diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index 7f08b79ba..4eabb7c48 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -16,6 +16,7 @@ {%- import_json "soc/files/soc/alerts.eventfields.json" as alerts_eventfields %} {%- import_json "soc/files/soc/hunt.queries.json" as hunt_queries %} {%- import_json "soc/files/soc/hunt.eventfields.json" as hunt_eventfields %} +{%- import_json "soc/files/soc/dashboards.queries.json" as dashboards_queries %} {%- import_json "soc/files/soc/cases.queries.json" as cases_queries %} {%- import_json "soc/files/soc/cases.eventfields.json" as cases_eventfields %} {%- import_json "soc/files/soc/menu.actions.json" as menu_actions %} @@ -169,6 +170,26 @@ "queries": {{ hunt_queries | json }}, "actions": {{ menu_actions | json }} }, + "dashboards": { + "advanced": true, + "groupItemsPerPage": 10, + "groupFetchLimit": 10, + "eventItemsPerPage": 10, + "eventFetchLimit": 100, + "relativeTimeValue": 24, + "relativeTimeUnit": 30, + "mostRecentlyUsedLimit": 5, + "ackEnabled": false, + "escalateEnabled": true, + "escalateRelatedEventsEnabled": {{ 'true' if CASE_MODULE == 'soc' else 'false' }}, + "eventFields": {{ hunt_eventfields | json }}, + "queryBaseFilter": "", + "queryToggleFilters": [ + { "name": "caseExcludeToggle", "filter": "NOT _index:\"*:so-case*\"", "enabled": true } + ], + "queries": {{ dashboards_queries | json }}, + "actions": {{ menu_actions | json }} + }, "job": { "actions": {{ menu_actions | json }} },