Skip to content

Commit

Permalink
add sentinel notification plugin doc (#486)
Browse files Browse the repository at this point in the history
  • Loading branch information
blotus authored Nov 20, 2023
1 parent e15ce04 commit 051f700
Show file tree
Hide file tree
Showing 2 changed files with 83 additions and 0 deletions.
82 changes: 82 additions & 0 deletions crowdsec-docs/docs/notification_plugins/sentinel.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
---
id: sentinel
title: Sentinel Plugin
---

The sentinel plugin is by default shipped with your CrowdSec installation. The following guide shows how to enable it.

## Enabling the plugin:

In your profile file (by default `/etc/crowdsec/profiles.yaml`) , uncomment the section
```
#notifications:
# - sentinel_default
```

## Configuring the plugin:

### Adding the plugin configuration

By default there would be a sentinel config at `/etc/crowdsec/notifications/sentinel.yaml`.
You will need to specify:
- customer_id
- shared_key
- log_type

Example config:

```yaml
type: sentinel # Don't change
name: sentinel_default # Must match the registered plugin in the profile

# One of "trace", "debug", "info", "warn", "error", "off"
log_level: info
# group_wait: # Time to wait collecting alerts before relaying a message to this plugin, eg "30s"
# group_threshold: # Amount of alerts that triggers a message before <group_wait> has expired, eg "10"
# max_retry: # Number of attempts to relay messages to plugins in case of error
# timeout: # Time to wait for response from the plugin before considering the attempt a failure, eg "10s"

#-------------------------
# plugin-specific options

# The following template receives a list of models.Alert objects
# The output goes in the http request body
format: |
{{.|toJson}}
customer_id: XXX-XXX
shared_key: XXXXXXX
log_type: crowdsec

```
**Note** that the `format` is a [go template](https://pkg.go.dev/text/template), which is fed a list of [Alert](https://pkg.go.dev/github.com/crowdsecurity/crowdsec@master/pkg/models#Alert) objects.

### Configuration options

#### customer_id

Also known as the `workspace id`.
You can get it from the azure portal in `Log Analytics workspace` -> `YOUR_WORKSPACE` -> `Settings` -> `Agents`

#### shared_key

Also known as the `primary key`.
You can get it from the azure portal in `Log Analytics workspace` -> `YOUR_WORKSPACE` -> `Settings` -> `Agents`

#### log_type

The log type is the name of the log that will be sent to azure.

Assuming you chose `crowdsec`, it will appear as `crowdsec_CL` in azure.


## Final Steps:

Let's restart crowdsec

```bash
sudo systemctl restart crowdsec
```

You can verify whether the plugin is properly working by triggering scenarios using tools like wapiti, nikto etc.
1 change: 1 addition & 0 deletions crowdsec-docs/sidebars.js
Original file line number Diff line number Diff line change
Expand Up @@ -347,6 +347,7 @@
],
},
"notification_plugins/email",
"notification_plugins/sentinel",
"notification_plugins/slack",
"notification_plugins/splunk",
"notification_plugins/template_helpers",
Expand Down

0 comments on commit 051f700

Please sign in to comment.