Kibana enable alerting - configure encryption key

[Yuuki24]

Hi, I'm using the last Tpot version available and I'm trying to enable the alerting via Kibana.

After the installation of Tpot, in the Kibana interface under Management > Rules I see the message "Additional setup required
You must configure an encryption key to use Alerting."
I followed the indications in the documentation suggested here (https://www.elastic.co/guide/en/kibana/8.6/alert-action-settings-kb.html#general-alert-action-settings) but the problem was not resolved.

So I tried to set the env variable in the /opt/tpot/etc/tpot.yml (with various combinations suggested online ->one reference used: elastic/kibana#57773) but again no luck...

kibana:
    container_name: kibana
    restart: always
    environment:
      - XPACK_APM_SERVICEMAPENABLED=true
      - XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=b4374646f883a09a4c45e6a948ad56bb
      - XPACK_REPORTING_ENCRYPTIONKEY=1011a2a1da7c5e6a8c0598117258345d
      - XPACK_SECURITY_ENCRYPTIONKEY=072a6a6a5e83780842d7f987700a725c
    depends_on:
      elasticsearch:
        condition: service_healthy
 #mem_limit: 1g
    ports:
     - "127.0.0.1:64296:5601"
    image: "dtagdevsec/kibana:2204"

The error log that I see in Kibana is this:

[WARN ][plugins.security.config] Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command.

the env variables are setted as I can see them from the "env" command from the kibana console in portainer that was installed to have a clearer view:

kibana@42be22241b37:/$ env
HOSTNAME=42be22241b37
PWD=/
HOME=/nonexistent
XPACK_REPORTING_ENCRYPTIONKEY=1011a2a1da7c5e6a8c0598117258345d
XPACK_SECURITY_ENCRYPTIONKEY=072a6a6a5e83780842d7f987700a725c
TERM=xterm
SHLVL=1
XPACK_APM_SERVICEMAPENABLED=true
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
KB_VER=8.6.0
XPACK_ENCRYPTEDSAVEDOBJECTS_ENCRYPTIONKEY=b4374646f883a09a4c45e6a948ad56bb
_=/usr/bin/env

Any ideas to resolve this problem?
Thank you :)

[t3chn0m4g3]

It is intentionally disabled. If you want to make use of it you need to use volumes (see Wiki, Discussions, etc.) to adjust the ES and Kibana configs to your needs.

[hugoroberts1]

Hi !

First time posting on Github,

I've read every discussion talking about setting up some kind of alerts in t-pot and I think that it would be so much more easier if you could create a little guide on a few ways to do it for beginners like me. I've tried with elastalert but it never worked and when I tried to modify the logstash.conf file in order to use the email method described here #683 I broke everything while trying to rebuild the image.

Thanks for your time !

(I don't know if I was suppose to create another discussion or not, sorry in advance)

[Yuuki24]

As suggested I created a volume for elasticsearch with the different "xpack" variables enabled, but I can't understand where to mount it...I tried on /etc/elasticsearch/elasticsearch.yml and on /usr/share/elasticsearch/config/elasticsearch.yml with no success...

I really need to enable the features to create rules and send emails based on them. Can you help me?

[MauriceLe]

Has a solution been found for the problem? I'm currently in the process of implementing the same thing and also need the alerting feature.

[Brophet]

I use elastalert by adding the following to tpot.yml:
maybe this helps someone

#Elastalert
  elastalert:
      network_mode: etc_default
      container_name: elastalert
      depends_on:
        elasticsearch:
         condition: service_healthy
      environment:
       TZ: "Europe/Berlin"
      restart: always
      volumes:
          - '/opt/elastalert/elastalert.yaml:/opt/elastalert/config.yaml'
          - '/opt/elastalert/rules:/opt/elastalert/rules'
      image: ghcr.io/jertel/elastalert2/elastalert2:2.9.0

and then creating the config file and a rule file like:

/opt/elastalert/config.yaml

rules_folder: /opt/elastalert/rules
run_every:
  seconds: 30
buffer_time:
  seconds: 30
es_host: elasticsearch
es_port: 9200
writeback_index: elastalert_status
alert_time_limit:
  days: 2

/opt/elastalert/rules/emailrule.yaml

name: "mailalert"
type: "any"
index: "logstash-*"
 
filter: 
 - query:
    query_string:
     query: "t-pot_hostname: SENSORHOSTNAME" #Replace this with the actual Hostname
 
realert: 
 minutes: 0
 
aggregation: 
 minutes: 5
 
query_key: 
 - type
 
aggregation_key: 
 - type

whitelist:
- "NGINX"
compare_key: "type" 
ignore_null: true
 
alert_subject: "Rule MailAlert on {0} occurred at {1}"
alert_subject_args:
 - t-pot_hostname
 - localTime
 
alert_text: |-
 Detected connection by {}
 Details if available:
  - Sensor: {}
  - Source IP: {}
  - Destination Port: {}
  - Related Message: {}
 
alert_text_args:
 - t-pot_hostname
 - type
 - src_ip
 - dest_port
 - message

alert:
 - email:
    smtp_host: ADD SMTP HOST #Replace with smtp Hostname or IP
    from_addr: "[email protected]"
    email: "[email protected]"

for creating the configs i used
https://elastalert2.readthedocs.io/en/latest/ruletypes.html#

Best regards