飞牛NAS保姆级教程：部署HFish蜜罐，全方位防御黑客入侵

name: "蜜罐告警"
type: any
index: logs-syslog-hfish  # 你的访问日志索引模式
# ES 8 数据流的时间字段通常是 @timestamp
timestamp_field: "@timestamp"
timestamp_type: iso
# 过滤条件：匹配敏感接口路径
filter:
- bool:
    must_not:
    - term:
        type: "common"

# 对相同IP进行分组，分别计数
query_key: "src_ip"
# 告警触发后，2分钟内抑制相同IP的重复告警
realert:
  minutes: 5
# 必须包含这些字段才能在注解中使用
include:
  - "src_ip"
  - "geo"
  - "@timestamp"
  - "attack_type"
  - "client"
  - "client_ip"
  - "name"
  - "account"
  - "threat_level"
# 告警动作：发送到Alertmanager
alert:
  - "alertmanager"
alertmanager_api_version: v2
alertmanager_hosts:
  - "https://alertmanager.evling.tech"
alertmanager_annotations:
  src_ip: "{{ _data.get('src_ip', '') }}"
  geo: "{{ _data.get('geo', '') }}"
  created_at: "{{ _data.get('@timestamp', '') }}"
  attack_type: "{{ _data.get('attack_type', '') }}"
  client: "{{ _data.get('client', '') }}"
  client_ip: "{{ _data.get('client_ip', '') }}"
  name: "{{ _data.get('name', '') }}"
  account: "{{ _data.get('account', '') }}"
  threat_level: "{{ _data.get('threat_level', '') }}"
alertmanager_labels:
  level: "警告"
  alert_source: "elastalert"
  alert_type: "hfish"
  client_ip: "{{src_ip}}"

...
# 路由配置中可以指定使用企微接收器
route:
  group_by: ['alertname', 'client_ip']
  group_wait: 30s
  group_interval: 10s
  repeat_interval: 1h
  receiver: 'prometheusalert-weixin-hfish'
  routes:
  - receiver: 'prometheusalert-weixin-hfish'
    group_wait: 5s
    match:
      alert_source: elastalert
      alert_type: hfish
receivers:
  - name: 'prometheusalert-weixin-hfish'
    webhook_configs:
      - url: 'https://promealert.evling.tech/prometheusalert?type=wx&tpl=prometheus-wx-hfish&wxurl=https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=your_wx_key&at=aaronnellis'
        send_resolved: false

{{ $var := .externalURL}}{{ range $k,$v:=.alerts }}{{if eq $v.status "resolved"}}[PROMETHEUS-恢复信息]({{$v.generatorURL}})
> **[{{$v.labels.alertname}}]({{$var}})**
> <font color="info">告警级别:</font> {{$v.labels.level}}
> <font color="info">开始时间:</font> {{$v.startsAt}}
> <font color="info">结束时间:</font> {{$v.endsAt}}
> <font color="info">故障主机IP:</font> {{$v.labels.instance}}
> <font color="info">**{{$v.annotations.description}}**</font>{{else}}[家庭云生活-安全告警]({{$v.generatorURL}})
> **[{{$v.labels.alertname}}]({{$var}})**
> <font color="warning">告警级别:</font> {{$v.labels.level}}
> <font color="warning">告警时间:</font> {{GetCSTtime $v.startsAt}}
> <font color="warning">攻击者IP:</font> {{$v.labels.client_ip}}
{{- if $v.annotations.geo}}
> <font color="warning">地理位置:</font> {{$v.annotations.geo}}
{{- end}}
> <font color="warning">攻击时间:</font> {{GetCSTtime $v.annotations.created_at}}
> <font color="warning">攻击类型:</font> {{$v.annotations.attack_type}}
> <font color="warning">节点名称:</font> {{$v.annotations.client}}
> <font color="warning">节点IP:</font> {{$v.annotations.client_ip}}
> <font color="warning">蜜罐名称:</font> {{$v.annotations.name}}
{{- if $v.annotations.account}}
> <font color="warning">账号信息:</font> {{$v.annotations.account}}
{{- end}}
> <font color="warning">威胁等级:</font> {{$v.annotations.threat_level}}
> <font color="warning">应急处置:</font> [立即封禁该IP](https://api-dc.evling.tech/deny/{{$v.labels.client_ip}}){{end}}{{ end }}
{{ $urimsg:=""}}{{ range $key,$value:=.commonLabels }}{{$urimsg =  print $urimsg $key "%3D%22" $value "%22%2C" }}{{end}}[*** 点我屏蔽该告警]({{$var}}/#/silences/new?filter=%7B{{SplitString $urimsg 0 -3}}%7D)