CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13053 from Security-Onion-Solutions/2.4/alertsefaults

Browse Source 
Add rule.uuid to default groupbys
This commit is contained in:
Josh Brower
2024-05-21 17:54:27 -04:00
committed by GitHub
parent 556fdfdcf9 f9e9b825cf
commit 8b011b8d7e
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/soc/defaults.yaml
View File

@@ -2056,17 +2056,17 @@ soc:
- acknowledged
queries:
- name: 'Group By Name, Module'
query: '* | groupby rule.name event.module* event.severity_label'
query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
- name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label'
query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
- name: 'Group By Source IP, Name'
query: '* | groupby source.ip rule.name event.severity_label'
query: '* | groupby source.ip rule.name event.severity_label rule.uuid'
- name: 'Group By Source Port, Name'
query: '* | groupby source.port rule.name event.severity_label'
query: '* | groupby source.port rule.name event.severity_label rule.uuid'
- name: 'Group By Destination IP, Name'
query: '* | groupby destination.ip rule.name event.severity_label'
query: '* | groupby destination.ip rule.name event.severity_label rule.uuid'
- name: 'Group By Destination Port, Name'
query: '* | groupby destination.port rule.name event.severity_label'
query: '* | groupby destination.port rule.name event.severity_label rule.uuid'
- name: Ungroup
query: '*'
grid: