Merge branch '2.4/dev' into jertel/wip

salt/soc/defaults.yaml

@@ -284,6 +284,27 @@ soc:
         - kerberos.service
         - kerberos.request_type
         - log.id.uid
+      '::ldap':
+        - soc_timestamp
+        - event.dataset
+        - source.ip
+        - source.port
+        - destination.ip
+        - destination.port
+        - ldap.result
+        - ldap.common_name
+        - ldap.object
+        - ldap.opcode
+      '::ldap_search':
+        - soc_timestamp
+        - event.dataset
+        - source.ip
+        - source.port
+        - destination.ip
+        - destination.port
+        - ldap.result
+        - ldap.object
+        - ldap_search.filter
       '::modbus':
         - soc_timestamp
         - event.dataset
@@ -1696,23 +1717,23 @@ soc:
               showSubtitle: true
             - name: HTTP
               description: HTTP grouped by destination port
-              query: 'tags:(http OR http2) | groupby destination.port'
+              query: '(tags:http OR tags:http2) | groupby destination.port'
               showSubtitle: true
             - name: HTTP
               description: HTTP grouped by status code and message
-              query: 'tags:(http OR http2) | groupby http.status_code http.status_message'
+              query: '(tags:http OR tags:http2) | groupby http.status_code http.status_message'
               showSubtitle: true
             - name: HTTP
               description: HTTP grouped by method and user agent
-              query: 'tags:(http OR http2) | groupby http.method http.useragent'
+              query: '(tags:http OR tags:http2) | groupby http.method http.useragent'
               showSubtitle: true
             - name: HTTP
               description: HTTP grouped by virtual host
-              query: 'tags:(http OR http2) | groupby http.virtual_host'
+              query: '(tags:http OR tags:http2) | groupby http.virtual_host'
               showSubtitle: true
             - name: HTTP
               description: HTTP with exe downloads
-              query: 'tags:(http OR http2) AND file.resp_mime_types:*exec* | groupby http.virtual_host'
+              query: '(tags:http OR tags:http2) AND file.resp_mime_types:*exec* | groupby http.virtual_host'
               showSubtitle: true
             - name: Intel
               description: Intel framework hits grouped by indicator
@@ -1726,6 +1747,14 @@ soc:
               description: KERBEROS grouped by service
               query: 'tags:kerberos | groupby kerberos.service'
               showSubtitle: true
+            - name: LDAP
+              description: LDAP grouped by source ip and result
+              query: 'tags:ldap | groupby source.ip ldap.result'
+              showSubtitle: true
+            - name: LDAP_SEARCH
+              description: LDAP_SEARCH grouped by source.ip and filter
+              query: 'tags:ldap_search | groupby source.ip | groupby ldap_search.filter'
+              showSubtitle: true
             - name: MODBUS
               description: MODBUS grouped by function
               query: 'tags:modbus | groupby modbus.function'
@@ -1943,7 +1972,7 @@ soc:
               query: 'tags:ftp | groupby ftp.command | groupby -sankey ftp.command source.ip | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name | groupby ftp.argument | groupby ftp.user'
             - name: HTTP
               description: HTTP (Hyper Text Transport Protocol) network metadata
-              query: 'tags:(http OR http2) | groupby http.method | groupby -sankey http.method http.virtual_host | groupby http.virtual_host | groupby http.uri | groupby http.useragent | groupby http.status_code | groupby http.status_message | groupby file.resp_mime_types | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name'
+              query: '(tags:http OR tags:http2) | groupby http.method | groupby -sankey http.method http.virtual_host | groupby http.virtual_host | groupby http.uri | groupby http.useragent | groupby http.status_code | groupby http.status_message | groupby file.resp_mime_types | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name'
             - name: Intel
               description: Zeek Intel framework hits
               query: 'tags:intel | groupby intel.indicator | groupby -sankey intel.indicator source.ip | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby intel.indicator_type | groupby intel.seen_where'
@@ -1956,6 +1985,12 @@ soc:
             - name: Kerberos
               description: Kerberos network metadata
               query: 'tags:kerberos | groupby kerberos.service | groupby -sankey kerberos.service source.ip | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby kerberos.client | groupby kerberos.request_type'
+            - name: LDAP
+              description: LDAP (Lightweight Directory Access Protocol) network metadata
+              query: 'tags:ldap | groupby source.ip | groupby destination.ip | groupby destination.port | groupby ldap.user_email | groupby ldap.property | groupby ldap.result | groupby ldap.common_name | groupby ldap.organizational_unit | groupby ldap.domain | groupby ldap.version | groupby ldap.object'
+            - name: LDAP_SEARCH
+              description: LDAP_SEARCH (Lightweight Directory Access Protocol) Search network metadata
+              query: 'tags:ldap_search | groupby source.ip | groupby destination.ip | groupby destination.port | groupby ldap_search.scope | groupby ldap.object | groupby ldap.domain | groupby ldap_search.filter'
             - name: MySQL
               description: MySQL network metadata
               query: 'tags:mysql | groupby mysql.command | groupby -sankey mysql.command source.ip | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby mysql.argument | groupby mysql.success | groupby mysql.response | groupby mysql.rows'

salt/soc/soc_soc.yaml

@@ -438,11 +438,11 @@ soc:
           intervalMinutes:
             description: How often to generate the Navigator Layers. (minutes)
             global: True
-            helpLink: navigator.html
+            helpLink: attack-navigator.html
           lookbackDays:
             description: How far back to search for ATT&CK-tagged alerts. (days)
             global: True
-            helpLink: navigator.html
+            helpLink: attack-navigator.html
       client:
         enableReverseLookup:
           description: Set to true to enable reverse DNS lookups for IP addresses in the SOC UI.