diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 00c45e5c5..bcdccf9ca 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1447,6 +1447,13 @@ soc: casesEnabled: true detectionsEnabled: true inactiveTools: ['toolUnused'] + detectionEngineStatusQueries: + - suricata: + IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"suricata"' + - elastalert: + IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"elastalert"' + - strelka: + IntegrityFailure: 'tags:so-soc AND soc.fields.error: "integrity check failed; discrepancies found" AND soc.fields.detectionEngine:"strelka"' tools: - name: toolKibana description: toolKibanaHelp