diff --git a/salt/common/tools/sbin/so-analyst-install b/salt/common/tools/sbin/so-analyst-install index 656aa5e4c..c49cb015b 100755 --- a/salt/common/tools/sbin/so-analyst-install +++ b/salt/common/tools/sbin/so-analyst-install @@ -6,7 +6,7 @@ # Elastic License 2.0. -doc_workstation_url="https://docs.securityonion.net/en/2.3/analyst-vm.html" +doc_workstation_url="https://docs.securityonion.net/en/2.4/analyst-vm.html" {# we only want the script to install the workstation if it is CentOS -#} {% if grains.os == 'CentOS' -%} {# if this is a manager -#} diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common index 44ca007ff..c241c6513 100755 --- a/salt/common/tools/sbin/so-common +++ b/salt/common/tools/sbin/so-common @@ -155,11 +155,11 @@ elastic_license() { read -r -d '' message <<- EOM \n Elastic Stack binaries and Security Onion components are only available under the Elastic License version 2 (ELv2): -https://www.elastic.co/licensing/elastic-license +https://securityonion.net/license/ Do you agree to the terms of ELv2? -If so, type AGREE to accept ELv2 and continue. Otherwise, press Enter to exit this program without making any changes. +If so, type AGREE to accept ELv2 and continue. Otherwise, press Enter to exit this program without making any changes. EOM AGREED=$(whiptail --title "$whiptail_title" --inputbox \ diff --git a/salt/common/tools/sbin/so-import-evtx b/salt/common/tools/sbin/so-import-evtx index bd9421897..a5540f768 100755 --- a/salt/common/tools/sbin/so-import-evtx +++ b/salt/common/tools/sbin/so-import-evtx @@ -158,7 +158,7 @@ cat << EOF Import complete! You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser: -https://{{ URLBASE }}/#/dashboards?q=import.id:${RUNID}%20%7C%20groupby%20event.module%20event.dataset&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC +https://{{ URLBASE }}/#/dashboards?q=import.id:${RUNID}%20%7C%20groupby%20-sankey%20event.dataset%20event.category%2a%20%7C%20groupby%20-pie%20event.category%20%7C%20groupby%20-bar%20event.module%20%7C%20groupby%20event.dataset%20%7C%20groupby%20event.module%20%7C%20groupby%20event.category%20%7C%20groupby%20observer.name%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC or you can manually set your Time Range to be (in UTC): From: $START_OLDEST_FORMATTED To: $END_NEWEST diff --git a/salt/common/tools/sbin/so-import-pcap b/salt/common/tools/sbin/so-import-pcap index dd1bb2774..2c1f27705 100755 --- a/salt/common/tools/sbin/so-import-pcap +++ b/salt/common/tools/sbin/so-import-pcap @@ -206,7 +206,7 @@ cat << EOF Import complete! You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser: -https://{{ URLBASE }}/#/dashboards?q=import.id:${HASH}%20%7C%20groupby%20event.module%20event.dataset&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC +https://{{ URLBASE }}/#/dashboards?q=import.id:${HASH}%20%7C%20groupby%20-sankey%20event.dataset%20event.category%2a%20%7C%20groupby%20-pie%20event.category%20%7C%20groupby%20-bar%20event.module%20%7C%20groupby%20event.dataset%20%7C%20groupby%20event.module%20%7C%20groupby%20event.category%20%7C%20groupby%20observer.name%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC or you can manually set your Time Range to be (in UTC): From: $START_OLDEST To: $END_NEWEST diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup index 43d35f875..cce080277 100755 --- a/salt/common/tools/sbin/soup +++ b/salt/common/tools/sbin/soup @@ -47,7 +47,7 @@ check_err() { ;; 28) echo 'No space left on device' - echo 'Likely ran out of space on disk, please review hardware requirements for Security Onion: https://docs.securityonion.net/en/2.3/hardware.html' + echo 'Likely ran out of space on disk, please review hardware requirements for Security Onion: https://docs.securityonion.net/en/2.4/hardware.html' ;; 30) echo 'Read-only file system' @@ -357,7 +357,7 @@ clone_to_tmp() { git clone $SOUP_BRANCH https://github.com/Security-Onion-Solutions/securityonion.git cd /tmp if [ ! -f $UPDATE_DIR/VERSION ]; then - echo "Update was unable to