diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 244a021d3..dc836a9d7 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -20,7 +20,7 @@ soc: - dashboards - name: actionCorrelate description: actionCorrelateHelp - icon: fab fa-searchengin + icon: fa-magnifying-glass-arrow-right target: '' links: - '/#/hunt?q=("{:log.id.fuid}" OR "{:log.id.uid}" OR "{:network.community_id}") | groupby event.module* | groupby -sankey event.module* event.dataset | groupby event.dataset | groupby source.ip source.port destination.ip destination.port | groupby network.protocol | groupby source_geo.organization_name source.geo.country_name | groupby destination_geo.organization_name destination.geo.country_name | groupby rule.name rule.category event.severity_label | groupby dns.query.name | groupby file.mime_type | groupby http.virtual_host http.uri | groupby notice.note notice.message notice.sub_message | groupby ssl.server_name | groupby source.ip host.hostname user.name event.action event.type process.executable process.pid'