Create ticket via PocketBase API

[trunishka]

Hi! I'm currently testing the possible load for Catalyst by creating numerous tickets (alerts) at once. But the only approach to create a ticket is but making a webhook to a python script that will create that ticket (according to documentation on reactions). So this looks a bit resource consuming, taking into consideration the possibility of creation more than 10 alerts at once.
There is an API webhook in PacketBase itself for CRUD actions but I failed to create an alert using that functionality. My assumption is that I need the CATALYST TOKEN like the one, from python script
# Connect to the PocketBase server client = PocketBase('http://127.0.0.1:8090') client.auth_store.save(token=os.environ["CATALYST_TOKEN"])
Can you clarify if there is an option to create alerts (tickets) via PacketBase API? If so, what are the required fields for this?

[cugu]

Hi @trunishka ,
There is an example reaction doing this in the documentation: http://catalyst.security-brewery.com/docs/catalyst/engineer/reaction/examples/ingest_alerts. You need a name and type. You also probably want to set open to true.

This example is also implemented in the demo instance: https://try.catalyst.security-brewery.com/ui/reactions and you can try it with curl curl -H "Authorization: Bearer 1234567890" https://try.catalyst.security-brewery.com/reaction/webhook -d '{"name":"my alert"}'.

Please note that you need to set the correct app url in the admin settings.

[trunishka]

Hi, @cugu!

The example you provided is the exact reason I created this discussion.
I am testing the possible processing capacity for Catalyst to ingest multiple tickets at once.
I was using the previous version of Catalyst ever since there was a keycloack as auth system and there were some "DoS/DDoS" cases, when your source systems (like EDR/SIEM/IDS) generates multiple alerts at once (for previous versions it was more than 500 alerts at once).
So, taking into consideration this aspect, i'm reproducing "DoS/DDoS" usecase on a new Catalyst architecture.
I have a VM machine with 8 GB of RAM for Catalyst and generating requests to the endpoint, mentioned by you (http://catalyst.security-brewery.com/docs/catalyst/engineer/reaction/examples/ingest_alerts).

What I noticed is that each request for alert generation takes about 3 seconds to response (if run one by one) and if run 50 at once - approximately 10 sec. for all.
But when i try to run 100 requests at once - they DoS the Catalyst. That is why i'm asking if there any other approach to ingest tickets, without triggering "reaction" with python script. Because I assume that triggering multiple python interpreters at once can cause a huge impact on performance.

This uscase is needed when your alert generating system (like EDR/SIEM/IDS) detects different suspicious actions at once (or just creates a lot of FP).

[cugu]

i'm asking if there any other approach to ingest tickets, without triggering "reaction" with python script

You could create a service user and use one of the pocketbase SDKs directly: Python, Dart or JavaScript. The python script would look similar to the internal script, but triggered externally.

[trunishka]

thanks it helped!