From 3992ef108207b88644198cb88e42860f515bf02d Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 21 May 2024 17:45:56 -0400
Subject: [PATCH 1/2] Add rule.uuid to default groupbys

---
 salt/soc/defaults.yaml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 0113f22cc..d19f7ed40 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -2020,6 +2020,7 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
+              - rule.uuid
             ':sigma:':
               - soc_timestamp
               - event.dataset
@@ -2033,6 +2034,7 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
+              - rule.uuid
             ':strelka:':
               - soc_timestamp
               - event.dataset
@@ -2042,6 +2044,7 @@ soc:
               - file.source
               - file.mime_type
               - log.id.fuid
+              - rule.uuid
           queryBaseFilter: tags:alert
           queryToggleFilters:
             - name: acknowledged
@@ -2056,17 +2059,17 @@ soc:
                 - acknowledged
           queries:
             - name: 'Group By Name, Module'
-              query: '* | groupby rule.name event.module* event.severity_label'
+              query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
-              query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label'
+              query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'
-              query: '* | groupby source.ip rule.name event.severity_label'
+              query: '* | groupby source.ip rule.name event.severity_label rule.uuid'
             - name: 'Group By Source Port, Name'
-              query: '* | groupby source.port rule.name event.severity_label'
+              query: '* | groupby source.port rule.name event.severity_label rule.uuid'
             - name: 'Group By Destination IP, Name'
-              query: '* | groupby destination.ip rule.name event.severity_label'
+              query: '* | groupby destination.ip rule.name event.severity_label rule.uuid'
             - name: 'Group By Destination Port, Name'
-              query: '* | groupby destination.port rule.name event.severity_label'
+              query: '* | groupby destination.port rule.name event.severity_label rule.uuid'
             - name: Ungroup
               query: '*'
         grid:

From f9e9b825cffe381115f9aa965f07c084001d866b Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 21 May 2024 17:53:20 -0400
Subject: [PATCH 2/2] Removed unneeded groupby

---
 salt/soc/defaults.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index d19f7ed40..15f1fd8ce 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -2020,7 +2020,6 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
-              - rule.uuid
             ':sigma:':
               - soc_timestamp
               - event.dataset
@@ -2034,7 +2033,6 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
-              - rule.uuid
             ':strelka:':
               - soc_timestamp
               - event.dataset
@@ -2044,7 +2042,6 @@ soc:
               - file.source
               - file.mime_type
               - log.id.fuid
-              - rule.uuid
           queryBaseFilter: tags:alert
           queryToggleFilters:
             - name: acknowledged