pull from github. Please check your internet." + echo "Update was unable to pull from Github. Please check your Internet access." exit 0 fi } @@ -458,7 +458,7 @@ es_indices_check() { if [ -z "$UNSUPPORTED_INDICES" ]; then echo "No unsupported indices found." else - echo "The following indices were created with Elasticsearch 6, and are not supported when upgrading to Elasticsearch 8. These indices may need to be deleted, migrated, or re-indexed before proceeding with the upgrade. Please see https://docs.securityonion.net/en/2.3/soup.html#elastic-8 for more details." + echo "The following indices were created with Elasticsearch 6, and are not supported when upgrading to Elasticsearch 8. These indices may need to be deleted, migrated, or re-indexed before proceeding with the upgrade. Please see https://docs.securityonion.net/en/2.4/soup.html#elastic-8 for more details." echo echo "$UNSUPPORTED_INDICES" exit 1 @@ -1411,7 +1411,7 @@ Each minion is on a random 15 minute check-in period and things like network ban If it looks like you’re missing data after the upgrade, please avoid restarting services and instead make sure at least one search node has completed its upgrade. The best way to do this is to run 'sudo salt-call state.highstate' from a search node and make sure there are no errors. Typically if it works on one node it will work on the rest. Forward nodes are less complex and will update as they check in so you can monitor those from the Grid section of SOC. -For more information, please see https://docs.securityonion.net/en/2.3/soup.html#distributed-deployments. +For more information, please see https://docs.securityonion.net/en/2.4/soup.html#distributed-deployments. EOF @@ -1425,7 +1425,7 @@ EOF A custom Elasticsearch configuration has been found at /opt/so/saltstack/local/elasticsearch/files/elasticsearch.yml. This file is no longer referenced in Security Onion versions >= 2.3.80. -If you still need those customizations, you'll need to manually migrate them to the new Elasticsearch config as shown at https://docs.securityonion.net/en/2.3/elasticsearch.html. +If you still need those customizations, you'll need to manually migrate them to the new Elasticsearch config as shown at https://docs.securityonion.net/en/2.4/elasticsearch.html. EOF @@ -1472,7 +1472,7 @@ if [[ -z $UNATTENDED ]]; then SOUP - Security Onion UPdater Please review the following for more information about the update process and recent updates: -https://docs.securityonion.net/soup +https://docs.securityonion.net/en/2.4/soup.html https://blog.securityonion.net EOF diff --git a/setup/so-functions b/setup/so-functions index b5ac3ce64..ad876fabd 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -99,7 +99,7 @@ analyst_salt_local() { read -r -d '' message <<- EOM Finished Analyst workstation installation. - Press ENTER to reboot. + Press the Enter key to reboot. EOM whiptail --title "$whiptail_title" --msgbox "$message" 12 75 @@ -1541,7 +1541,7 @@ networking_needful() { source "$net_init_file" fi if [[ $reinit_networking ]] || ! [[ -f $net_init_file ]]; then - whiptail_network_init_notice + #whiptail_network_init_notice network_init fi set_main_ip @@ -2003,7 +2003,7 @@ set_main_ip() { info "ERROR: Could not determine MAINIP or MNIC_IP." info "MAINIP=$MAINIP" info "MNIC_IP=$MNIC_IP" - whiptail_error_message "The management IP could not be determined. Please check the log at /root/sosetup.log and verify the network configuration. Press OK to exit." + whiptail_error_message "The management IP could not be determined. Please check the log at /root/sosetup.log and verify the network configuration. Select OK to exit." exit 1 fi sleep 1 diff --git a/setup/so-setup b/setup/so-setup index a114233d6..784aa0ca4 100755 --- a/setup/so-setup +++ b/setup/so-setup @@ -272,7 +272,7 @@ if ! [[ -f $install_opt_file ]]; then whiptail_dhcp_warn whiptail_management_nic fi - whiptail_network_init_notice + #whiptail_network_init_notice # Initializing the network based on the previous information network_init