From d2a74c80e2aaa309d3660232fcbd28490b4dc50a Mon Sep 17 00:00:00 2001
From: Josh Brower <Josh@Defensivedepth.com>
Date: Wed, 17 Feb 2021 16:37:31 -0500
Subject: [PATCH 1/3] Update .security analyzer

---
 .../templates/so/so-common-template.json      | 33 ++++++++++---------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/salt/elasticsearch/templates/so/so-common-template.json b/salt/elasticsearch/templates/so/so-common-template.json
index 74ff3748a..062838670 100644
--- a/salt/elasticsearch/templates/so/so-common-template.json
+++ b/salt/elasticsearch/templates/so/so-common-template.json
@@ -12,20 +12,18 @@
       "analyzer": {
         "es_security_analyzer": {
           "type": "custom",
-          "filter": [ "path_hierarchy_pattern_filter", "lowercase" ],
-          "tokenizer": "whitespace"
-        },
-        "es_security_search_analyzer": {
-          "type": "custom",
-          "filter": [ "lowercase" ],
-          "tokenizer": "whitespace"
-        },
-        "es_security_search_quote_analyzer": {
-          "type": "custom",
-          "filter": [ "lowercase" ],
-          "tokenizer": "whitespace"
+          "char_filter": [ "whitespace_no_way" ],
+          "filter": [ "lowercase", "trim" ],
+          "tokenizer": "keyword"
         }
       },
+      "char_filter": {
+        "whitespace_no_way": {
+          "type": "pattern_replace",
+          "pattern": "(\\s)+",
+          "replacement": "$1"
+        }
+      },  
       "filter" : {
         "path_hierarchy_pattern_filter": {
           "type" : "pattern_capture",
@@ -35,6 +33,12 @@
             "((?:[^/]*/)*)(.*)"
           ]
         }
+      },  
+      "tokenizer": {
+        "path_tokenizer": {
+          "type": "path_hierarchy",
+          "delimiter": "\\"
+        }
       }
     }
   },
@@ -67,13 +71,12 @@
               "type": "text",
               "fields": {
                 "keyword": {
+                "ignore_above": 32765,
                  "type": "keyword"
                },
                "security": {
                  "type": "text",
-                 "analyzer": "es_security_analyzer",
-                 "search_analyzer": "es_security_search_analyzer",
-                 "search_quote_analyzer": "es_security_search_quote_analyzer"
+                 "analyzer": "es_security_analyzer"
                }
              }
             }

From 2a324eac3245db287516f932ce66257aa5050cbf Mon Sep 17 00:00:00 2001
From: Josh Brower <Josh@Defensivedepth.com>
Date: Fri, 19 Feb 2021 15:12:55 -0500
Subject: [PATCH 2/3] Add sigma refresh script

---
 salt/common/tools/sbin/so-playbook-sync | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/so-playbook-sync b/salt/common/tools/sbin/so-playbook-sync
index 250e4a3ad..8bf8dc507 100755
--- a/salt/common/tools/sbin/so-playbook-sync
+++ b/salt/common/tools/sbin/so-playbook-sync
@@ -17,4 +17,4 @@
 
 . /usr/sbin/so-common
 
-docker exec so-soctopus python3 playbook_play-sync.py
+docker exec so-soctopus python3 playbook_play-update.py

From 8c69e19419adb15824dffc699bf6740f2e6611dd Mon Sep 17 00:00:00 2001
From: Josh Brower <Josh@Defensivedepth.com>
Date: Fri, 19 Feb 2021 15:14:37 -0500
Subject: [PATCH 3/3] Add sigma refresh script

---
 .../tools/sbin/so-playbook-sigma-refresh      | 20 +++++++++++++++++++
 salt/common/tools/sbin/so-playbook-sync       |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 salt/common/tools/sbin/so-playbook-sigma-refresh

diff --git a/salt/common/tools/sbin/so-playbook-sigma-refresh b/salt/common/tools/sbin/so-playbook-sigma-refresh
new file mode 100644
index 000000000..10697bc2f
--- /dev/null
+++ b/salt/common/tools/sbin/so-playbook-sigma-refresh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Copyright 2014,2015,2016,2017,2018,2019,2020,2021 Security Onion Solutions, LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+. /usr/sbin/so-common
+
+docker exec so-soctopus python3 playbook_play-update.py
\ No newline at end of file
diff --git a/salt/common/tools/sbin/so-playbook-sync b/salt/common/tools/sbin/so-playbook-sync
index 8bf8dc507..250e4a3ad 100755
--- a/salt/common/tools/sbin/so-playbook-sync
+++ b/salt/common/tools/sbin/so-playbook-sync
@@ -17,4 +17,4 @@
 
 . /usr/sbin/so-common
 
-docker exec so-soctopus python3 playbook_play-update.py
+docker exec so-soctopus python3 playbook_play-sync.py