From 1c55f738ec88d151bfb476f7eb668474eba32e78 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Thu, 1 Oct 2020 17:23:29 -0400 Subject: [PATCH] More json for soc --- salt/soc/files/soc/alerts.actions.default.yaml | 8 ++++++++ salt/soc/files/soc/alerts.queries.default.yaml | 13 ++++++++----- salt/soc/files/soc/hunt.actions.default.yaml | 11 ----------- salt/soc/files/soc/soc.json | 7 +------ 4 files changed, 17 insertions(+), 22 deletions(-) create mode 100644 salt/soc/files/soc/alerts.actions.default.yaml delete mode 100644 salt/soc/files/soc/hunt.actions.default.yaml diff --git a/salt/soc/files/soc/alerts.actions.default.yaml b/salt/soc/files/soc/alerts.actions.default.yaml new file mode 100644 index 000000000..e30fe64c9 --- /dev/null +++ b/salt/soc/files/soc/alerts.actions.default.yaml @@ -0,0 +1,8 @@ +soc: + alerts: + actions: [ + { "name": "", "description": "actionHuntHelp", "icon": "fa-search", "link": "/#/hunt?q=\"{value}\" | groupby event.module event.dataset", "target": "" }, + { "name": "", "description": "actionPcapHelp", "icon": "fa-stream", "link": "/joblookup?esid={eventId}", "target": "" }, + { "name": "", "description": "actionGoogleHelp", "icon": "fab fa-google", "link": "https://www.google.com/search?q={value}", "target": "_blank" }, + { "name": "actionVirusTotal", "description": "actionVirusTotalHelp", "icon": "", "link": "https://www.virustotal.com/gui/search/{value}", "target": "_blank" } + ] \ No newline at end of file diff --git a/salt/soc/files/soc/alerts.queries.default.yaml b/salt/soc/files/soc/alerts.queries.default.yaml index e30fe64c9..69514fe94 100644 --- a/salt/soc/files/soc/alerts.queries.default.yaml +++ b/salt/soc/files/soc/alerts.queries.default.yaml @@ -1,8 +1,11 @@ soc: alerts: - actions: [ - { "name": "", "description": "actionHuntHelp", "icon": "fa-search", "link": "/#/hunt?q=\"{value}\" | groupby event.module event.dataset", "target": "" }, - { "name": "", "description": "actionPcapHelp", "icon": "fa-stream", "link": "/joblookup?esid={eventId}", "target": "" }, - { "name": "", "description": "actionGoogleHelp", "icon": "fab fa-google", "link": "https://www.google.com/search?q={value}", "target": "_blank" }, - { "name": "actionVirusTotal", "description": "actionVirusTotalHelp", "icon": "", "link": "https://www.virustotal.com/gui/search/{value}", "target": "_blank" } + queries: [ + { "name": "Group By Name, Module", "query": "* | groupby rule.name rule.uuid event.module event.severity_label" }, + { "name": "Group By Sensor, Source IP/Port, Destination IP/Port, Name", "query": "* | groupby observer.name source.ip source.port destination.ip destination.port rule.name rule.uuid network.community_id event.severity_label" }, + { "name": "Group By Source IP, Name", "query": "* | groupby source.ip rule.name rule.uuid event.severity_label" }, + { "name": "Group By Source Port, Name", "query": "* | groupby source.port rule.name rule.uuid event.severity_label" }, + { "name": "Group By Destination IP, Name", "query": "* | groupby destination.ip rule.name rule.uuid event.severity_label" }, + { "name": "Group By Destination Port, Name", "query": "* | groupby destination.port rule.name rule.uuid event.severity_label" }, + { "name": "Ungroup", "query": "*" } ] \ No newline at end of file diff --git a/salt/soc/files/soc/hunt.actions.default.yaml b/salt/soc/files/soc/hunt.actions.default.yaml deleted file mode 100644 index 4f2a07f53..000000000 --- a/salt/soc/files/soc/hunt.actions.default.yaml +++ /dev/null @@ -1,11 +0,0 @@ -soc: - hunt: - actions: [ - { "name": "Group By Name, Module", "query": "* | groupby rule.name rule.uuid event.module event.severity_label" }, - { "name": "Group By Sensor, Source IP/Port, Destination IP/Port, Name", "query": "* | groupby observer.name source.ip source.port destination.ip destination.port rule.name rule.uuid network.community_id event.severity_label" }, - { "name": "Group By Source IP, Name", "query": "* | groupby source.ip rule.name rule.uuid event.severity_label" }, - { "name": "Group By Source Port, Name", "query": "* | groupby source.port rule.name rule.uuid event.severity_label" }, - { "name": "Group By Destination IP, Name", "query": "* | groupby destination.ip rule.name rule.uuid event.severity_label" }, - { "name": "Group By Destination Port, Name", "query": "* | groupby destination.port rule.name rule.uuid event.severity_label" }, - { "name": "Ungroup", "query": "*" } - ] \ No newline at end of file diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index 95a4a8f89..f7dace82d 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -71,12 +71,7 @@ { "name": "escalated", "filter": "event.escalated:true", "enabled": false, "exclusive": true } ], "queries": {{ alerts_queries.soc.alerts.queries | json }}, - "actions": [ - { "name": "", "description": "actionHuntHelp", "icon": "fa-crosshairs", "link": "/#/hunt?q=\"{value}\" | groupby event.module event.dataset", "target": "_blank" }, - { "name": "", "description": "actionPcapHelp", "icon": "fa-stream", "link": "/joblookup?esid={eventId}", "target": "_blank" }, - { "name": "", "description": "actionGoogleHelp", "icon": "fab fa-google", "link": "https://www.google.com/search?q={value}", "target": "_blank" }, - { "name": "actionVirusTotal", "description": "actionVirusTotalHelp", "icon": "", "link": "https://www.virustotal.com/gui/search/{value}", "target": "_blank" } - ] + "actions": {{ alerts_actions.soc.alerts.actions | json }} } } }