@@ -0,0 +1,1912 @@
+#!/usr/bin/env python%0A%0A# This Source Code Form is subject to the terms of the Mozilla Public%0A# License, v. 2.0. If a copy of the MPL was not distributed with this%0A# file, You can obtain one at http://mozilla.org/MPL/2.0/.%0A# Copyright (c) 2014 Mozilla Corporation%0A#%0A# Contributors:%0A# Jonathan Claudius jclaudius@mozilla.com%0A# Brandon Myers bmyers@mozilla.com%0A%0Afrom lib.alerttask import AlertTask%0Afrom query_models import SearchQuery, TermMatch, PhraseMatch, TermsMatch%0A%0A%0Aclass AlertOpenPortViolation(AlertTask):%0A    def main(self):%0A        search_query = SearchQuery(hours=4)%0A%0A        search_query.add_must(%5B%0A            TermMatch('_type', 'event'), %0A            PhraseMatch('tag', 'open_port_policy_violation'),%0A        %5D)%0A%0A        self.filtersManual(search_query)%0A%0A        # Search aggregations on field 'sourceipaddress', keep X samples of%0A        # events at most%0A        self.searchEventsAggregated('details.destinationipaddress', samplesLimit=100)%0A        # alert when %3E= X matching events in an aggregation%0A        self.walkAggregations(threshold=1)%0A%0A    # Set alert properties%0A    def onAggregation(self, aggreg):%0A        # aggreg%5B'count'%5D: number of items in the aggregation, ex: number of failed login attempts%0A        # aggreg%5B'value'%5D: value of the aggregation field, ex: toto@example.com%0A        # aggreg%5B'events'%5D: list of events in the aggregation%0A        category = 'open_port_policy_violation'%0A        tags = %5B'open_port_policy_violation'%5D%0A        severity = 'CRITICAL'%0A%0A        summary = ('%7B0%7D unauthorized open port(s) on %7B1%7D'.format(aggreg%5B'count'%5D, aggreg%5B'value'%5D))%0A        # hosts = self.mostCommon(aggreg%5B'allevents'%5D, '_source.details.hostname')%0A        # for i in hosts%5B:5%5D:%0A        #     summary += ' %7B0%7D (%7B1%7D hits)'.format(i%5B0%5D, i%5B1%5D)%0A%0A        # Create the alert object based on these properties%0A        return self.createAlertDict(summary, category, tags, aggreg%5B'events'%5D, severity)%0A

Add open port violation alert