|
67 | 67 | "name": "query1", |
68 | 68 | "data_source": "logs", |
69 | 69 | "search": { |
70 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 70 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
71 | 71 | }, |
72 | 72 | "indexes": [ |
73 | 73 | "*" |
|
133 | 133 | "name": "query1", |
134 | 134 | "data_source": "logs", |
135 | 135 | "search": { |
136 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 136 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
137 | 137 | }, |
138 | 138 | "indexes": [ |
139 | 139 | "*" |
|
203 | 203 | "name": "query1", |
204 | 204 | "data_source": "logs", |
205 | 205 | "search": { |
206 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 206 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
207 | 207 | }, |
208 | 208 | "indexes": [ |
209 | 209 | "*" |
|
259 | 259 | "name": "query1", |
260 | 260 | "data_source": "logs", |
261 | 261 | "search": { |
262 | | - "query": "source:beyondtrust-identity-security-insights @severity:Critical @incidentType:Detection $Severity $Provider $Entity-Type" |
| 262 | + "query": "source:beyond-trust-identity-security-insights @severity:Critical @incidentType:Detection $Severity $Provider $Entity-Type" |
263 | 263 | }, |
264 | 264 | "indexes": [ |
265 | 265 | "*" |
|
311 | 311 | "name": "query1", |
312 | 312 | "data_source": "logs", |
313 | 313 | "search": { |
314 | | - "query": "source:beyondtrust-identity-security-insights @severity:High @incidentType:Detection $Severity $Provider $Entity-Type" |
| 314 | + "query": "source:beyond-trust-identity-security-insights @severity:High @incidentType:Detection $Severity $Provider $Entity-Type" |
315 | 315 | }, |
316 | 316 | "indexes": [ |
317 | 317 | "*" |
|
363 | 363 | "name": "query1", |
364 | 364 | "data_source": "logs", |
365 | 365 | "search": { |
366 | | - "query": "source:beyondtrust-identity-security-insights @severity:Moderate @incidentType:Detection $Severity $Provider $Entity-Type" |
| 366 | + "query": "source:beyond-trust-identity-security-insights @severity:Moderate @incidentType:Detection $Severity $Provider $Entity-Type" |
367 | 367 | }, |
368 | 368 | "indexes": [ |
369 | 369 | "*" |
|
415 | 415 | "name": "query1", |
416 | 416 | "data_source": "logs", |
417 | 417 | "search": { |
418 | | - "query": "source:beyondtrust-identity-security-insights @severity:Low @incidentType:Detection $Severity $Provider $Entity-Type" |
| 418 | + "query": "source:beyond-trust-identity-security-insights @severity:Low @incidentType:Detection $Severity $Provider $Entity-Type" |
419 | 419 | }, |
420 | 420 | "indexes": [ |
421 | 421 | "*" |
|
466 | 466 | "name": "query1", |
467 | 467 | "data_source": "logs", |
468 | 468 | "search": { |
469 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 469 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
470 | 470 | }, |
471 | 471 | "indexes": [ |
472 | 472 | "*" |
|
596 | 596 | "name": "query1", |
597 | 597 | "data_source": "logs", |
598 | 598 | "search": { |
599 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 599 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
600 | 600 | }, |
601 | 601 | "indexes": [ |
602 | 602 | "*" |
|
622 | 622 | "name": "query2", |
623 | 623 | "data_source": "logs", |
624 | 624 | "search": { |
625 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 625 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
626 | 626 | }, |
627 | 627 | "indexes": [ |
628 | 628 | "*" |
|
687 | 687 | "name": "query1", |
688 | 688 | "data_source": "logs", |
689 | 689 | "search": { |
690 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 690 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
691 | 691 | }, |
692 | 692 | "indexes": [ |
693 | 693 | "*" |
|
758 | 758 | "name": "query1", |
759 | 759 | "data_source": "logs", |
760 | 760 | "search": { |
761 | | - "query": "source:beyondtrust-identity-security-insights @severity:Critical @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
| 761 | + "query": "source:beyond-trust-identity-security-insights @severity:Critical @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
762 | 762 | }, |
763 | 763 | "indexes": [ |
764 | 764 | "*" |
|
837 | 837 | "name": "query1", |
838 | 838 | "data_source": "logs", |
839 | 839 | "search": { |
840 | | - "query": "source:beyondtrust-identity-security-insights @severity:High @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
| 840 | + "query": "source:beyond-trust-identity-security-insights @severity:High @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
841 | 841 | }, |
842 | 842 | "indexes": [ |
843 | 843 | "*" |
|
916 | 916 | "name": "query1", |
917 | 917 | "data_source": "logs", |
918 | 918 | "search": { |
919 | | - "query": "source:beyondtrust-identity-security-insights @severity:Moderate @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
