diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index e0a5206bc..d96e41a70 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1447,13 +1447,6 @@ soc: casesEnabled: true detectionsEnabled: true inactiveTools: ['toolUnused'] - detectionEngineStatusQueries: - suricata: - IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"suricata"' - elastalert: - IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"elastalert"' - strelka: - IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"strelka"' tools: - name: toolKibana description: toolKibanaHelp @@ -2270,6 +2263,13 @@ soc: - name: "Detections with Overrides" query: "_exists_:so_detection.overrides | groupby so_detection.language | groupby so_detection.ruleset so_detection.isEnabled" description: Show Detections that have Overrides + detectionEngineStatusQueries: + suricata: + IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"suricata"' + elastalert: + IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"elastalert"' + strelka: + IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"strelka"' detection: showUnreviewedAiSummaries: false presets: diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml index af4668fc2..06f562a6a 100644 --- a/salt/soc/soc_soc.yaml +++ b/salt/soc/soc_soc.yaml @@ -461,7 +461,12 @@ soc: alerts: *appSettings cases: *appSettings dashboards: *appSettings - detections: *appSettings + detections: + <<: *appSettings + detectionEngineStatusQueries: + description: Queries mapped to the detection engine status. + global: True + forcedType: "{}" detection: showUnreviewedAiSummaries: description: Show AI summaries in detections even if they have not yet been reviewed by a human.