-
-
-
Hybrid Hunter Alpha 1.1.4 - Feature Parity Release
+
+
+
+
+
Hybrid Hunter Alpha 1.1.4 - Feature Parity Release
+
+
Changes:
-
- Added new in-house auth method [Security Onion Auth](https://github.com/Security-Onion-Solutions/securityonion-auth).
- Web user creation is done via the browser now instead of so-user-add.
- New Logstash pipeline setup. Now uses multiple pipelines.
- New Master + Search node type and well as a Heavy Node type in the install.
- Change all nodes to point to the docker registry on the Master. This cuts down on the calls to dockerhub.
- Zeek 3.0.1
- Elastic 6.8.6
- New SO Start | Stop | Restart scripts for all components (eg. `so-playbook-restart`).
- BPF support for Suricata (NIDS), Steno (PCAP) & Zeek ([Docs](https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/BPF)).
- Updated Domain Stats & Frequency Server containers to Python3 & created new Salt states for them.
- Added so-status script which gives an easy to read look at container status.
- Manage threshold.conf for Suricata using the thresholding pillar.
- The ISO now includes all the docker containers for faster install speeds.
- You now set the password for the onion account during the iso install. This account is temporary and will be removed after so-setup.
- Updated Helix parsers for better compatibility.
- Updated telegraf docker to include curl and jq.
- CVE-2020-0601 Zeek Detection Script.
- ISO Install now prompts you to create a password for the onion user during imaging. This account gets disabled during setup.
- Check out the Hybrid Hunter Quick Start Guide .
-
-
+
+ Added new in-house auth method [Security Onion Auth](https://github.com/Security-Onion-Solutions/securityonion-auth).
+ Web user creation is done via the browser now instead of so-user-add.
+ New Logstash pipeline setup. Now uses multiple pipelines.
+ New Master + Search node type and well as a Heavy Node type in the install.
+ Change all nodes to point to the docker registry on the Master. This cuts down on the calls to dockerhub.
+ Zeek 3.0.1
+ Elastic 6.8.6
+ New SO Start | Stop | Restart scripts for all components (eg. `so-playbook-restart`).
+ BPF support for Suricata (NIDS), Steno (PCAP) & Zeek ([Docs](https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/BPF)).
+ Updated Domain Stats & Frequency Server containers to Python3 & created new Salt states for them.
+ Added so-status script which gives an easy to read look at container status.
+ Manage threshold.conf for Suricata using the thresholding pillar.
+ The ISO now includes all the docker containers for faster install speeds.
+ You now set the password for the onion account during the iso install. This account is temporary and will be removed after so-setup.
+ Updated Helix parsers for better compatibility.
+ Updated telegraf docker to include curl and jq.
+ CVE-2020-0601 Zeek Detection Script.
+ ISO Install now prompts you to create a password for the onion user during imaging. This account gets disabled during setup.
+ Check out the Hybrid Hunter Quick Start Guide .
+
+
-
diff --git a/salt/elasticsearch/files/ingest/common b/salt/elasticsearch/files/ingest/common
index f9d6199ba..de83ef4cf 100644
--- a/salt/elasticsearch/files/ingest/common
+++ b/salt/elasticsearch/files/ingest/common
@@ -39,7 +39,7 @@
{ "rename": { "field": "dataset", "target_field": "event.dataset", "ignore_missing": true } },
{
"remove": {
- "field": [ "index_name_prefix", "beat"],
+ "field": [ "index_name_prefix"],
"ignore_failure": false
}
}
diff --git a/salt/elasticsearch/files/ingest/ossec.alert b/salt/elasticsearch/files/ingest/ossec.alert
index 39362c4ed..23d374fdc 100644
--- a/salt/elasticsearch/files/ingest/ossec.alert
+++ b/salt/elasticsearch/files/ingest/ossec.alert
@@ -2,6 +2,7 @@
"description" : "ossec",
"processors" : [
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true } },
+ { "remove": { "field": [ "agent" ], "ignore_missing": true, "ignore_failure": false } },
{ "rename": { "field": "message2.agent", "target_field": "agent", "ignore_missing": true } },
{ "rename": { "field": "message2.data", "target_field": "data", "ignore_missing": true } },
{ "rename": { "field": "message2.decoder", "target_field": "decoder", "ignore_missing": true } },
diff --git a/salt/elasticsearch/files/ingest/strelka b/salt/elasticsearch/files/ingest/strelka
index 8652fb912..39783c2ce 100644
--- a/salt/elasticsearch/files/ingest/strelka
+++ b/salt/elasticsearch/files/ingest/strelka
