securityonion/salt/soc/files/soc/menu.actions.json

{%- set ENDGAMEHOST = salt['pillar.get']('soc:endgamehost', False) %}
[
  { "name": "actionHunt", "description": "actionHuntHelp", "icon": "fa-crosshairs", "target": "", 
            "links": [
              "/#/hunt?q=\"{value|escape}\" | groupby event.module event.dataset"
            ]},
  { "name": "actionCorrelate", "description": "actionCorrelateHelp", "icon": "fab fa-searchengin", "target": "",
            "links": [
              "/#/hunt?q=(\"{:log.id.fuid}\" OR \"{:log.id.uid}\" OR \"{:network.community_id}\") | groupby event.module event.dataset", 
              "/#/hunt?q=(\"{:log.id.fuid}\" OR \"{:log.id.uid}\") | groupby event.module event.dataset", 
              "/#/hunt?q=(\"{:log.id.fuid}\" OR \"{:network.community_id}\") | groupby event.module event.dataset", 
              "/#/hunt?q=(\"{:log.id.uid}\" OR \"{:network.community_id}\") | groupby event.module event.dataset", 
              "/#/hunt?q=\"{:log.id.fuid}\" | groupby event.module event.dataset",
              "/#/hunt?q=\"{:log.id.uid}\" | groupby event.module event.dataset", 
              "/#/hunt?q=\"{:network.community_id}\" | groupby event.module event.dataset"
            ]},
  { "name": "actionPcap", "description": "actionPcapHelp", "icon": "fa-stream", "target": "", 
            "links": [
              "/joblookup?esid={:soc_id}&time={:@timestamp}", 
              "/joblookup?ncid={:network.community_id}&time={:@timestamp}"
            ],
            "categories": ["hunt", "alerts"]},
  { "name": "actionCyberChef", "description": "actionCyberChefHelp", "icon": "fas fa-bread-slice", "target": "_blank", 
            "links": [
              "/cyberchef/#input={value|base64}"
            ]},
  { "name": "actionGoogle", "description": "actionGoogleHelp", "icon": "fab fa-google", "target": "_blank", 
            "links": [
              "https://www.google.com/search?q={value}"
            ]},
  { "name": "actionVirusTotal", "description": "actionVirusTotalHelp", "icon": "fa-external-link-alt", "target": "_blank", 
            "links": [
              "https://www.virustotal.com/gui/search/{value}"
	    ]}
 {%- if ENDGAMEHOST %}
   ,{ "name": "Endgame", "description": "Endgame Endpoint Investigation and Response", "icon": "fa-external-link-alt", "target": "_blank",
            "links": [
              "https://{{ ENDGAMEHOST }}/endpoints/{:agent.id}"
            ]}
 {% endif %}
]