Alert Scripts - Script Arguments - Field Format

Graylog Central (peer support)
,
1

I posted about this before but I still don’t have a solution - I have narrowed it down to what parameters are put in for script arguments in Graylog. If I put static information on the script Arguments Line, the script itself runs. What I need is the correct way to put in parameters based off of fields in the alert.

Has anyone passed in field data via Script arguments on an Alert Notification?

The metadata on the Script Argument Line is:

<UserName> <WorkstationName> <UserEmail> <Event Time>

If I put in static information like:

"tmacgbay" "Batcave-PC2" "Robin@batcave.com" "10-5-22"

then the outcome is as expected where Robin@batcave.com will receive an e-mail

I have tried the following that would pull data from the alerted on message

"${event.fields.winlog_event_data_TargetUserName}"   "${event.fields.winlog_event_data_TargetDomainName}" "${event.fields.user_email}"  "${event.fields.event_created}"

Or having it look more like the documentation (taking out the .fields.)

"${event.winlog_event_data_TargetUserName}"   "${event.winlog_event_data_TargetDomainName}" "${event.user_email}"  "${event.event_created}"

I have also tried removing the quotes…

If you have an example of using Alerts Scripting and passing parameters, can you post it here?

2

Hey,

I just started my GL operation docker server back up. I think I can test this out.`

3

Where do I send the coffee?

2 Likes
4

Ok so I have a slight problem, I’m using Docker Enterprise image and through in the Default example of Graylog alert script from the doc’s.

Jumping through hurdles right now. Permission issues, unable to locate script issues. TBH it is a good leaning lesson :laughing:

1 Like
5

@tmacgbay
I’ve been banging at it, so far I’m at this point.

Error: Script invocation failed: [Cannot run program "/usr/share/graylog/scripts/alert_script.py" (in directory "/usr/share/graylog/scripts"): error=13, Permission denied]

Adjust the permissions, added the X bit on the file. made sure Graylog had access to it.

  1. I’m using Docker which I not so good at it for troubleshooting.
  2. Never used Script to send mail.

Bonus, I’m learning :+1:

This might have to do with Python and access the docker container, not sure thou

6

If I put static data for the fields it runs fine and sends the e-mail. But ${event.fields.event_time} and the like don’t work. I did change the script a bit since first post, I will put that in when I get to a computer.

Hope you Friday night is fun!

7

thanks Tad,
yeah I cant wait to get home tonight. to much is going on here and I’m tired of looking at server lights and little black boxes :laughing:

1 Like
8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.