From 042e5ae9f0a3aee89a9aa6246bb5d172a52a2bcf Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Thu, 14 Dec 2023 12:46:28 -0500 Subject: [PATCH] https://github.com/Security-Onion-Solutions/securityonion/issues/12021 --- salt/soc/defaults.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 3655019e4..414bc3a53 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1348,7 +1348,7 @@ soc: showSubtitle: true - name: Firewall description: Firewall events grouped by action - query: 'tags:firewall | groupby rule.action' + query: 'observer.type:firewall | groupby event.action' showSubtitle: true dashboards: advanced: true @@ -1551,7 +1551,7 @@ soc: query: 'tags:s7* | groupby -sankey event.dataset source.ip destination.ip | groupby event.dataset | groupby source.ip | groupby destination.ip | groupby destination.port' - name: Firewall description: Firewall logs - query: 'tags:firewall | groupby -sankey rule.action interface.name | groupby rule.action | groupby interface.name | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port' + query: 'observer.type:firewall | groupby -sankey event.action observer.ingress.interface.name | groupby event.action | groupby observer.ingress.interface.name | groupby network.type | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port' - name: VLAN description: VLAN (Virtual Local Area Network) tagged logs query: '* AND _exists_:network.vlan.id | groupby network.vlan.id | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby event.dataset | groupby event.module | groupby observer.name | groupby source.geo.country_name | groupby destination.geo.country_name'