@@ -6,7 +6,7 @@
{ "rename": { "field": "message2.scan", "target_field": "scan", "ignore_missing": true } },
{ "rename": { "field": "message2.request", "target_field": "request", "ignore_missing": true } },
{ "rename": { "field": "scan.hash", "target_field": "file.hash", "ignore_missing": true } },
- { "remove": { "field": ["host", "path"], "ignore_missing": true } },
+ { "remove": { "field": ["host", "path", "agent"], "ignore_missing": true } },
{ "pipeline": { "name": "common" } }
]
}
diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common
index 79876d366..52d9372a2 100644
--- a/salt/elasticsearch/files/ingest/suricata.common
+++ b/salt/elasticsearch/files/ingest/suricata.common
@@ -8,7 +8,7 @@
{ "rename":{ "field": "message2.src_port", "target_field": "source.port", "ignore_failure": true } },
{ "rename":{ "field": "message2.dest_ip", "target_field": "destination.ip", "ignore_failure": true } },
{ "rename":{ "field": "message2.dest_port", "target_field": "destination.port", "ignore_failure": true } },
- { "remove": { "field": ["message2"], "ignore_failure": true } },
+ { "remove": { "field": ["message2", "agent"], "ignore_failure": true } },
{ "pipeline": { "name": "common" } }
]
}
diff --git a/salt/elasticsearch/files/ingest/zeek.common b/salt/elasticsearch/files/ingest/zeek.common
index 85902ffa5..4c062c1c3 100644
--- a/salt/elasticsearch/files/ingest/zeek.common
+++ b/salt/elasticsearch/files/ingest/zeek.common
@@ -16,7 +16,7 @@
{ "rename": { "field": "message2.id.resp_p", "target_field": "destination.port", "ignore_missing": true } },
{ "set": { "field": "server.port", "value": "{{destination.port}}" } },
{ "date": { "field": "message2.ts", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "ignore_failure": true } },
- { "remove": { "field": ["message2.ts", "path"], "ignore_failure": true } },
+ { "remove": { "field": ["message2.ts", "path", "agent"], "ignore_failure": true } },
{ "pipeline": { "name": "common" } }
]
}
diff --git a/salt/elasticsearch/init.sls b/salt/elasticsearch/init.sls
index 07d75abfb..575d8162c 100644
--- a/salt/elasticsearch/init.sls
+++ b/salt/elasticsearch/init.sls
@@ -114,11 +114,12 @@ so-elasticsearch:
- name: so-elasticsearch
- user: elasticsearch
- environment:
- - bootstrap.memory_lock=true
- - cluster.name={{ esclustername }}
+ - discovery.type=single-node
+ #- bootstrap.memory_lock=true
+ #- cluster.name={{ esclustername }}
- ES_JAVA_OPTS=-Xms{{ esheap }} -Xmx{{ esheap }}
- - http.host=0.0.0.0
- - transport.host=127.0.0.1
+ #- http.host=0.0.0.0
+ #- transport.host=127.0.0.1
- ulimits:
- memlock=-1:-1
- nofile=65536:65536
diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index e350b5798..3aa8fa565 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -71,7 +71,7 @@ filebeat.modules:
#=========================== Filebeat prospectors =============================
# List of prospectors to fetch data.
-filebeat.prospectors:
+filebeat.inputs:
#------------------------------ Log prospector --------------------------------
{%- if grains['role'] == 'so-sensor' or grains['role'] == "so-eval" or grains['role'] == "so-helix" or grains['role'] == "so-heavynode" %}
{%- if BROVER != 'SURICATA' %}
@@ -226,7 +226,7 @@ output.elasticsearch:
# Client Certificate Key
#ssl.key: "/usr/share/filebeat/filebeat.key"
-
+setup.template.enabled: false
# A dictionary of settings to place into the settings.index dictionary
# of the Elasticsearch template. For more details, please check
# https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html
diff --git a/salt/fleet/osquery-packages.html b/salt/fleet/osquery-packages.html
index c94ba89b9..c1843bf01 100644
--- a/salt/fleet/osquery-packages.html
+++ b/salt/fleet/osquery-packages.html
@@ -8,14 +8,14 @@
-
-
-
-
-
-
Osquery Packages
-
-
Notes
-
- These packages are customized for this specific Fleet install and will only be generated after the Fleet setup script has been run. If you want vanilla osquery packages, you can get them directly from osquery.io
- Packages are not signed.
-
-
Downloads
-
-
-
Known Issues
-
-
-
-
-
+
+
+
+
+
+
+
Osquery Packages
+
+
+
Notes
+
+ These packages are customized for this specific Fleet install and will only be generated after the Fleet setup script has been run. If you want vanilla osquery packages, you can get them directly from osquery.io
+ Packages are not signed.
+
+
+
Downloads
+
+ Generated: N/A
+
+
+ Packages:
+
+
+
+ Config Files:
+
+
+
+
Known Issues
+
+
+
+
