CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add defaults for auto extracted observables

Browse Source
This commit is contained in:
Jason Ertel
2023-01-24 13:17:50 -05:00
parent b0709e93fa
commit 7b1f867ac3
2 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
salt/soc/defaults.yaml
View File

@@ -1020,6 +1020,9 @@ soc:
cacheMs: 300000 cacheMs: 300000
verifyCert: false verifyCert: false
casesEnabled: true casesEnabled: true
extractCommonObservables:
- source.ip
- destination.ip
timeoutMs: 300000 timeoutMs: 300000
timeShiftMs: 120000 timeShiftMs: 120000
defaultDurationMs: 1800000 defaultDurationMs: 1800000

3
salt/soc/soc_soc.yaml
View File

@@ -69,6 +69,9 @@ soc:
description: Set to true if the SOC case management module, natively integrated with Elasticsearch, should be enabled. description: Set to true if the SOC case management module, natively integrated with Elasticsearch, should be enabled.
global: True global: True
advanced: True advanced: True
extractCommonObservables:
description: List of indexed fields to automatically extract into a case observable, when attaching related events to a case.
global: True
timeShiftMs: timeShiftMs:
description: Duration (in milliseconds) to further expand the PCAP time range when querying PCAP data related to an event. This duration is added to the normal duration value (see defaultDurationMs). description: Duration (in milliseconds) to further expand the PCAP time range when querying PCAP data related to an event. This duration is added to the normal duration value (see defaultDurationMs).
global: True global: True