Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into dev

salt/kibana/etc/config.json

@@ -1,8 +1,9 @@
 { "attributes":
 	{
-    "defaultIndex": "*:logstash-*",
-		"discover:sampleSize":"10",
+    "defaultIndex": "*:so-*",
+		"discover:sampleSize":"100",
 	  "dashboard:defaultDarkTheme":true,
+	  "theme:darkMode":true,
 	  "timepicker:timeDefaults":"{\n  \"from\": \"now-24h\",\n  \"to\": \"now\",\n  \"mode\": \"quick\"\n}"
 	}
 }

salt/kibana/etc/kibana.yml

@@ -4,7 +4,7 @@
 server.name: kibana
 server.host: "0"
 server.basePath: /kibana
-elasticsearch.url: http://{{ ES }}:9200
+elasticsearch.hosts: [ "http://{{ ES }}:9200" ]
 #kibana.index: ".kibana"
 #elasticsearch.username: elastic
 #elasticsearch.password: changeme

salt/logstash/pipelines/config/so/9600_output_ossec.conf.jinja

@@ -21,9 +21,9 @@ output {
     elasticsearch {
       pipeline => "%{event_type}"
       hosts => "{{ ES }}"
-      index => "so-ossec-%{+YYYY.MM.dd}"
-      template_name => "so-ossec"
-      template => "/so-ossec-template.json"
+      index => "so-common-%{+YYYY.MM.dd}"
+      template_name => "so-common"
+      template => "/so-common-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/config/so/9700_output_strelka.conf.jinja

@@ -20,9 +20,9 @@ output {
   if [event_type] =~ "strelka" {
     elasticsearch {
       hosts => "{{ ES }}"
-      index => "so-strelka-%{+YYYY.MM.dd}"
-      template_name => "so-strelka"
-      template => "/so-strelka-template.json"
+      index => "so-common-%{+YYYY.MM.dd}"
+      template_name => "so-common"
+      template => "/so-common-template.json"
       template_overwrite => true
     }
   }

salt/logstash/pipelines/templates/so/so-common-template.json

@@ -1,5 +1,5 @@
 {
-  "index_patterns": ["so-ids-*", "so-firewall-*", "so-syslog-*", "so-zeek-*", "so-import-*", "so-ossec-*", "so-strelka", "so-beats-*"],
+  "index_patterns": ["so-ids-*", "so-firewall-*", "so-syslog-*", "so-zeek-*", "so-import-*", "so-ossec-*", "so-strelka-*", "so-beats-*"],
   "version":50001,
   "order" : 10,
   "settings":{

setup/so-functions

@@ -460,7 +460,7 @@ docker_registry() {
 
 }
 docker_seed_registry() {
-  VERSION="HH1.1.4"
+  VERSION="HH1.2.1"
   if [ $INSTALLTYPE != 'HELIXSENSOR' ]; then
     TRUSTED_CONTAINERS=( \
     "so-acng:$VERSION" \
@@ -743,7 +743,7 @@ master_static() {
   touch /opt/so/saltstack/pillar/static.sls
 
   echo "static:" > /opt/so/saltstack/pillar/static.sls
-  echo "  soversion: HH1.1.4" >> /opt/so/saltstack/pillar/static.sls
+  echo "  soversion: HH1.2.1" >> /opt/so/saltstack/pillar/static.sls
   echo "  hnmaster: $HNMASTER" >> /opt/so/saltstack/pillar/static.sls
   echo "  ntpserver: $NTPSERVER" >> /opt/so/saltstack/pillar/static.sls
   echo "  proxy: $PROXY" >> /opt/so/saltstack/pillar/static.sls