From 34a5985311bd64ccb30aab66eac4eaf2a7694262 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 16 May 2024 21:14:57 -0400
Subject: [PATCH 01/45] Create tpm enrollment script

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
---
 salt/common/tools/sbin/so-luks-tpm-enroll | 60 +++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 salt/common/tools/sbin/so-luks-tpm-enroll

diff --git a/salt/common/tools/sbin/so-luks-tpm-enroll b/salt/common/tools/sbin/so-luks-tpm-enroll
new file mode 100644
index 000000000..f08fe5e0b
--- /dev/null
+++ b/salt/common/tools/sbin/so-luks-tpm-enroll
@@ -0,0 +1,60 @@
+#!/bin/bash
+#
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0."
+
+# This script is intended to be used in the case the ISO install did not properly setup TPM decrypt for LUKS partitions at boot.
+
+check_for_tpm() {
+  echo -n "Checking for TPM: "
+  if [ -d /sys/class/tpm/tpm0 ]; then
+    echo -e "tpm0 found."
+    TPM="yes"
+    # Check if TPM is using sha1 or sha256
+    if [ -d /sys/class/tpm/tpm0/pcr-sha1 ]; then
+      echo -e "TPM is using sha1.\n"
+      TPM_PCR="sha1"
+    elif [ -d /sys/class/tpm/tpm0/pcr-sha256 ]; then
+      echo -e "TPM is using sha256.\n"
+      TPM_PCR="sha256"
+    fi
+  else
+    echo -e "No TPM found.\n"
+    exit 1
+  fi
+}
+
+check_for_luks_partitions() {
+  echo "Checking for LUKS partitions"
+  for part in $(lsblk -o NAME,FSTYPE -ln | grep crypto_LUKS | awk '{print $1}'); do
+    echo "Found LUKS partition: $part"
+    LUKS_PARTITIONS+=("$part")
+  done
+  if [ ${#LUKS_PARTITIONS[@]} -eq 0 ]; then
+    echo -e "No LUKS partitions found.\n"
+    exit 1
+  fi
+  echo ""
+}
+
+enroll_tpm_in_luks() {
+  read -s -p "Enter the LUKS passphrase used during ISO install: " LUKS_PASSPHRASE
+  echo ""
+  for part in "${LUKS_PARTITIONS[@]}"; do
+    echo "Enrolling TPM for LUKS device: /dev/$part"
+    if [ "$TPM_PCR" == "sha1" ]; then
+      clevis luks bind -d /dev/$part tpm2 '{"pcr_bank":"sha1","pcr_ids":"7"}' <<< $LUKS_PASSPHRASE
+    elif [ "$TPM_PCR" == "sha256" ]; then
+      clevis luks bind -d /dev/$part tpm2 '{"pcr_bank":"sha256","pcr_ids":"7"}' <<< $LUKS_PASSPHRASE
+    fi
+  done
+  echo "Running dracut"
+  dracut -fv --no-kernel
+}
+
+check_for_tpm
+check_for_luks_partitions
+enroll_tpm_in_luks
+echo -e "\nTPM enrollment complete. Reboot the system to verify the TPM is correctly decrypting the LUKS partition(s) at boot.\n"
\ No newline at end of file

From fcc72a4f4ec9d31843bd7e620223735cc649a222 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Mon, 20 May 2024 11:23:25 -0600
Subject: [PATCH 02/45] Add Default IntegrityCheck Frequency Values