printf '%s\n' \ @@ -287,7 +287,7 @@ if ! [[ -f $install_opt_file ]]; then if [[ $option == "CONFIGURENETWORK" ]]; then collect_hostname network_init_whiptail - whiptail_network_init_notice + #whiptail_network_init_notice network_init printf '%s\n' \ "MNIC=$MNIC" \ diff --git a/setup/so-whiptail b/setup/so-whiptail index 7b9cf8505..7b2b6d807 100755 --- a/setup/so-whiptail +++ b/setup/so-whiptail @@ -244,7 +244,7 @@ whiptail_storage_requirements() { You need ${needed_val} to meet minimum requirements. - Visit https://docs.securityonion.net/en/latest/hardware.html for more information. + Visit https://docs.securityonion.net/en/2.4/hardware.html for more information. Select YES to continue anyway, or select NO to cancel. EOM @@ -284,7 +284,7 @@ whiptail_dhcp_warn() { local interaction_text="Select YES to keep DHCP or NO to go back." local window_type="yesno" else - local interaction_text="Press ENTER to continue." + local interaction_text="Press the Enter key to continue." local window_type="msgbox" fi @@ -422,7 +422,7 @@ whiptail_end_settings() { read -r -d '' msg <<-EOM $end_msg - Press TAB to select yes or no. + Press the Tab key to select yes or no. EOM whiptail --title "The following options have been set, would you like to proceed?" --yesno "$msg" 24 75 --scrolltext @@ -460,7 +460,7 @@ whiptail_install_type() { # What kind of install are we doing? install_type=$(whiptail --title "$whiptail_title" --radiolist \ - "Choose install type. \nSee https://docs.securityonion.net/architecture for details." 13 65 5 \ + "What kind of installation would you like to do?\n\nFor more information, please see:\nhttps://docs.securityonion.net/en/2.4/architecture.html" 18 65 5 \ "EVAL" "Evaluation mode (not for production) " ON \ "STANDALONE" "Standalone production install " OFF \ "DISTRIBUTED" "Distributed install submenu " OFF \ @@ -508,7 +508,7 @@ whiptail_install_type_dist_new() { read -r -d '' mngr_msg <<- EOM Choose a distributed manager type to start a new grid. - See https://docs.securityonion.net/architecture for details. + See https://docs.securityonion.net/en/2.4/architecture.html for details. Note: MANAGER is the recommended option for most users. MANAGERSEARCH should only be used in very specific situations. EOM @@ -528,7 +528,7 @@ whiptail_install_type_dist_existing() { local node_msg read -r -d '' node_msg <<- EOM - Choose a distributed node type to join to an existing grid. See https://docs.securityonion.net/architecture for details. + Choose a distributed node type to join to an existing grid. See https://docs.securityonion.net/en/2.4/architecture.html for details. Note: Heavy nodes (HEAVYNODE) are NOT recommended for most users. EOM @@ -776,13 +776,13 @@ whiptail_management_nic() { filter_unused_nics - MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select your management NIC:" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) + MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select the NIC you would like to use for management.\n\nUse the arrow keys to move around and the space bar to select." 22 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) local exitstatus=$? whiptail_check_exitstatus $exitstatus while [ -z "$MNIC" ] do - MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select your management NIC:" 20 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) + MNIC=$(whiptail --title "$whiptail_title" --radiolist "Please select the NIC you would like to use for management.\n\nUse the arrow keys to move around and the space bar to select." 22 75 12 "${nic_list[@]}" 3>&1 1>&2 2>&3 ) local exitstatus=$? whiptail_check_exitstatus $exitstatus done @@ -929,7 +929,7 @@ whiptail_manager_updates_warning() { [ -n "$TESTING" ] && return whiptail --title "$whiptail_title"\ - --msgbox "Updating through the manager node requires the manager to have internet access, press ENTER to continue."\ + --msgbox "Updating through the manager node requires the manager to have access to the Internet. Press the Enter key to continue."