CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 02:02:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Group by community ID on second alert quick query

Browse Source
This commit is contained in:
Jason Ertel
2020-09-19 08:39:01 -04:00
parent 5b38acb64b
commit fc51c2aef4
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/soc/files/soc/soc.json
View File

@@ -172,7 +172,7 @@
"querySuffix": "", "querySuffix": "",
"queries": [ "queries": [
{ "name": "Group By Name", "query": "* | groupby rule.name event.severity_label" }, { "name": "Group By Name", "query": "* | groupby rule.name event.severity_label" },
{ "name": "Group By Sensor, Source IP/Port, Destination IP/Port, Name", "query": "* | groupby observer.name source.ip source.port destination.ip destination.port rule.name event.severity_label" }, { "name": "Group By Sensor, Source IP/Port, Destination IP/Port, Name", "query": "* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label" },
{ "name": "Group By Source IP, Name", "query": "* | groupby source.ip rule.name event.severity_label" }, { "name": "Group By Source IP, Name", "query": "* | groupby source.ip rule.name event.severity_label" },
{ "name": "Group By Source Port, Name", "query": "* | groupby source.port rule.name event.severity_label" }, { "name": "Group By Source Port, Name", "query": "* | groupby source.port rule.name event.severity_label" },
{ "name": "Group By Destination IP, Name", "query": "* | groupby destination.ip rule.name event.severity_label" }, { "name": "Group By Destination IP, Name", "query": "* | groupby destination.ip rule.name event.severity_label" },