mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
Merge remote-tracking branch 'remotes/origin/dev' into issue/6810
This commit is contained in:
@@ -244,6 +244,26 @@
|
|||||||
"message": {
|
"message": {
|
||||||
"type": "text"
|
"type": "text"
|
||||||
},
|
},
|
||||||
|
"scan":{
|
||||||
|
"type":"object",
|
||||||
|
"dynamic": true,
|
||||||
|
"properties":{
|
||||||
|
"exiftool":{
|
||||||
|
"type":"text"
|
||||||
|
},
|
||||||
|
"pe":{
|
||||||
|
"properties":{
|
||||||
|
"sections":{
|
||||||
|
"properties":{
|
||||||
|
"entropy":{
|
||||||
|
"type": "float"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
"tags": {
|
"tags": {
|
||||||
"type": "keyword",
|
"type": "keyword",
|
||||||
"ignore_above": 1024
|
"ignore_above": 1024
|
||||||
|
|||||||
@@ -734,7 +734,18 @@
|
|||||||
"properties":{
|
"properties":{
|
||||||
"exiftool":{
|
"exiftool":{
|
||||||
"type":"text"
|
"type":"text"
|
||||||
}
|
},
|
||||||
|
"pe":{
|
||||||
|
"properties":{
|
||||||
|
"sections":{
|
||||||
|
"properties":{
|
||||||
|
"entropy":{
|
||||||
|
"type": "float"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"server":{
|
"server":{
|
||||||
|
|||||||
@@ -1,5 +1,7 @@
|
|||||||
[
|
[
|
||||||
{ "name": "Open Cases", "query": "NOT case.status:closed AND NOT case.category:template" },
|
{ "name": "Open Cases", "query": "NOT case.status:closed AND NOT case.category:template" },
|
||||||
{ "name": "Closed Cases", "query": "case.status:closed AND NOT case.category:template" },
|
{ "name": "Closed Cases", "query": "case.status:closed AND NOT case.category:template" },
|
||||||
|
{ "name": "My Open Cases", "query": "NOT case.status:closed AND NOT case.category:template AND case.assigneeId:{myId}" },
|
||||||
|
{ "name": "My Closed Cases", "query": "case.status:closed AND NOT case.category:template AND case.assigneeId:{myId}" },
|
||||||
{ "name": "Templates", "query": "case.category:template" }
|
{ "name": "Templates", "query": "case.category:template" }
|
||||||
]
|
]
|
||||||
Reference in New Issue
Block a user