CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'remotes/origin/dev' into issue/6810

Browse Source
This commit is contained in:
m0duspwnens
2022-01-18 09:13:10 -05:00
parent 3bd26f05d4 71da74fd00
commit 87999453f2
3 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
salt/elasticsearch/templates/so/so-case-template.json.jinja
View File

@@ -244,6 +244,26 @@
"message": {
"type": "text"
},
"scan":{
"type":"object",
"dynamic": true,
"properties":{
"exiftool":{
"type":"text"
},
"pe":{
"properties":{
"sections":{
"properties":{
"entropy":{
"type": "float"
}
}
}
}
}
}
},
"tags": {
"type": "keyword",
"ignore_above": 1024

11
salt/elasticsearch/templates/so/so-common-template.json.jinja
View File

@@ -734,6 +734,17 @@
"properties":{
"exiftool":{
"type":"text"
},
"pe":{
"properties":{
"sections":{
"properties":{
"entropy":{
"type": "float"
}
}
}
}
}
}
},

2
salt/soc/files/soc/cases.queries.json
View File

@@ -1,5 +1,7 @@
[
{ "name": "Open Cases", "query": "NOT case.status:closed AND NOT case.category:template" },
{ "name": "Closed Cases", "query": "case.status:closed AND NOT case.category:template" },
{ "name": "My Open Cases", "query": "NOT case.status:closed AND NOT case.category:template AND case.assigneeId:{myId}" },
{ "name": "My Closed Cases", "query": "case.status:closed AND NOT case.category:template AND case.assigneeId:{myId}" },
{ "name": "Templates", "query": "case.category:template" }
]