Alerting

How to create custom alert script to initiate tcpdump?

b_chris21
Communicator

Hello everyone,

I am trying to create a custom alert action where tcpdump capture will be triggered for the event's src and dest IPs.

I created a simple bash script for that: 

 

#!/bin/bash
#Initiate tcpdump (3 dumps for 5mins each)
tcpdump -i ens33 -G 300 -W 3 -w /mnt/nfs/pcaps/pcap-%Y-%m-%d_%H.%M.%S

 

My problem is that this does not contain the src and dest IPs of the correlation event triggered. How can I pass these variables here in order not to capture the whole traffic, but only the one related between these two hosts?

Thanks

Chris 

Labels (1)
0 Karma

schose
Builder

Hi,

The alert action script receives the configuration and results from the stdin in json format.. 

example:

{
"app": "search",
"owner": "admin",
"results_file": "heregoesthecreditcardnumber",
"results_link": "heregoesthecreditcardnumber",
"search_uri": "/servicesNS/nobody/search/saved/searches/testalert",
"server_host": "art-mb-2.local",
"server_uri": "heregoesthecreditcardnumber",
"session_key": "heregoesthecreditcardnumber",
"sid": "scheduler__admin__search__testalert_at_1569508320_128",
"search_name": "testalert",
"configuration": {
"email": "andreas at batchworks.de",
"company": "batchworks",
"severity": "WARNING"
},
"result": {
"sourcetype": "splunkd",
"count": "80"
}
}

in "result" there are your search results.. read this in python like: 

result = sys.stdin.read() settings = json.loads(result)regards,​
 

Andreas

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...