CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Added TemplateDetections To Detection ClientParams

Browse Source 
The UI can now insert templates when you select a Detection language. These are those templates, annotated.
This commit is contained in:
Corey Ogburn
2024-05-30 15:59:03 -06:00
parent fb8929ea37
commit 85c269e697
2 changed files with 45 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
salt/soc/defaults.yaml
View File

@@ -2253,3 +2253,36 @@ soc:
severityTranslations:
minor: low
major: high
templateDetections:
suricata: |
alert tcp any any <> any any (msg:""; sid:[publicId];)
strelka: |
rule {
meta:
description = "";
strings:
$x = \"string\";
condition:
all of them;
}
elastalert: |
title:
id: [publicId]
status:
description:
references:
-
author:
date:
tags:
-
logsource:
product:
category:
detection:
selection:
condition: selection
falsepositives:
-
level:

13
salt/soc/soc_soc.yaml
View File

@@ -119,7 +119,7 @@ soc:
advanced: True
rulesRepos:
default: &eerulesRepos
description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Elastalert --> Full Update."
description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections --> Options dropdown menu --> Elastalert --> Full Update."
global: True
advanced: True
forcedType: "[]{}"
@@ -319,6 +319,17 @@ soc:
cases: *appSettings
dashboards: *appSettings
detections: *appSettings
detection:
templateDetections:
suricata:
description: The template used when creating a new Suricata detection. [publicId] will be replaced with an unused Public Id.
multiline: True
strelka:
description: The template used when creating a new Strelka detection.
multiline: True
elastalert:
description: The template used when creating a new ElastAlert detection. [publicId] will be replaced with an unused Public Id.
multiline: True
grid:
maxUploadSize:
description: The maximum number of bytes for an uploaded PCAP import file.