CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add alert events filed

Browse Source
This commit is contained in:
Mike Reeves
2020-10-01 17:49:17 -04:00
parent bd5efbabd9
commit 490278a4c3
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
salt/soc/files/soc/alerts.eventfields.default.json Normal file
View File

@@ -0,0 +1,4 @@
{
"default": ["soc_timestamp", "rule.name", "event.severity_label", "source.ip", "source.port", "destination.ip", "destination.port", "rule.gid", "rule.uuid", "rule.category", "rule.rev"],
":ossec:": ["soc_timestamp", "rule.name", "event.severity_label", "source.ip", "source.port", "destination.ip", "destination.port", "rule.level", "rule.category", "process.name", "user.name", "user.escalated", "location", "process.name" ]
}

6
salt/soc/files/soc/soc.json
View File

@@ -4,6 +4,7 @@
{%- set FEATURES = salt['pillar.get']('elastic:features', False) %}
{%- import_json "soc/files/soc/alerts.queries.default.json" as alerts_queries %}
{%- import_json "soc/files/soc/alerts.actions.default.json" as alerts_actions %}
{%- import_json "soc/files/soc/alerts.eventfields.default.json" as alerts_eventfields %}
{%- import_json "soc/files/soc/hunt.queries.default.json" as hunt_queries %}
{%- import_json "soc/files/soc/hunt.actions.default.json" as hunt_actions %}
{%- import_json "soc/files/soc/hunt.eventfields.default.json" as hunt_eventfields %}
@@ -62,10 +63,7 @@
"relativeTimeValue": 24,
"relativeTimeUnit": 30,
"mostRecentlyUsedLimit": 5,
"eventFields": {
"default": ["soc_timestamp", "rule.name", "event.severity_label", "source.ip", "source.port", "destination.ip", "destination.port", "rule.gid", "rule.uuid", "rule.category", "rule.rev"],
":ossec:": ["soc_timestamp", "rule.name", "event.severity_label", "source.ip", "source.port", "destination.ip", "destination.port", "rule.level", "rule.category", "process.name", "user.name", "user.escalated", "location", "process.name" ]
},
"eventFields": {{ alerts_eventfields }},
"queryBaseFilter": "event.dataset:alert",
"queryToggleFilters": [
{ "name": "acknowledged", "filter": "event.acknowledged:true", "enabled": false, "exclusive": true },