CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Resolve conflicts with dataset PR

Browse Source
This commit is contained in:
Doug Burks
2023-06-20 07:40:10 -04:00
committed by GitHub
parent 520a5671ca
commit 0e09d73aa0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/soc/defaults.yaml
View File

@@ -1127,7 +1127,7 @@ soc:
showSubtitle: true showSubtitle: true
- name: SOC - Auth - name: SOC - Auth
description: Users authenticated to SOC grouped by IP address and identity description: Users authenticated to SOC grouped by IP address and identity
query: 'event.module:kratos AND event.dataset:kratos.audit AND msg:authenticated | groupby http_request.headers.x-real-ip identity_id' query: 'event.dataset:kratos.audit AND msg:authenticated | groupby http_request.headers.x-real-ip identity_id'
showSubtitle: true showSubtitle: true
- name: SOC - App - name: SOC - App
description: Logs generated by the Security Onion Console (SOC) server and modules description: Logs generated by the Security Onion Console (SOC) server and modules
@@ -1389,7 +1389,7 @@ soc:
query: '* | groupby -sankey event.dataset event.category* | groupby -pie event.category | groupby -bar event.module* | groupby event.dataset | groupby event.module* | groupby event.category | groupby observer.name | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name' query: '* | groupby -sankey event.dataset event.category* | groupby -pie event.category | groupby -bar event.module* | groupby event.dataset | groupby event.module* | groupby event.category | groupby observer.name | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name'
- name: SOC Auth - name: SOC Auth
description: SOC (Security Onion Console) authentication logs description: SOC (Security Onion Console) authentication logs
query: 'event.module:kratos AND event.dataset:kratos.audit AND msg:authenticated | groupby -sankey http_request.headers.x-real-ip identity_id | groupby http_request.headers.x-real-ip | groupby identity_id | groupby http_request.headers.user-agent' query: 'event.dataset:kratos.audit AND msg:authenticated | groupby -sankey http_request.headers.x-real-ip identity_id | groupby http_request.headers.x-real-ip | groupby identity_id | groupby http_request.headers.user-agent'
- name: Elastalerts - name: Elastalerts
description: Elastalert logs description: Elastalert logs
query: '_index: "*:elastalert*" | groupby rule_name | groupby alert_info.type' query: '_index: "*:elastalert*" | groupby rule_name | groupby alert_info.type'