CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 10:12:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10638 from Security-Onion-Solutions/cogburn/import-fix

Browse Source 
Change upload path
This commit is contained in:
Jason Ertel
2023-06-22 13:04:22 -04:00
committed by GitHub
parent 6b97d07a89 6769386c86
commit cae9e6230f
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
salt/soc/defaults.yaml
View File

@@ -580,18 +580,18 @@ soc:
- event.dataset - event.dataset
- process.executable - process.executable
- user.name - user.name
'::process_terminated': '::process_terminated':
- soc_timestamp - soc_timestamp
- process.executable - process.executable
- process.pid - process.pid
- winlog.computer_name - winlog.computer_name
'::file_create': '::file_create':
- soc_timestamp - soc_timestamp
- file.target - file.target
- process.executable - process.executable
- process.pid - process.pid
- winlog.computer_name - winlog.computer_name
'::registry_value_set': '::registry_value_set':
- soc_timestamp - soc_timestamp
- winlog.event_data.TargetObject - winlog.event_data.TargetObject
- process.executable - process.executable
@@ -1000,13 +1000,13 @@ soc:
- destination.port - destination.port
- tds.header_type - tds.header_type
- log.id.uid - log.id.uid
- event.dataset - event.dataset
server: server:
bindAddress: 0.0.0.0:9822 bindAddress: 0.0.0.0:9822
baseUrl: / baseUrl: /
maxPacketCount: 5000 maxPacketCount: 5000
htmlDir: html htmlDir: html
importUploadDir: /opt/sensoroni/uploads importUploadDir: /nsm/soc/uploads
airgapEnabled: false airgapEnabled: false
modules: modules:
cases: soc cases: soc
@@ -1034,7 +1034,7 @@ soc:
asyncThreshold: 10 asyncThreshold: 10
influxdb: influxdb:
hostUrl: hostUrl:
token: token:
org: Security Onion org: Security Onion
bucket: telegraf/so_short_term bucket: telegraf/so_short_term
verifyCert: false verifyCert: false
@@ -1409,7 +1409,7 @@ soc:
- name: Host Registry Changes - name: Host Registry Changes
description: Windows Registry changes description: Windows Registry changes
query: 'event.category: registry | groupby -sankey event.action host.name | groupby event.dataset event.action | groupby host.name | groupby process.executable | groupby registry.path | groupby process.executable registry.path' query: 'event.category: registry | groupby -sankey event.action host.name | groupby event.dataset event.action | groupby host.name | groupby process.executable | groupby registry.path | groupby process.executable registry.path'
- name: Host DNS & Process Mappings - name: Host DNS & Process Mappings
description: DNS queries mapped to originating processes description: DNS queries mapped to originating processes
query: 'event.category: network AND _exists_:process.executable AND (_exists_:dns.question.name OR _exists_:dns.answers.data) | groupby -sankey host.name dns.question.name | groupby event.dataset event.type | groupby host.name | groupby process.executable | groupby dns.question.name | groupby dns.answers.data' query: 'event.category: network AND _exists_:process.executable AND (_exists_:dns.question.name OR _exists_:dns.answers.data) | groupby -sankey host.name dns.question.name | groupby event.dataset event.type | groupby host.name | groupby process.executable | groupby dns.question.name | groupby dns.answers.data'
- name: Host Process Activity - name: Host Process Activity
@@ -1686,7 +1686,7 @@ soc:
- name: Templates - name: Templates
query: 'so_case.category:template' query: 'so_case.category:template'
case: case:
analyzerNodeId: analyzerNodeId:
mostRecentlyUsedLimit: 5 mostRecentlyUsedLimit: 5
renderAbbreviatedCount: 30 renderAbbreviatedCount: 30
presets: presets:

2
salt/soc/enabled.sls
View File

@@ -23,7 +23,7 @@ so-soc:
- ipv4_address: {{ DOCKER.containers['so-soc'].ip }} - ipv4_address: {{ DOCKER.containers['so-soc'].ip }}
- binds: - binds:
- /nsm/soc/jobs:/opt/sensoroni/jobs:rw - /nsm/soc/jobs:/opt/sensoroni/jobs:rw
- /nsm/soc/uploads:/opt/sensoroni/uploads:rw - /nsm/soc/uploads:/nsm/soc/uploads:rw
- /opt/so/log/soc/:/opt/sensoroni/logs/:rw - /opt/so/log/soc/:/opt/sensoroni/logs/:rw
- /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro - /opt/so/conf/soc/soc.json:/opt/sensoroni/sensoroni.json:ro
- /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro - /opt/so/conf/soc/motd.md:/opt/sensoroni/html/motd.md:ro