Security Automation with Ansible 2

ElastAlert rule configuration

Assuming that you already have Elastic Stack installed and logging SSH logs, use the following ElastAlert rule to trigger SSH attack IP blacklisting:

es_host: localhostes_port: 9200name: "SSH Bruteforce attack alert"type: frequencyindex: filebeat-*num_events: 20timeframe:  minutes: 1# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.htmlfilter:- query:    query_string:      query: '_type:sshlog AND login:failed AND (username: "ubuntu" OR username: "root")'alert:  - slack:      slack_webhook_url: "https://hooks.slack.com/services/xxxxx"      slack_username_override: "attack-bot"      slack_emoji_override: "robot_face" - command: ["/usr/bin/curl", "https://xxxxxxxxxxx.execute-api.us-east-1.amazonaws.com/dev/zzzzzzzzzzzzzz/ip/inframonitor/%(ip)s"] ...