CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-01-30 11:54:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update defaults.yaml to replace remaining instances of identity_id with user.name

Browse Source
This commit is contained in:
Doug Burks
2025-05-08 09:09:26 -04:00
committed by GitHub
parent e661c73583
commit a8cb18bb2e
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
salt/soc/defaults.yaml
View File

@@ -116,14 +116,14 @@ soc:
- soc_timestamp
- event.dataset
- http_request.headers.x-real-ip
- identity_id
- user.name
- http_request.headers.user-agent
- msg
':hydra:':
- soc_timestamp
- event.dataset
- http_request.headers.x-real-ip
- identity_id
- user.name
- http_request.headers.user-agent
- msg
'::conn':
@@ -1605,7 +1605,7 @@ soc:
showSubtitle: true
- name: SOC - Auth
description: Users authenticated to SOC grouped by IP address and identity
query: 'event.dataset:kratos.audit AND msg:*authenticated* | groupby http_request.headers.x-real-ip identity_id'
query: 'event.dataset:kratos.audit AND msg:*authenticated* | groupby http_request.headers.x-real-ip user.name'
showSubtitle: true
- name: SOC - App
description: Logs generated by the Security Onion Console (SOC) server and modules