Playbook: reset status to only default SO rules active

[sleepingbel]

Hello all,

Is there a method in playbook to reset the status of the plays so that only the default SO plays are active?

Regards
Bart

[InfosecGoon]

Just to clarify -- you want just the default plays to be available in draft mode and none of the custom plays you may have written or imported, or do you want just the default plays to be in active mode?

[sleepingbel]

I want just the default plays to be in active mode.

[InfosecGoon]

You can't enable them all at once, but you can do up to 150 at a time.

Please note: We recommend being judicious about which Plays you turn on to make sure they they are a good fit for your threat model and that they match the data that you're bringing into Security Onion. For example, most of the Windows endpoint Plays are dependent upon process or file system information from something like Sysmon, so if you're not ingesting those logs, it's not going to actually do anything but cause more load on your system.

That said, to bulk enable the Community rules:

1. Open up Playbook
2. Click on the upper-right drop down for Add Filter, select Playbook, and then Community.
3. Scroll to the bottom and click to display 150 Plays per page.
4. Click on the checkbox at the top of the lefthand column to select all 150 plays.
5. Click on the ellipsis in the rightmost column, then Status, then Active.

Again, turning on tons of Plays at once will have performance implications, so be aware of that before you begin.

[sleepingbel]

Thanks InfosecGoon for the info,

I'll try to make my question a bit clearer.

SO is installed with a default set windows sigma rules, in the past I reviewed these rules and tweaked these rules. So I have now for 1 year a set of rules that are ok for me.

The last 3 months I added new windows rules, and gradually elasticsearch started to spike in cpu usage. This is due to the resources available on the hardware.

So now I wanted to go back to the original set of windows sigma rules.

My question is now:
Is there a SO command or script that only activates the default windows SO sigma rule set and disables all other rules.

I use this SO installation at home, so if it is not possible to revert the added rules (what i don't want to do manually) I simply reinstall SO.

[InfosecGoon]

If you want to revert to just the Windows rules and delete the ones that you have tweaked and added, you can reset it to "fresh installation" with so-playbook-reset. The rules will still be in draft status and require manual activation.

[sleepingbel]

thx