mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-21 08:23:08 +01:00
New Hunt queryToggleFilter
New filter to exclude soc logs from hunt results.
This commit is contained in:
@@ -1117,6 +1117,9 @@ soc:
|
||||
- name: caseExcludeToggle
|
||||
filter: 'NOT _index:"*:so-case*"'
|
||||
enabled: true
|
||||
- name: socExcludeToggle
|
||||
filter: 'NOT event.module:"soc"'
|
||||
enabled: true
|
||||
queries:
|
||||
- name: Default Query
|
||||
description: Show all events grouped by the observer host
|
||||
|
||||
Reference in New Issue
Block a user