Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FIX: Exclude System logs from Hunt/Dashboard Queries. #10122

Closed
bryant-treacle opened this issue Apr 13, 2023 · 2 comments
Closed

FIX: Exclude System logs from Hunt/Dashboard Queries. #10122

bryant-treacle opened this issue Apr 13, 2023 · 2 comments
Assignees
@coreyogburn
Labels
2.4 Planned for 2.4.X Hunt SOC

Comments

@bryant-treacle
Copy link
Contributor

Hunt and Dashboards interfaces return SOC server and elastic_agent (Parsing Failures) logs when hunting or correlating on data. Recommend adding a toggle to exclude/include system logs from queries similar to case data.
@bryant-treacle bryant-treacle added the 2.4 Planned for 2.4.X label Apr 13, 2023
@bryant-treacle
Copy link
Contributor Author

Enabling this feature could break pivoting from the Error message in SOC to Hunt

@coreyogburn coreyogburn self-assigned this Jun 20, 2023
@dougburks
Copy link
Contributor

Tested and verified:
image

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@coreyogburn coreyogburn

Labels
2.4 Planned for 2.4.X Hunt SOC
Projects
None yet
Milestone
No milestone
Development

When branches are created from issues, their pull requests are automatically linked.

cogburn/10122 Security-Onion-Solutions/securityonion-soc
4 participants
@dougburks @jertel @bryant-treacle @coreyogburn