Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Metron Alert UI: Alerts not appearing in merton-alerts UI

Metron Alert UI: Alerts not appearing in merton-alerts UI

New Contributor

I am trying to develop an usecase with metron.

The end-to-end usecase is, we need to calculate the count of number of events happened for each ip’s. Based on the count reaching above the threshold count generate an alerts in the merton alerts-UI.

For that, I have the events data coming to “indexing” kafka topic. I created a profile in ${METRON_HOME}/config/zookeeper/profiler.json as below.

{ 
"profiles": [ 
{ 
"profile": "demo_iplogon_failed", 
"foreach": "ip_address", 
"onlyif": "source.type == 'demo_windowsnxlog' and event_id ==
'4625'", 
"init": { 
"count": "0" 
}, 
"update": { 
"count": "count + 1" 
}, 
"result": { 
"profile" : "count", 
"triage": { 
"logon_failed_count": "count" 
} 
} 
}  
]}

After reloading the zookeeper config files, I see the indices created in ElasticSearch with format profile_index_yyyy.MM.dd.HH and the snapshot of record is in attached snapshot

64759-sanpshot-of-profile-index-record.jpg

I see all the records in the profiler_index_* pattern have field is_alert=”true”. But I don’t see these records turn up as alerts in the metron-alerts UI.

I would like to figure out the reason for alerts not turning up in the metron-alerts UI ?

I am seeing is_alerts=”true” for all the records under profiler_index_*. How can I configure to set is_alert=”true” only when the count exceeds the threshold value ?

@nallen @asubramanian: tagging you as you can help me quickly. Please don't mind!

3 REPLIES 3
Highlighted

Re: Metron Alert UI: Alerts not appearing in merton-alerts UI

Rising Star

> I would like to figure out the reason for alerts not turning up in the metron-alerts UI ?

I believe it is because the Alerts UI has not been configured to look at the `profiler_index_*` indices that have been created. Right now, the Alerts UI only looks at the indices that have been created for each sensor.

> I am seeing is_alerts=”true” for all the records under profiler_index_*.

The `is_alerts` value is set to true when those messages are generated by the Profiler. The purpose of sending messages back into Kafka from the Profiler, is to enable use of the Threat Triage mechanism. That is why they are always set to true.

> How can I configure to set is_alert=”true” only when the count exceeds the threshold value ?

You would do this by defining a rule in Threat Triage that increase the threat score based on that count exceeding a threshold.

Re: Metron Alert UI: Alerts not appearing in merton-alerts UI

New Contributor
@nallen

can I define the triage in profile definition as blow ??

"triage": {
"name":"Login Failed Anomaly",
"rule": SHELL_GET_EXPRESSION("profileName == 'demo_iplogon_failed' and count > 20"),
"score":"10",
"logon_failed_count": "count"
}

Re: Metron Alert UI: Alerts not appearing in merton-alerts UI

Rising Star

Please open a separate question if you have issues with Threat Triage.

Don't have an account?
Coming from Hortonworks? Activate your account here