| 919 | + "query": "source:beyond-trust-identity-security-insights @severity:Moderate @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
920 | 920 | }, |
921 | 921 | "indexes": [ |
922 | 922 | "*" |
|
995 | 995 | "name": "query1", |
996 | 996 | "data_source": "logs", |
997 | 997 | "search": { |
998 | | - "query": "source:beyondtrust-identity-security-insights @severity:Low @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
| 998 | + "query": "source:beyond-trust-identity-security-insights @severity:Low @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
999 | 999 | }, |
1000 | 1000 | "indexes": [ |
1001 | 1001 | "*" |
|
1074 | 1074 | "name": "query1", |
1075 | 1075 | "data_source": "logs", |
1076 | 1076 | "search": { |
1077 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
| 1077 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
1078 | 1078 | }, |
1079 | 1079 | "indexes": [ |
1080 | 1080 | "*" |
|
1144 | 1144 | "name": "query1", |
1145 | 1145 | "data_source": "logs", |
1146 | 1146 | "search": { |
1147 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
| 1147 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection -@entityName:\"\" $Severity $Provider $Entity-Type" |
1148 | 1148 | }, |
1149 | 1149 | "indexes": [ |
1150 | 1150 | "*" |
|
1214 | 1214 | "name": "query1", |
1215 | 1215 | "data_source": "logs", |
1216 | 1216 | "search": { |
1217 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 1217 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
1218 | 1218 | }, |
1219 | 1219 | "indexes": [ |
1220 | 1220 | "*" |
|
1348 | 1348 | "name": "query1", |
1349 | 1349 | "data_source": "logs", |
1350 | 1350 | "search": { |
1351 | | - "query": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
| 1351 | + "query": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type" |
1352 | 1352 | }, |
1353 | 1353 | "indexes": [ |
1354 | 1354 | "*" |
|
1415 | 1415 | "response_format": "event_list", |
1416 | 1416 | "query": { |
1417 | 1417 | "data_source": "logs_stream", |
1418 | | - "query_string": "source:beyondtrust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type", |
| 1418 | + "query_string": "source:beyond-trust-identity-security-insights @incidentType:Detection $Severity $Provider $Entity-Type", |
1419 | 1419 | "indexes": [], |
1420 | 1420 | "storage": "hot" |
1421 | 1421 | }, |
|
1538 | 1538 | }, |
1539 | 1539 | "group_by": [], |
1540 | 1540 | "search": { |
1541 | | - "query": "source:beyondtrust-identity-security-insights status:critical" |
| 1541 | + "query": "source:beyond-trust-identity-security-insights status:critical" |
1542 | 1542 | } |
1543 | 1543 | } |
1544 | 1544 | ], |
|
1589 | 1589 | }, |
1590 | 1590 | "group_by": [], |
1591 | 1591 | "search": { |
1592 | | - "query": "source:beyondtrust-identity-security-insights status:high" |
| 1592 | + "query": "source:beyond-trust-identity-security-insights status:high" |
1593 | 1593 | } |
1594 | 1594 | } |
1595 | 1595 | ], |
|
1645 | 1645 | } |
1646 | 1646 | ], |
1647 | 1647 | "search": { |
1648 | | - "query": "source:beyondtrust-identity-security-insights status:critical" |
| 1648 | + "query": "source:beyond-trust-identity-security-insights status:critical" |
1649 | 1649 | } |
1650 | 1650 | } |
1651 | 1651 | ], |
|
1710 | 1710 | }, |
1711 | 1711 | "group_by": [], |
1712 | 1712 | "search": { |
1713 | | - "query": "source:beyondtrust-identity-security-insights status:medium" |
| 1713 | + "query": "source:beyond-trust-identity-security-insights status:medium" |
1714 | 1714 | } |
1715 | 1715 | } |
1716 | 1716 | ], |
|
1761 | 1761 | }, |
1762 | 1762 | "group_by": [], |
1763 | 1763 | "search": { |
1764 | | - "query": "source:beyondtrust-identity-security-insights status:low" |
| 1764 | + "query": "source:beyond-trust-identity-security-insights status:low" |
1765 | 1765 | } |
1766 | 1766 | } |
1767 | 1767 | ], |
|
1812 | 1812 | }, |
1813 | 1813 | "group_by": [], |
1814 | 1814 | "search": { |
1815 | | - "query": "source:beyondtrust-identity-security-insights status:info" |
| 1815 | + "query": "source:beyond-trust-identity-security-insights status:info" |
1816 | 1816 | } |
1817 | 1817 | } |
1818 | 1818 | ], |
|
1865 | 1865 | } |
1866 | 1866 | ], |
1867 | 1867 | "search": { |
1868 | | - "query": "source:beyondtrust-identity-security-insights status:high" |
| 1868 | + "query": "source:beyond-trust-identity-security-insights status:high" |
1869 | 1869 | } |
1870 | 1870 | } |
1871 | 1871 | ], |
|
1932 | 1932 | } |
1933 | 1933 | ], |
1934 | 1934 | "search": { |
1935 | | - "query": "source:beyondtrust-identity-security-insights status:medium" |
| 1935 | + "query": "source:beyond-trust-identity-security-insights status:medium" |
1936 | 1936 | } |
1937 | 1937 | } |
1938 | 1938 | ], |
|
0 commit comments