diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index cd6b183c4..5be549e9e 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -2524,6 +2524,9 @@ soc: queries: - name: 'Group By Name, Module' query: '* | groupby rule.name event.module* event.severity_label rule.uuid' + - name: 'Group By Assessment, Name' + query: '* | groupby event.so_alerttriage.assessment* rule.name event.severity_label rule.uuid' + license: oai - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name' query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid' - name: 'Group By Source IP, Name' diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index d3e0ef5f1..28654bb8a 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -1209,6 +1209,8 @@ soc: - field: showSubtitle label: Show Query in Dropdown. forcedType: bool + - field: license + label: Only show on grids licensed for this feature, e.g. oai. Leave blank to show everywhere. queryToggleFilters: description: Customize togglable query filters that apply to all queries. Exclusive toggles will invert the filter if toggled off rather than omitting the filter from the query. global: True