CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add dashboard ref to soc.json

Browse Source
This commit is contained in:
Jason Ertel
2022-05-06 15:15:55 -04:00
parent 9800f59ed7
commit 0786191fc9
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
salt/soc/files/soc/soc.json
View File

@@ -16,6 +16,7 @@
{%- import_json "soc/files/soc/alerts.eventfields.json" as alerts_eventfields %} {%- import_json "soc/files/soc/alerts.eventfields.json" as alerts_eventfields %}
{%- import_json "soc/files/soc/hunt.queries.json" as hunt_queries %} {%- import_json "soc/files/soc/hunt.queries.json" as hunt_queries %}
{%- import_json "soc/files/soc/hunt.eventfields.json" as hunt_eventfields %} {%- import_json "soc/files/soc/hunt.eventfields.json" as hunt_eventfields %}
{%- import_json "soc/files/soc/dashboards.queries.json" as dashboards_queries %}
{%- import_json "soc/files/soc/cases.queries.json" as cases_queries %} {%- import_json "soc/files/soc/cases.queries.json" as cases_queries %}
{%- import_json "soc/files/soc/cases.eventfields.json" as cases_eventfields %} {%- import_json "soc/files/soc/cases.eventfields.json" as cases_eventfields %}
{%- import_json "soc/files/soc/menu.actions.json" as menu_actions %} {%- import_json "soc/files/soc/menu.actions.json" as menu_actions %}
@@ -169,6 +170,26 @@
"queries": {{ hunt_queries | json }}, "queries": {{ hunt_queries | json }},
"actions": {{ menu_actions | json }} "actions": {{ menu_actions | json }}
}, },
"dashboards": {
"advanced": true,
"groupItemsPerPage": 10,
"groupFetchLimit": 10,
"eventItemsPerPage": 10,
"eventFetchLimit": 100,
"relativeTimeValue": 24,
"relativeTimeUnit": 30,
"mostRecentlyUsedLimit": 5,
"ackEnabled": false,
"escalateEnabled": true,
"escalateRelatedEventsEnabled": {{ 'true' if CASE_MODULE == 'soc' else 'false' }},
"eventFields": {{ hunt_eventfields | json }},
"queryBaseFilter": "",
"queryToggleFilters": [
{ "name": "caseExcludeToggle", "filter": "NOT _index:\"*:so-case*\"", "enabled": true }
],
"queries": {{ dashboards_queries | json }},
"actions": {{ menu_actions | json }}
},
"job": { "job": {
"actions": {{ menu_actions | json }} "actions": {{ menu_actions | json }}
}, },