<div id="readability-page-1" class="page"><div id="post-body-3401224767617480981" itemprop="articleBody">
<a href="https://elastalert2.readthedocs.io/en/latest/" target="_blank">ElastAlert</a>도 대안이 될 수 있다. pip로는 설치가 잘 되지 않아서 가상 환경을 자동으로 지원한다는 pipx로 WSL 우분투에 설치.<div><pre><code>root@easyDATA:~# apt install pipxroot@easyDATA:~# pipx install elastalert2&nbsp;installed package elastalert2 2.29.0, installed using Python 3.12.3 These apps are now globally available - elastalert - elastalert-create-index - elastalert-test-rule ⚠️ Note: '/root/.local/bin' is not on your PATH environment variable. These apps will not be globally accessible until your PATH is updated. Run pipx ensurepath to automatically add it, or manually modify your PATH in your shell's config file (i.e. ~/.bashrc). done!root@easyDATA:~# ls .local/bin/elastalert&nbsp; elastalert-create-index&nbsp; elastalert-test-rule</code></pre></div>
<div><a name="more"></a>실행 파일 경로 지정.
<div><pre><code>root@easyDATA:~# pipx ensurepathSuccess! Added /root/.local/bin to the PATH environment variable. Consider adding shell completions for pipx. Run 'pipx completions' for instructions. You will need to open a new terminal or re-login for the PATH changes to take effect. Otherwise pipx is ready to go!root@easyDATA:~# exec $SHELL</code></pre></div>
다음은 엘라스틱 연동을 위한 config.yaml 설정.<div>
 <div><pre><code>rules_folder: /root/elastalert/rulerun_every:&nbsp; minutes: 1buffer_time:&nbsp; minutes: 1es_host: 192.168.56.1es_port: 9200use_ssl: Truees_username: elastices_password: passwordca_certs: /mnt/d/elk/v9/elasticsearch-9.3.3/config/certs/http_ca.crtwriteback_index: elastalert_statusalert_time_limit:&nbsp; minutes: 1smtp_host: "smtp.gmail.com"smtp_port: 465smtp_ssl: truefrom_addr: "mhkang589@gmail.com"smtp_auth_file: "/root/elastalert/smtp_auth.yaml"</code></pre></div>
 ElastAlert 용 인덱스 생성.</div>
<pre><code>root@easyDATA:~# elastalert-create-index --config elastalert/config.yamlReading Elastic 8 index mappings:Reading index mapping 'es_mappings/8/silence.json'Reading index mapping 'es_mappings/8/elastalert_status.json'Reading index mapping 'es_mappings/8/elastalert.json'Reading index mapping 'es_mappings/8/past_elastalert.json'Reading index mapping 'es_mappings/8/elastalert_error.json'New index elastalert_status createdDone!</code></pre>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYFmf2sYrhCIR7hkLVHSovl0P5H2fUKe19JFe0KNF63lIkh1J8P5JWadr5heEogX2KIEZUGmQloBFS5VJqVMygUitEkc2lw_ZbtWUDKTACajyGrmSbmITG7FAeF9pX-tzk_TMjgkuLrCJhYODMu70_UuV3UDz4lqHyqQf3YzFXmienHNdjtT8uwWYDNFaW/s1010/elastalert-create-index.png"><img data-original-height="720" data-original-width="1010" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYFmf2sYrhCIR7hkLVHSovl0P5H2fUKe19JFe0KNF63lIkh1J8P5JWadr5heEogX2KIEZUGmQloBFS5VJqVMygUitEkc2lw_ZbtWUDKTACajyGrmSbmITG7FAeF9pX-tzk_TMjgkuLrCJhYODMu70_UuV3UDz4lqHyqQf3YzFXmienHNdjtT8uwWYDNFaW/s16000/elastalert-create-index.png"></a>
다음은 각각 이메일 경보 발송을 위한 smtp_auth.yaml과&nbsp;
<div><pre><code>user: "mhkang589@gmail.com"password: "app password"</code></pre></div>
 rule.yaml 설정.
<div><pre><code>name: TEST - sysmon occurtype: frequencyindex: ubuntutimestamp_field: "@timestamp"num_events: 4timeframe:&nbsp; minutes: 1filter:- query:&nbsp; &nbsp; query_string:&nbsp; &nbsp; &nbsp; query: "event.system.provider.name: Linux-Sysmon"include: ["message"]alert:- "email"email:- "mhkang589@gmail.com"</code></pre></div>
ElastAlert 실행.
<div><pre><code>root@easyDATA:~# elastalert --config elastalert/config.yaml --verboseINFO:elastalert:1 rules loadedINFO:elastalert:Starting upINFO:elastalert:Disabled rules are: []INFO:elastalert:Sleeping for 59.999885 secondsINFO:elastalert:Queried rule TEST - sysmon occur from 2026-04-20 18:31 KST to 2026-04-20 18:32 KST: 8 / 8 hitsINFO:elastalert:Sent email to ['mhkang589@gmail.com']INFO:elastalert:Ignoring match for silenced rule TEST - sysmon occurINFO:elastalert:Ran TEST - sysmon occur from 2026-04-20 18:31 KST to 2026-04-20 18:32 KST: 8 query hits (0 already seen), 2 matches, 1 alerts sent</code></pre></div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVV6TVdV76Dp0-EYMg-TBT76qtJzYXlq_QA3Lfiy4kpiynaDKWKdYhQWpgUjwjhPNGfa1VJrfL3zvlcobPY3t75ZCXYXGEcDKNkuA6_TIpguww_TpGBlcgvFOwKrx2HOb36mu6VFfXHvAMoWldLOqoyr7Nl6WInrmRpNMcONh5HOW6BUr6NipG4qR371Ni/s1280/elastalert.png"><img data-original-height="652" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVV6TVdV76Dp0-EYMg-TBT76qtJzYXlq_QA3Lfiy4kpiynaDKWKdYhQWpgUjwjhPNGfa1VJrfL3zvlcobPY3t75ZCXYXGEcDKNkuA6_TIpguww_TpGBlcgvFOwKrx2HOb36mu6VFfXHvAMoWldLOqoyr7Nl6WInrmRpNMcONh5HOW6BUr6NipG4qR371Ni/s16000/elastalert.png"></a>
<div>관련 글<ul><li><a href="https://kangmyounghun.blogspot.com/2025/12/kibana-alert-2nd.html">Kibana Alert - 2nd</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/11/kibana-alert.html">Kibana Alert</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/02/watcher.html" target="">Watcher 맛보기</a></li></ul></div></div>

