[Hunt] Way to add the event.dataset column to the Events list

[stummasino-matc]

Hi All
Is there a way to add the event.dataset column to the Events list in the Hunt interface. Could be a problem with my workflow but I like to sort the events by time and then step through. It would just be nice to be able to see the event type right in that list. I do know that I can click the arrow and expand each event to see the event.dataset field.

[dougburks]

First, please note that you can easily add a groupby table for event.dataset by adding the following to your query:

| groupby: event.dataset

If you really want to change the Events table at the bottom of the page, those fields are defined in /opt/so/saltstack/default/salt/soc/files/soc/hunt.eventfields.json. You can modify this file by copying it to /opt/so/saltstack/local/salt/soc/files/soc/ and then modifying your copy. This is similar to the process for modifying the default queries as shown here:
https://docs.securityonion.net/en/2.3/soc-customization.html#custom-queries