Merge pull request #12724 from Security-Onion-Solutions/dougburks-pat…

…ch-1 FEATURE: Add Events table columns for event.module strelka #12716
Security-Onion-Solutions · Apr 2, 2024 · a678a5a · a678a5a
2 parents 55e71c8 + b2b54cc
commit a678a5a
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
@@ -1893,7 +1893,16 @@ soc:
               - event_data.destination.host
               - event_data.destination.port
               - event_data.process.executable
-              - event_data.process.pid
+              - event_data.process.pid    
+            ':strelka:':
+              - soc_timestamp
+              - file.name
+              - file.size
+              - hash.md5
+              - file.source
+              - file.mime_type
+              - log.id.fuid
+              - event.dataset
           queryBaseFilter: tags:alert
           queryToggleFilters:
             - name: acknowledged