\ 8 75 local exitstatus=$? @@ -986,7 +986,7 @@ whiptail_network_notice() { [ -n "$TESTING" ] && return - whiptail --title "$whiptail_title" --yesno "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. Select YES to continue." 8 75 + whiptail --title "$whiptail_title" --yesno "Since this is a network install we assume the management interface, DNS, Hostname, etc are already set up. Select Yes if you've already configured these settings. Otherwise, select No to quit." 10 75 local exitstatus=$? whiptail_check_exitstatus $exitstatus @@ -1115,7 +1115,7 @@ whiptail_requirements_error() { [ -n "$TESTING" ] && return whiptail --title "$whiptail_title" \ - --yesno "This machine currently has $current_val $requirement_needed, but needs $needed_val to meet minimum requirements. Press YES to continue anyway, or press NO to cancel." 10 75 + --yesno "This machine currently has $current_val $requirement_needed, but needs $needed_val to meet minimum requirements. Select YES to continue anyway, or select NO to cancel." 10 75 local exitstatus=$? whiptail_check_exitstatus $exitstatus @@ -1198,7 +1198,7 @@ whiptail_set_redirect() { options+=("OTHER" "Use a different name like a FQDN or Load Balancer" OFF) REDIRECTINFO=$(whiptail --title "$whiptail_title" --radiolist \ - "How would you like to access the web interface?\n\nSecurity Onion uses strict cookie enforcement, so whatever you choose here will be the only way that you can access the web interface.\n\nIf you choose something other than IP address, then you'll need to ensure that you can resolve the name via DNS or hosts entry. If you are unsure, please select IP." 20 75 4 \ + "How would you like to access the web interface?\n\nWhatever you choose here will be the only way that you can access the web interface.\n\nIf you choose something other than IP address, then you'll need to ensure that you can resolve the name via DNS or hosts entry. If you are unsure, please select IP." 20 75 4 \ "${options[@]}" \ 3>&1 1>&2 2>&3 ) @@ -1237,7 +1237,7 @@ whiptail_setup_complete() { read -r -d '' message <<- EOM Finished ${install_type} installation. $accessMessage - Press ENTER to exit setup. + Press the Enter key to exit setup. EOM whiptail --title "$whiptail_title" --msgbox "$message" 12 75 @@ -1257,7 +1257,7 @@ whiptail_setup_failed() { read -r -d '' message <<- EOM Install had a problem. Please see $setup_log for details.\n $check_err_msg - Press Ok to exit. + Select Ok to exit. EOM whiptail --title "$whiptail_title" --msgbox "$message" $height 75 @@ -1298,9 +1298,9 @@ whiptail_storage_requirements() { You need ${needed_val} to meet minimum requirements. - Visit https://docs.securityonion.net/en/latest/hardware.html for more information. + Visit https://docs.securityonion.net/en/2.4/hardware.html for more information. - Press YES to continue anyway, or press NO to cancel. + Select YES to continue anyway, or select NO to cancel. EOM whiptail \ @@ -1350,10 +1350,10 @@ whiptail_you_sure() { read -r -d '' you_sure_text <<- EOM Welcome to Security Onion Setup! - You can use Setup for several different use cases, from a small standalone installation to a large distributed deployment for your enterprise. Don't forget to review the documentation at: - https://docs.securityonion.net + You can use Setup for several different use cases, from a small standalone installation to a large distributed deployment for your enterprise. You can learn more in the documentation at: + https://docs.securityonion.net/en/2.4/ - Setup uses keyboard navigation and you can use arrow keys to move around. Certain screens may provide a list and ask you to select one or more items from that list. You can use [SPACE] to select items and [ENTER] to proceed to the next screen. + Setup uses keyboard navigation and you can use arrow keys to move around. Certain screens may provide a list and ask you to select one or more items from that list. You can use the Space bar to select items and the Enter key to proceed to the next screen. Would you like to continue? EOM