#3308·elastalert

How to make cmd: python -m elastalert.elastalert --verbose --rule examples/rules/test_rule.yaml to run in background

Author: sandraimmaculateCreated Jan 15, 2025Updated Jan 16, 2025

Hello, I have installed the elastalert2. I have created a rule to trigger an alert when the sudo command is executed

index: .ds-logs-auditd.log-default-*
type: any

filter:
- term:
    process.executable: "/usr/bin/sudo"

alert:
- "email"

email:
- "[email protected]"

smtp_host: smtphost
smtp_port: 8025
smtp_auth_file: smtp_auth.yaml

realert:
  minutes: 0

Whenever i run the below command

python -m elastalert.elastalert --verbose --rule examples/rules/test_rule.yaml

I'm receiving the email alert as it have to run it in background right so that whenever the sudo command is executed i will be receiving the email alert. if i created another rule how to run both of them! Please Help! Thanks in advance!