z1pti3 / jimiplugin-humio

Extends jimi with a number of triggers and actions interacting with humio API. This functionality can be used for advanced alerts, security events and triggering automation / ingestion

jimiPlugin-humio

Unlock jimi’s potential by adding the Humio plugin. Humio is an event log management solution but combined with jimi the possibilities are endless.

Use jimi in combination with Humio to create powerful jimiFlows that respond to your data. For example:

• Target online systems for software deployment,
• Create alerts when threshold are met ( can be done per host, per metric etc )
• Security event enrichment
• Event filtering
• Automaticaly respond to system failures and carry out automated actions

API details are required within jimi settings.json file

humio : {
  "host": "<host>",
  "port": <port>,
  "apiToken": "<apiToken>",
  "secure" : <true/false>, - Optional
  "ca" : "<CAPATH>", - Optional
  "requestTimeout": <TimeoutValue> - Optional
}

jimiplugin-humio's Issues

Poor ingest action speed

When running ingest of events each action decrypts the token which adds significant overheads when the number of events being processed per jimiFlow is higher.

An example from the code which is generated for every event:

headers = {"Authorization":"Bearer {}".format(auth.getPasswordFromENC(self.humio_ingest_token)),"Content-Type":"application/json","Accept":"application/json"}

Syntax Error on action.py

lines 164 and 177 have a syntax error missing a bracket ")" at the end of the format function

Bug - Plugin does not error or notify when job does not create

If the API call for creating the job does not work jimi does not notify or tell you just tries and tries again.