How to change query in SIEM

Elastic Security SIEM
1

Im using Elastic stack 7.4 and stup auditbeat, filebeat, packetbeat ready.
Im focus on SIEM -> network, in Top DNS domains panel, i saw , default get top root domain not real domain. ( dns.question.registered_domain instead of dns.question.name)

For example, server query domain abc.xyz.com. In Top DNS domains panel will show xyz.com. It not good, When i use timeline, drag and drop xyz.com, get many result, many event is unrelated. It can be list down aaa.xyz.com, bbb.xyz.com.

How to change query in SIEM panel ?
Thank

{
  "aggregations": {
    "dns_count": {
      "cardinality": {
        "field": "dns.question.registered_domain"
      }
    },
    "dns_name_query_count": {
      "terms": {
        "field": "dns.question.registered_domain",
        "size": 10,
        "order": {
          "unique_domains": "desc"
        }
      },
      "aggs": {
        "unique_domains": {
          "cardinality": {
            "field": "dns.question.name"
          }
        },
        "dns_bytes_in": {
          "sum": {
            "field": "source.bytes"
          }
        },
        "dns_bytes_out": {
          "sum": {
            "field": "destination.bytes"
          }
        }
      }
    }
  },
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": 1571249363494,
              "lte": 1571335763494
            }
          }
        }
      ],
      "must_not": [
        {
          "term": {
            "dns.question.type": {
              "value": "PTR"
            }
          }
        }
      ]
    }
  }
}
2

Hi @tatdat, there currently is no way to change the queries used in the SIEM app. You could instead create a table visualization and view it on a dashboard, would that work?

3

I found solution. In timeline, select field need to search, and drag & drop value to timeline again.
Love this timeline, very powerful. Thank Elastic SIEM team!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.