Merge pull request #10416 from Security-Onion-Solutions/2.4/smallfixes

2.4/EQL

salt/elasticfleet/files/integrations/endpoints-initial/elastic-defend-endpoints.json

@@ -0,0 +1,28 @@
+{
+	"name": "elastic-defend-endpoints",
+	"namespace": "default",
+	"description": "",
+	"package": {
+		"name": "endpoint",
+		"title": "Elastic Defend",
+		"version": ""
+	},
+	"enabled": true,
+	"policy_id": "endpoints-initial",
+	"vars": {},
+	"inputs": [{
+		"type": "endpoint",
+		"enabled": true,
+		"streams": [],
+		"config": {
+			"integration_config": {
+				"value": {
+					"type": "endpoint",
+					"endpointConfig": {
+						"preset": "DataCollection"
+					}
+				}
+			}
+		}
+	}]
+}

salt/soctopus/files/templates/generic.template

@@ -12,3 +12,13 @@ play_url: "https://{{ GLOBALS.url_base }}/playbook/issues/6000"
 kibana_pivot: "https://{{ GLOBALS.url_base }}/kibana/app/kibana#/discover?_g=()&_a=(columns:!(_source),interval:auto,query:(language:lucene,query:'_id:{[_id]}'),sort:!('@timestamp',desc))"
 soc_pivot: "https://{{ GLOBALS.url_base }}/#/hunt"
 sigma_level: ""
+
+index: '.ds-logs-*'
+name: EQL
+priority: 3
+realert:
+  minutes: 0
+type: any
+filter:
+- query:
+    query_string: