diff --git a/salt/soc/files/soc/soc.json b/salt/soc/files/soc/soc.json index f7dace82d..0dafdacaa 100644 --- a/salt/soc/files/soc/soc.json +++ b/salt/soc/files/soc/soc.json @@ -3,6 +3,7 @@ {%- set THEHIVEKEY = salt['pillar.get']('global:hivekey', '') %} {%- set FEATURES = salt['pillar.get']('elastic:features', False) %} {%- import_yaml "soc/files/soc/alerts.queries.default.yaml" as alerts_queries %} +{%- import_yaml "soc/files/soc/alerts.actions.default.yaml" as alerts_actions %} {%- import_yaml "soc/files/soc/hunt.queries.default.yaml" as hunt_queries %} {%- import_yaml "soc/files/soc/hunt.actions.default.yaml" as hunt_actions %} {%- import_yaml "soc/files/soc/hunt.eventfields.default.yaml" as hunt_eventfields %} @@ -46,7 +47,7 @@ "relativeTimeValue": 24, "relativeTimeUnit": 30, "mostRecentlyUsedLimit": 5, - "eventFields": {{ hunt_eventfields.soc.hunt.eventfields | json }} , + "eventFields": { {{ hunt_eventfields.soc.hunt.eventfields | json }} }, "queryBaseFilter": "", "queryToggleFilters": [], "queries": {{ hunt_queries.soc.hunt.queries | json }} ,