CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'remotes/origin/dev' into issue/6810

Browse Source
This commit is contained in:
m0duspwnens
2022-01-19 15:35:28 -05:00
parent 67e34b2402 e984b0b9c4
commit fc65f7bb84
4 changed files with 14 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
salt/elasticsearch/templates/so/so-case-template.json.jinja
View File

@@ -36,11 +36,11 @@
"@timestamp": {
"type": "date"
},
"kind": {
"so_kind": {
"type": "keyword",
"ignore_above": 1024
},
"operation": {
"so_operation": {
"type": "keyword",
"ignore_above": 1024
},
@@ -48,7 +48,7 @@
"type": "keyword",
"ignore_above": 1024
},
"artifact": {
"so_artifact": {
"properties": {
"artifactType": {
"type": "keyword",
@@ -121,7 +121,7 @@
}
}
},
"artifactstream": {
"so_artifactstream": {
"properties": {
"content": {
"type": "text"
@@ -135,7 +135,7 @@
}
}
},
"case": {
"so_case": {
"properties": {
"assigneeId": {
"type": "keyword",
@@ -193,7 +193,7 @@
}
}
},
"comment": {
"so_comment": {
"properties": {
"caseId": {
"type": "keyword",
@@ -211,7 +211,7 @@
}
}
},
"related": {
"so_related": {
"properties": {
"caseId": {
"type": "keyword",
@@ -220,56 +220,6 @@
"createTime": {
"type": "date"
},
"fields": {
"properties": {
"@timestamp": {
"type": "date"
},
"event": {
"properties": {
"dataset": {
"type": "keyword",
"ignore_above": 1024
},
"module": {
"type": "keyword",
"ignore_above": 1024
},
"category": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"message": {
"type": "text"
},
"scan":{
"type":"object",
"dynamic": true,
"properties":{
"exiftool":{
"type":"text"
},
"pe":{
"properties":{
"sections":{
"properties":{
"entropy":{
"type": "float"
}
}
}
}
}
}
},
"tags": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"userId": {
"type": "keyword",
"ignore_above": 1024

2
salt/soc/files/soc/cases.eventfields.json
View File

@@ -1,3 +1,3 @@
{
"default": ["soc_timestamp", "case.title", "case.status", "case.severity", "case.createTime"]
"default": ["soc_timestamp", "so_case.title", "so_case.status", "so_case.severity", "so_case.createTime"]
}

10
salt/soc/files/soc/cases.queries.json
View File

@@ -1,7 +1,7 @@
[
{ "name": "Open Cases", "query": "NOT case.status:closed AND NOT case.category:template" },
{ "name": "Closed Cases", "query": "case.status:closed AND NOT case.category:template" },
{ "name": "My Open Cases", "query": "NOT case.status:closed AND NOT case.category:template AND case.assigneeId:{myId}" },
{ "name": "My Closed Cases", "query": "case.status:closed AND NOT case.category:template AND case.assigneeId:{myId}" },
{ "name": "Templates", "query": "case.category:template" }
{ "name": "Open Cases", "query": "NOT so_case.status:closed AND NOT so_case.category:template" },
{ "name": "Closed Cases", "query": "so_case.status:closed AND NOT so_case.category:template" },
{ "name": "My Open Cases", "query": "NOT so_case.status:closed AND NOT so_case.category:template AND so_case.assigneeId:{myId}" },
{ "name": "My Closed Cases", "query": "so_case.status:closed AND NOT so_case.category:template AND so_case.assigneeId:{myId}" },
{ "name": "Templates", "query": "so_case.category:template" }
]

2
salt/soc/files/soc/soc.json
View File

@@ -211,7 +211,7 @@
"viewEnabled": true,
"createLink": "/case/create",
"eventFields": {{ cases_eventfields | json }},
"queryBaseFilter": "_index:\"*:so-case\" AND kind:case",
"queryBaseFilter": "_index:\"*:so-case\" AND so_kind:case",
"queryToggleFilters": [
],
"queries": {{ cases_queries | json }},