CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 01:32:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add rule.uuid to default groupbys

Browse Source
This commit is contained in:
DefensiveDepth
2024-05-21 17:45:56 -04:00
parent 556fdfdcf9
commit 3992ef1082
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
salt/soc/defaults.yaml
View File

@@ -2020,6 +2020,7 @@ soc:
- event_data.destination.port - event_data.destination.port
- event_data.process.executable - event_data.process.executable
- event_data.process.pid - event_data.process.pid
- rule.uuid
':sigma:': ':sigma:':
- soc_timestamp - soc_timestamp
- event.dataset - event.dataset
@@ -2033,6 +2034,7 @@ soc:
- event_data.destination.port - event_data.destination.port
- event_data.process.executable - event_data.process.executable
- event_data.process.pid - event_data.process.pid
- rule.uuid
':strelka:': ':strelka:':
- soc_timestamp - soc_timestamp
- event.dataset - event.dataset
@@ -2042,6 +2044,7 @@ soc:
- file.source - file.source
- file.mime_type - file.mime_type
- log.id.fuid - log.id.fuid
- rule.uuid
queryBaseFilter: tags:alert queryBaseFilter: tags:alert
queryToggleFilters: queryToggleFilters:
- name: acknowledged - name: acknowledged
@@ -2056,17 +2059,17 @@ soc:
- acknowledged - acknowledged
queries: queries:
- name: 'Group By Name, Module' - name: 'Group By Name, Module'
query: '* | groupby rule.name event.module* event.severity_label' query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
- name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name' - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label' query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
- name: 'Group By Source IP, Name' - name: 'Group By Source IP, Name'
query: '* | groupby source.ip rule.name event.severity_label' query: '* | groupby source.ip rule.name event.severity_label rule.uuid'
- name: 'Group By Source Port, Name' - name: 'Group By Source Port, Name'
query: '* | groupby source.port rule.name event.severity_label' query: '* | groupby source.port rule.name event.severity_label rule.uuid'
- name: 'Group By Destination IP, Name' - name: 'Group By Destination IP, Name'
query: '* | groupby destination.ip rule.name event.severity_label' query: '* | groupby destination.ip rule.name event.severity_label rule.uuid'
- name: 'Group By Destination Port, Name' - name: 'Group By Destination Port, Name'
query: '* | groupby destination.port rule.name event.severity_label' query: '* | groupby destination.port rule.name event.severity_label rule.uuid'
- name: Ungroup - name: Ungroup
query: '*' query: '*'
grid: grid: