Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FIX: Update dashboard and hunt query for firewall logs #12021

Closed
dougburks opened this issue Dec 14, 2023 · 2 comments
Closed

FIX: Update dashboard and hunt query for firewall logs #12021

dougburks opened this issue Dec 14, 2023 · 2 comments
Assignees
@dougburks
Milestone
2.4.40

Comments

@dougburks
Copy link
Contributor

dougburks commented Dec 14, 2023 •
edited

new dashboard:
observer.type:firewall | groupby -sankey event.action observer.ingress.interface.name | groupby event.action | groupby observer.ingress.interface.name | groupby network.type | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port

new hunt query:
observer.type:firewall | groupby event.action
@dougburks dougburks self-assigned this Dec 14, 2023
@dougburks dougburks added this to the 2.4.40 milestone Dec 14, 2023
dougburks added a commit that referenced this issue Dec 14, 2023
@dougburks
https://github.com/Security-Onion-Solutions/securityonion/issues/12021
042e5ae
@dougburks
Copy link
Contributor Author

dougburks commented Dec 14, 2023 •
edited

Additional commit to update columns at the bottom of Dashboards and Hunt:
8779fb8

dougburks added a commit that referenced this issue Dec 14, 2023
@dougburks
Merge pull request #12023 from Security-Onion-Solutions/2.4/fix-firew…
88684a6 
…all-queries

FIX: Update dashboard and hunt query for firewall logs #12021
dougburks added a commit that referenced this issue Dec 18, 2023
@dougburks
FIX: Update dashboard and hunt query for firewall logs #12021
6a1073b
dougburks added a commit that referenced this issue Dec 18, 2023
@dougburks
FIX: Update dashboard and hunt query for firewall logs #12021
4d8661d
dougburks added a commit that referenced this issue Dec 19, 2023
@dougburks
Merge pull request #12048 from Security-Onion-Solutions/2.4/improve-f…
5e8613f 
…ilterlog-parser

FIX: Update dashboard and hunt query for firewall logs #12021
@dougburks
Copy link
Contributor Author

Tested and verified:

image

image

image

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 20, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@dougburks dougburks

Labels
None yet
Projects
None yet
Milestone
2.4.40
Development

No branches or pull requests
1 participant
@dougburks