New Default Hunt Query

[H4xl0r]

Im new to this, but for me the query:

* | groupby event.module* | groupby -sankey event.module* event.dataset | groupby event.dataset | groupby source.ip source.port destination.ip destination.port | groupby network.protocol | groupby source_geo.organization_name source.geo.country_name | groupby destination_geo.organization_name destination.geo.country_name | groupby rule.name rule.category event.severity_label | groupby dns.query.name | groupby file.mime_type | groupby http.virtual_host http.uri | groupby notice.note notice.message notice.sub_message | groupby ssl.server_name | groupby source.ip host.hostname user.name event.action event.type process.executable process.pid

Should be the default Hunt Qery , it even comes from the System somewhere.
Thanks for the great work!

[InfosecGoon]

Good news, you can make whatever you like the default Hunt query. Go to Administration --> Configuration and then modify the setting in soc --> config --> server --> client --> hunt --> queries.