: /opt/alert/bin/ucf.sh
Jira: Opens a ticket on Jira when an alert is triggered.

Configuration steps:

Create /opt/alert/jira_acct.yaml:

user: user.example.com
password: IjP0vVhgrjkotElFf4ig03g6

Edit /opt/alert/config.yaml:

jira_account_file: "/opt/alert/jira_acct.yaml"
jira_server: "https://example.atlassian.net"

Rule definition options:
- Required:
  - project: The name of the Jira project.
  - issue type: The type of Jira issue.
- Optional:
  - Components: Component(s) to set the ticket to.
  - Labels: Label(s) to set the ticket to.
  - Watchers: User ID(s) to add as watchers.
  - Priority: Issue priority (Lowest, Low, Medium, High, Highest).
  - Bump tickets: If true, comments on existing tickets newer than max_age.
  - Bump Only: Skips ticket creation if no ticket to bump.
  - Bump in statuses: Statuses for commenting instead of new ticket.
  - Ignore in title: Removes value from Jira subject when searching.
  - Max age: Maximum ticket age for bumping (default: 30 days).
  - Bump not in statuses: Statuses to exclude for bumping.
  - Bump after inactivity: Comments only on inactive tickets (default: 0 days).
  - Transition to: Transitions ticket to given status when bumping.

Webhook Connector: Sends POST or PUT request to a web service.
URL: Host of application or web application.
Username: Username used to send alert.
Password: Password of the username.
Proxy address: Proxy address.
Headers: Request headers.
Static Payload: Static payload of the request.
Payload: Payload of the request.

To enable https, add to /opt/alert/config.yaml:

webhook_verify_ssl: true
webhook_ca: /etc/logserver/ssl/rootCA.crt
webhook_cert: /etc/logserver/ssl/clientCert.crt
webhook_key: /etc/logserver/ssl/clientKey.key

Slack: Sends notification to a predefined Slack channel.
Webhook URL: URL with auth data and channel ID (from Slack’s Incoming Webhooks).
Username: Username or email address in Slack.
Slack channel: Channel name (default if empty).
Message Color: Message color (default: ‘danger’).
Message Title: Title of the Slack message.
ServiceNow: Creates a new Incident in ServiceNow.

Configuration steps:

Create /opt/alert/servicenow_auth_file.yml:

servicenow_rest_url: https://dev123.service-now.com/api/now/v1/table/incident
username: exampleUser
password: exampleUserPassword

Short Description: Incident description.
Comments: Work notes or comments.
Assignment Group: Group to assign the incident.
Category: Incident category (must exist).
Subcategory: Incident subcategory (must exist).
CMDB CI: Configuration item to link.
Caller Id: Caller’s email address.
Proxy: Proxy address if needed.
EnergySoar: Creates a new Incident in Energy Soar.

Configuration:

Edit /opt/alert/config.yaml:

hive_host: https://127.0.0.1/base
hive_apikey: APIKEY

Rule definition options:
- Alert type: Type of alert (alert or Case).
- Follow: Updates status to Updated and related case if enabled.
- Title: Alert title.
- Description: Alert description.
- Type: Alert type.
- Source: Alert source.
- Status: Alert status (New, Ignored, Updated, Imported).
- Severity: Alert severity (low, medium, high, critical).
- TLP: Traffic Light Protocol (white, green, amber, red).
- Tags: Tags attached to alert.
- Observable data mapping: Key and value mapping.
- Alert text: Alert content text.

Definition-based Notification

Microsoft Teams Alerts

Required settings:

ms_teams_webhook_url: Webhook endpoint with authentication and channel ID (from Teams → Connectors → Incoming Webhook).
ms_teams_alert_summary: Short summary (may not display in current Teams version).

Optional settings:

ms_teams_theme_color: HEX color code for alert border (e.g., #ff0000 for red).
ms_teams_proxy: Proxy in hostname:port format if needed.
Telegram Alerts

Required settings:

telegram_bot_token: Authorization token (e.g., 110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw) from BotFather.
telegram_room_id: Chat or channel ID (e.g., -xxxxxxxx).

Optional settings:

telegram_api_url: Custom Telegram Bot API domain (default: api.telegram.org).
telegram_proxy: Proxy in hostname:port format if needed.
ServiceNow Alerts

Required settings:

servicenow_rest_url: REST API endpoint (e.g., https://instancename.service-now.com/api/now/v1/table/incident).
username: ServiceNow API username.
password: ServiceNow API password.
short_description: Incident summary.
comments: Work notes or comments.
assignment_group: Group for incident handling.
category: Existing ServiceNow category.
subcategory: Existing ServiceNow subcategory.
cmdb_ci: Configuration item to link.
caller_id: Caller’s identifier (e.g., alert-energylogserver@company.com).

Optional settings:

servicenow_proxy: Proxy in hostname:port format if needed.
Google Chat Alerts

Required settings:

googlechat_webhook_url: Webhook endpoint (from Google Chat → Configure Webhooks).

Optional settings:

googlechat_format: Notification layout (basic or card).
googlechat_header_title: Header title for card format.
googlechat_header_subtitle: Header subtitle for card format.
googlechat_header_image: URL to image/icon for card header.
googlechat_footer_kibanalink: URL to Energylogserver UI for card footer.
PagerDuty:

pagerduty:
  api_key: "YOUR_PAGERDUTY_KEY"
  service_id: "SERVICE_ID"
  priority: "P1"
  auto_resolve: true

OpsGenie:

opsgenie:
  api_key: "YOUR_OPSGENIE_KEY"
  team: "Security Team"
  priority: "P1"
  tags: ["siem", "alert"]

Webhook Configuration:

{
  "webhook_url": "https://soar.company.com/api/incidents",
  "http_post_payload": {
    "alert_name": "{alert_name}",
    "severity": "{severity}",
    "timestamp": "{@timestamp}",
    "source_ip": "{source.ip}",
    "evidence_url": "{discover_url}"
  },
  "webhook_headers": {
    "Authorization": "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json"
  }
}

Confirmation

Screenshots: The images 08_main_siem_interface.png and 08_create_alert_rule.png are correctly placed in the Alerting Interface Overview and Quick Start: Alert Creation Wizard sections, respectively, with the specified paths and Polish descriptions.
Excel Corrections: All corrections (rows 57–80) are applied, including updated navigation, removed invalid elements, and added alert methods/types.
Cohesion: The document is logically structured, with consistent formatting, no duplicates, and clear integration of screenshots.