Custom Dashboard Doesnt show up ?

[izidood]

Hi.
I have a problem with getting my custom Dashboard to show up, iv'e done what the documentation says.
Custom motd.md in /opt/so/saltstack/local/salt/soc/files/soc works just fine.
But the dashboard.queries.json that iv'e coppied from "default" won't accept any changes. i thought i might have been wrong on the syntax or what not, but that is not the case, as it doesn't give me an error upon restart of the soc. also i tried to copy an existing dashboard and renaming it, but that didn't show up either. is there anyone else with this problem ?

[dougburks]

What is the output of the following?

sudo ls -alh /opt/so/saltstack/local/salt/soc/files/soc/

[izidood]

-rw-r--r--. 1 socore socore 21K May 30 08:44 dashboard.queries.json

[dougburks]

Have you tried changing dashboard.queries.json to dashboards.queries.json (note that dashboards is plural)?
https://docs.securityonion.net/en/2.3/soc-customization.html#custom-queries

[izidood]

wow haha. thanks Doug.