Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FIX: Update dashboard and hunt query for firewall logs #12021 #12023

Merged
merged 2 commits into from
Dec 14, 2023
Merged

FIX: Update dashboard and hunt query for firewall logs #12021 #12023

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
042e5ae
https://github.com/Security-Onion-Solutions/securityonion/issues/12021
dougburks Dec 14, 2023
8779fb8
Update defaults.yaml
dougburks Dec 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions salt/soc/defaults.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,6 +470,18 @@ soc:
- rule.action
- rule.reason
- network.community_id
':pfsense:':
- soc_timestamp
- source.ip
- source.port
- destination.ip
- destination.port
- network.transport
- network.direction
- observer.ingress.interface.name
- event.action
- event.reason
- network.community_id
':osquery:':
- soc_timestamp
- source.ip
Expand Down Expand Up @@ -1348,7 +1360,7 @@ soc:
showSubtitle: true
- name: Firewall
description: Firewall events grouped by action
query: 'tags:firewall | groupby rule.action'
query: 'observer.type:firewall | groupby event.action'
showSubtitle: true
dashboards:
advanced: true
Expand Down Expand Up @@ -1551,7 +1563,7 @@ soc:
query: 'tags:s7* | groupby -sankey event.dataset source.ip destination.ip | groupby event.dataset | groupby source.ip | groupby destination.ip | groupby destination.port'
- name: Firewall
description: Firewall logs
query: 'tags:firewall | groupby -sankey rule.action interface.name | groupby rule.action | groupby interface.name | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port'
query: 'observer.type:firewall | groupby -sankey event.action observer.ingress.interface.name | groupby event.action | groupby observer.ingress.interface.name | groupby network.type | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port'
- name: VLAN
description: VLAN (Virtual Local Area Network) tagged logs
query: '* AND _exists_:network.vlan.id | groupby network.vlan.id | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby event.dataset | groupby event.module | groupby observer.name | groupby source.geo.country_name | groupby destination.geo.country_name'
Expand Down
Loading