New Hunt queryToggleFilter

New filter to exclude soc logs from hunt results.
This commit is contained in:
Corey Ogburn
2023-06-20 13:15:15 -06:00
parent d247c9d704
commit 261acee8a0

View File

@@ -1117,6 +1117,9 @@ soc:
- name: caseExcludeToggle
filter: 'NOT _index:"*:so-case*"'
enabled: true
- name: socExcludeToggle
filter: 'NOT event.module:"soc"'
enabled: true
queries:
- name: Default Query
description: Show all events grouped by the observer host