From 1e6161f89c82277a409d0051f82a0fa5a79582d9 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 23 May 2024 08:19:43 -0400
Subject: [PATCH] Update defaults.yaml

---
 salt/soc/defaults.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 6ecf1f183..86170b4ce 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1482,7 +1482,7 @@ soc:
               showSubtitle: true
             - name: Elastalerts
               description: ''
-              query: '_type:elastalert | groupby rule.name'
+              query: 'event.dataset:sigma.alert | groupby rule.name'
               showSubtitle: true
             - name: Alerts
               description: Show all alerts grouped by alert source