From 34d9882987a3083669e12b8db86b030912c2af7f Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Thu, 14 May 2020 13:47:01 -0400 Subject: [PATCH] fix Wazuh and Sysmon queries --- salt/soc/files/soc/soc.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index eb53c77ac..88eeed8ec 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -87,12 +87,12 @@ { "name": "Elastalerts", "description": "", "query": "_type:elastalert | groupby rule.name"}, { "name": "Alerts", "description": "Show all alerts grouped by alert source", "query": "event.dataset: alert | groupby event.module"}, { "name": "NIDS Alerts", "description": "Show all NIDS alerts grouped by alert name", "query": "event.category: network AND event.dataset: alert | groupby rule.name"}, - { "name": "OSSEC Alerts", "description": "", "query": "event_type:ossec AND alert | groupby rule.category"}, - { "name": "OSSEC Commands", "description": "", "query": "event_type:ossec AND alert | groupby process.command_line"}, - { "name": "OSSEC Processes", "description": "", "query": "event_type:ossec AND alert | groupby process.name"}, - { "name": "OSSEC Users", "description": "", "query": "event_type:ossec AND alert | groupby user.name"}, - { "name": "SYSMON", "description": "", "query": "event_type:sysmon | groupby event_id"}, - { "name": "SYSMON", "description": "", "query": "event_type:sysmon | groupby username"}, + { "name": "Wazuh/OSSEC Alerts", "description": "Show all Wazuh alerts grouped by category", "query": "event.module:ossec AND event.dataset:alert | groupby rule.category"}, + { "name": "Wazuh/OSSEC Commands", "description": "Show all Wazuh alerts grouped by command line", "query": "eevent.module:ossec AND event.dataset:alert | groupby process.command_line"}, + { "name": "Wazuh/OSSEC Processes", "description": "Show all Wazuh alerts grouped by process name", "query": "event.module:ossec AND event.dataset:alert | groupby process.name"}, + { "name": "Wazuh/OSSEC Users", "description": "Show all Wazuh alerts grouped by username", "query": "event.module:ossec AND event.dataset:alert | groupby user.name"}, + { "name": "Sysmon Events", "description": "Show all Sysmon logs grouped by event_id", "query": "event_type:sysmon | groupby event_id"}, + { "name": "Sysmon Usernames", "description": "Show all Sysmon logs grouped by username", "query": "event_type:sysmon | groupby username"}, { "name": "Zeek Notice", "description": "Show notices from Zeek", "query": "event.module:zeek AND event.dataset:notice | groupby notice.note,notice.message"}, { "name": "Connections", "description": "Connections grouped by IP and Port", "query": "event.module:zeek AND event.dataset:conn | groupby source.ip,destination.ip,network.protocol,destination.port"}, { "name": "Connections", "description": "Connections grouped by Service", "query": "event.module:zeek AND event.dataset:conn | groupby network.protocol,destination.port"},