Merge pull request #10652 from Security-Onion-Solutions/cogburn/10122

FIX: Exclude System logs from Hunt/Dashboard Queries.
2025-12-06 17:22:49 +01:00 · 2023-06-23 13:48:17 -06:00
parent d247c9d704 fb27e7c479
commit 106aaa9c3e
1 changed files with 6 additions and 0 deletions
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1117,6 +1117,9 @@ soc:
            - name: caseExcludeToggle
              filter: 'NOT _index:"*:so-case*"'
              enabled: true
+            - name: socExcludeToggle
+              filter: 'NOT event.module:"soc"'
+              enabled: true
          queries:
            - name: Default Query
              description: Show all events grouped by the observer host
@@ -1384,6 +1387,9 @@ soc:
            - name: caseExcludeToggle
              filter: 'NOT _index:"*:so-case*"'
              enabled: true
+            - name: socExcludeToggle
+              filter: 'NOT event.module:"soc"'
+              enabled: true
          queries:
            - name: Overview
              description: Overview of all events