From 1bcf80dd10cedd0b678b587fea6b066dccb44292 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Tue, 13 Oct 2026 17:11:49 -0400 Subject: [PATCH] Group by assessment without a missing bucket The assessment is a number, and SOC's missing bucket only works on keyword fields, so the * made Elasticsearch fail parsing "__missing__" as a long. Untriaged alerts now drop out of this view. --- salt/soc/defaults.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 5be549e9e..f0cd8d759 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -2525,7 +2525,7 @@ soc: - name: 'Group By Name, Module' query: '* | groupby rule.name event.module* event.severity_label rule.uuid' - name: 'Group By Assessment, Name' - query: '* | groupby event.so_alerttriage.assessment* rule.name event.severity_label rule.uuid' + query: '* | groupby event.so_alerttriage.assessment rule.name event.severity_label rule.uuid' license: oai - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name' query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'