</div></div>

케세라세라

ElastAlert도 대안이 될 수 있다. pip로는 설치가 잘 되지 않아서 가상 환경을 자동으로 지원한다는 pipx로 WSL 우분투에 설치.
root@easyDATA:~# apt install pipx
root@easyDATA:~# pipx install elastalert2
 installed package elastalert2 2.29.0, installed using Python 3.12.3 These apps are now globally available - elastalert - elastalert-create-index - elastalert-test-rule ⚠️ Note: '/root/.local/bin' is not on your PATH environment variable. These apps will not be globally accessible until your PATH is updated. Run pipx ensurepath to automatically add it, or manually modify your PATH in your shell's config file (i.e. ~/.bashrc). done!
root@easyDATA:~# ls .local/bin/
elastalert  elastalert-create-index  elastalert-test-rule
실행 파일 경로 지정.
root@easyDATA:~# pipx ensurepath
Success! Added /root/.local/bin to the PATH environment variable. Consider adding shell completions for pipx. Run 'pipx completions' for instructions. You will need to open a new terminal or re-login for the PATH changes to take effect. Otherwise pipx is ready to go!
root@easyDATA:~# exec $SHELL
다음은 엘라스틱 연동을 위한 config.yaml 설정.
  
rules_folder: /root/elastalert/rule
run_every:
  minutes: 1
buffer_time:
  minutes: 1
es_host: 192.168.56.1
es_port: 9200
use_ssl: True
es_username: elastic
es_password: password
ca_certs: /mnt/d/elk/v9/elasticsearch-9.3.3/config/certs/http_ca.crt
writeback_index: elastalert_status
alert_time_limit:
  minutes: 1
smtp_host: "smtp.gmail.com"
smtp_port: 465
smtp_ssl: true
from_addr: "mhkang589@gmail.com"
smtp_auth_file: "/root/elastalert/smtp_auth.yaml"
  
ElastAlert 용 인덱스 생성.
root@easyDATA:~# elastalert-create-index --config elastalert/config.yaml
Reading Elastic 8 index mappings:
Reading index mapping 'es_mappings/8/silence.json'
Reading index mapping 'es_mappings/8/elastalert_status.json'
Reading index mapping 'es_mappings/8/elastalert.json'
Reading index mapping 'es_mappings/8/past_elastalert.json'
Reading index mapping 'es_mappings/8/elastalert_error.json'
New index elastalert_status created
Done!
다음은 각각 이메일 경보 발송을 위한 smtp_auth.yaml과 
user: "mhkang589@gmail.com"
password: "app password"
  
rule.yaml 설정.
name: TEST - sysmon occur
type: frequency
index: ubuntu
timestamp_field: "@timestamp"
num_events: 4
timeframe:
  minutes: 1
filter:
- query:
    query_string:
      query: "event.system.provider.name: Linux-Sysmon"
include: ["message"]
alert:
- "email"
email:
- "mhkang589@gmail.com"
ElastAlert 실행.
root@easyDATA:~# elastalert --config elastalert/config.yaml --verbose
INFO:elastalert:1 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999885 seconds
INFO:elastalert:Queried rule TEST - sysmon occur from 2026-04-20 18:31 KST to 2026-04-20 18:32 KST: 8 / 8 hits
INFO:elastalert:Sent email to ['mhkang589@gmail.com']
INFO:elastalert:Ignoring match for silenced rule TEST - sysmon occur
INFO:elastalert:Ran TEST - sysmon occur from 2026-04-20 18:31 KST to 2026-04-20 18:32 KST: 8 query hits (0 already seen), 2 matches, 1 alerts sent
관련 글
Kibana Alert - 2nd
Kibana Alert
Watcher 맛보기

Kibana Alert - 3rd

댓글