From 8cfabf101c3ca97a369ee6c0a01dcced55914dae Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Sat, 10 Oct 2020 07:17:49 -0400 Subject: [PATCH] Update Hunt query for firewall #1499 --- salt/soc/files/soc/hunt.queries.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/files/soc/hunt.queries.json b/salt/soc/files/soc/hunt.queries.json index e3ed3ad8f..f2c3a633a 100644 --- a/salt/soc/files/soc/hunt.queries.json +++ b/salt/soc/files/soc/hunt.queries.json @@ -61,5 +61,5 @@ { "name": "x509", "description": "x.509 grouped by key length and name", "query": "event.dataset:x509 | groupby x509.certificate.key.length x509.san_dns"}, { "name": "x509", "description": "x.509 grouped by name and issuer", "query": "event.dataset:x509 | groupby x509.san_dns x509.certificate.issuer"}, { "name": "x509", "description": "x.509 grouped by name and subject", "query": "event.dataset:x509 | groupby x509.san_dns x509.certificate.subject"}, - { "name": "Firewall", "description": "Firewall events grouped by action", "query": "event_type:firewall | groupby action"} + { "name": "Firewall", "description": "Firewall events grouped by action", "query": "event.dataset:firewall | groupby rule.action"} ]