CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-02-03 13:53:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update soc defaults.yaml to include dnp3_control and dnp3_objects eventfields

Browse Source
This commit is contained in:
Doug Burks
2022-12-10 07:33:09 -05:00
committed by GitHub
parent c4ea39d1ba
commit 187ca4c453
1 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
salt/soc/defaults.yaml
View File

@@ -212,6 +212,24 @@ soc:
- destination.port
- dnp3.fc_reply
- log.id.uid
'::dnp3_control':
- soc_timestamp
- source.ip
- source.port
- destination.ip
- destination.port
- dnp3.function_code
- dnp3.block_type
- log.id.uid
'::dnp3_objects':
- soc_timestamp
- source.ip
- source.port
- destination.ip
- destination.port
- dnp3.function_code
- dnp3.object_type
- log.id.uid
'::dns':
- soc_timestamp
- source.ip
@@ -1415,6 +1433,24 @@ soc:
- destination.port
- dnp3.fc_reply
- log.id.uid
'::dnp3_control':
- soc_timestamp
- source.ip
- source.port
- destination.ip
- destination.port
- dnp3.function_code
- dnp3.block_type
- log.id.uid
'::dnp3_objects':
- soc_timestamp
- source.ip
- source.port
- destination.ip
- destination.port
- dnp3.function_code
- dnp3.object_type
- log.id.uid
'::dns':
- soc_timestamp
- source.ip