How do i view playbook queries in kibana/soc?

[ramijat]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

24

RAM

48

Storage for /

200

Storage for /nsm

1000

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

As the title says, i need to debug certain playbooks that seem to be ignoring filters, however i am not sure where to see the results elastalert sees, i would like to copy the elastalert EQL query shown in playbook and visualize it in kibana discover or SOC hunt, however it seems the syntax is different it doesn't bring results back or incorrect results since it start with any.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[defensivedepth]

Hello there @ramijat !

Yes, which the switch from Lucene to EQL, testing the EQL query is a bit more cumbersome. The easiest way to do it is through the Kibana dev tools: