mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-17 05:31:34 +01:00
10 lines
825 B
JSON
10 lines
825 B
JSON
[
|
|
{ "name": "Group By Name, Module", "query": "* | groupby rule.name event.module event.severity_label" },
|
|
{ "name": "Group By Sensor, Source IP/Port, Destination IP/Port, Name", "query": "* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label" },
|
|
{ "name": "Group By Source IP, Name", "query": "* | groupby source.ip rule.name event.severity_label" },
|
|
{ "name": "Group By Source Port, Name", "query": "* | groupby source.port rule.name event.severity_label" },
|
|
{ "name": "Group By Destination IP, Name", "query": "* | groupby destination.ip rule.name event.severity_label" },
|
|
{ "name": "Group By Destination Port, Name", "query": "* | groupby destination.port rule.name event.severity_label" },
|
|
{ "name": "Ungroup", "query": "*" }
|
|
]
|