CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into dev

Browse Source
This commit is contained in:
m0duspwnens
2020-04-16 10:55:49 -04:00
parent 78b0b5ad18 616baaf4be
commit 2da3165019
2 changed files with 27 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/common/grafana/grafana_dashboards/eval/eval.json
View File

@@ -2795,7 +2795,7 @@
"timeShift": null, "timeShift": null,
"title": "{{ SERVERNAME }} - System Uptime", "title": "{{ SERVERNAME }} - System Uptime",
"type": "stat" "type": "stat"
} },
{ {
"cacheTimeout": null, "cacheTimeout": null,
"datasource": "InfluxDB", "datasource": "InfluxDB",

44
salt/soc/files/soc/changes.json
View File

@@ -1,23 +1,29 @@
{ {
"title": "Introducing Hybrid Hunter 1.2.1 Beta", "title": "Introducing Hybrid Hunter 1.2.1 Beta 1",
"changes": [ "changes": [
{ "summary": "New authentication framework" }, { "summary": "Introduction of the Security Onion Console. Once logged in you are directly taken to the SOC." },
{ "summary": "New Logstash pipeline setup. Now uses multiple pipelines." }, { "summary": "New authentication using Kratos." },
{ "summary": "New Master + Search node type and well as a Heavy Node type in the install." }, { "summary": "During install you must specify how you would like to access the SOC ui. This is for strict cookie security." },
{ "summary": "Change all nodes to point to the docker registry on the Master. This cuts down on the calls to dockerhub." }, { "summary": "Ability to list and delete web users from the SOC ui." },
{ "summary": "Upgraded to Zeek 3.0" }, { "summary": "The soremote account is now used to add nodes to the grid vs using socore." },
{ "summary": "Upgraded to Elastic 7.6" }, { "summary": "Community ID support for Zeek, osquery, and Suricata. You can now tie host events to connection logs!" },
{ "summary": "New SO Start | Stop | Restart scripts for all components (eg. `so-playbook-restart`)." }, { "summary": "Elastic 7.6.1 with ECS support." },
{ "summary": "BPF support for Suricata (NIDS), Steno (PCAP) & Zeek (<a target='new' href='https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/BPF'>More Info</a>)." }, { "summary": "New set of Kibana dashboards that align with ECS." },
{ "summary": "Updated Domain Stats & Frequency Server containers to Python3 & created new Salt states for them." }, { "summary": "Eval mode no longer uses Logstash for parsing (Filebeat -> ES Ingest)" },
{ "summary": "Added so-status script which gives an easy to read look at container status." }, { "summary": "Ingest node parsing for osquery-shipped logs (osquery, WEL, Sysmon)." },
{ "summary": "Manage threshold.conf for Suricata using the thresholding pillar." }, { "summary": "Fleet standalone mode with improved Web UI & API access control." },
{ "summary": "The ISO now includes all the docker containers for faster install speeds." }, { "summary": "Improved Fleet integration support." },
{ "summary": "You now set the password for the onion account during the iso install. This account is temporary and will be removed after so-setup." }, { "summary": "Playbook now has full Windows Sigma community ruleset builtin." },
{ "summary": "Updated Helix parsers for better compatibility." }, { "summary": "Automatic Sigma community rule updates." },
{ "summary": "Updated telegraf docker to include curl and jq." }, { "summary": "Playbook stability enhancements." },
{ "summary": "CVE-2020-0601 Zeek Detection Script." }, { "summary": "Zeek health check. Zeek will now auto restart if a worker crashes." },
{ "summary": "ISO Install now prompts you to create a password for the onion user during imaging. This account gets disabled during setup." }, { "summary": "zeekctl is now managed by salt." },
{ "summary": "Check out the Hybrid Hunter Quick Start Guide." } { "summary": "Grafana dashboard improvements and cleanup." },
{ "summary": "Moved logstash configs to pillars." },
{ "summary": "Salt logs moved to /opt/so/log/salt." },
{ "summary": "Strelka integrated for file-oriented detection/analysis at scale" },
{ "summary": "KNOWN ISSUE: Updating users via the SOC ui is known to fail. To change a user, delete the user and re-add them." },
{ "summary": "KNOWN ISSUE: Due to the move to ECS, the current Playbook plays may not alert correctly at this time." },
{ "summary": "KNOWN ISSUE: The osquery MacOS package does not install correctly." }
] ]
} }