---
 salt/soc/defaults.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 1f9fe686b..0113f22cc 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1305,6 +1305,7 @@ soc:
           reposFolder: /opt/sensoroni/sigma/repos
           rulesFingerprintFile: /opt/sensoroni/fingerprints/sigma.fingerprint
           stateFilePath: /opt/sensoroni/fingerprints/elastalertengine.state
+          integrityCheckFrequencySeconds: 600
           rulesRepos:
             default:
               - repo: https://github.com/Security-Onion-Solutions/securityonion-resources
@@ -1383,6 +1384,7 @@ soc:
                 community: true
           yaraRulesFolder: /opt/sensoroni/yara/rules
           stateFilePath: /opt/sensoroni/fingerprints/strelkaengine.state
+          integrityCheckFrequencySeconds: 600
         suricataengine:
           allowRegex: ''
           autoUpdateEnabled: true
@@ -1393,6 +1395,7 @@ soc:
           denyRegex: ''
           rulesFingerprintFile: /opt/sensoroni/fingerprints/emerging-all.fingerprint
           stateFilePath: /opt/sensoroni/fingerprints/suricataengine.state
+          integrityCheckFrequencySeconds: 600
       client:
         enableReverseLookup: false
         docsUrl: /docs/

From 6fac6eebceeacc74b6b595e9c7eedf26fa907305 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Mon, 20 May 2024 14:37:54 -0400
Subject: [PATCH 03/45] Helper script for enrolling tpm into luks

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
---
 .../{so-luks-tpm-enroll => so-luks-tpm-regen} | 46 +++++++++++++++++--
 1 file changed, 42 insertions(+), 4 deletions(-)
 rename salt/common/tools/sbin/{so-luks-tpm-enroll => so-luks-tpm-regen} (67%)

diff --git a/salt/common/tools/sbin/so-luks-tpm-enroll b/salt/common/tools/sbin/so-luks-tpm-regen
similarity index 67%
rename from salt/common/tools/sbin/so-luks-tpm-enroll
rename to salt/common/tools/sbin/so-luks-tpm-regen
index f08fe5e0b..50058b504 100644
--- a/salt/common/tools/sbin/so-luks-tpm-enroll
+++ b/salt/common/tools/sbin/so-luks-tpm-regen
@@ -5,7 +5,33 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0."
 
+set -e
 # This script is intended to be used in the case the ISO install did not properly setup TPM decrypt for LUKS partitions at boot.
+if [ -z $NOROOT ]; then
+	# Check for prerequisites
+	if [ "$(id -u)" -ne 0 ]; then
+		echo "This script must be run using sudo!"
+		exit 1
+	fi
+fi
+ENROLL_TPM=N
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --enroll-tpm)
+      ENROLL_TPM=Y
+      ;;
+    *)
+      echo "Usage: $0 [options]"
+      echo ""
+      echo "where options are:"
+      echo "  --enroll-tpm            for when TPM enrollment was not selected during ISO install."
+      echo ""
+      exit 1
+      ;;
+  esac
+  shift
+done
 
 check_for_tpm() {
   echo -n "Checking for TPM: "
@@ -50,11 +76,23 @@ enroll_tpm_in_luks() {
       clevis luks bind -d /dev/$part tpm2 '{"pcr_bank":"sha256","pcr_ids":"7"}' <<< $LUKS_PASSPHRASE
     fi
   done
-  echo "Running dracut"
-  dracut -fv --no-kernel
+ }
+
+regenerate_tpm_enrollment_token() {
+  for part in "${LUKS_PARTITIONS[@]}"; do
+    clevis luks regen -d /dev/$part -s 1 -q
+  done
 }
 
 check_for_tpm
 check_for_luks_partitions
-enroll_tpm_in_luks
-echo -e "\nTPM enrollment complete. Reboot the system to verify the TPM is correctly decrypting the LUKS partition(s) at boot.\n"
\ No newline at end of file
+
+if [[ $ENROLL_TPM == "Y" ]]; then
+  enroll_tpm_in_luks
+else
+  regenerate_tpm_enrollment_token
+fi
+
+echo "Running dracut"
+dracut -fv
+echo -e "\nTPM configuration complete. Reboot the system to verify the TPM is correctly decrypting the LUKS partition(s) at boot.\n"
\ No newline at end of file

From 026023fd0a2c1643b5972d2198391c33972ba602 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Mon, 20 May 2024 14:35:11 -0600
Subject: [PATCH 04/45] Annotate integrityCheckFrequencySeconds per det engine

---
 salt/soc/soc_soc.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index bc1c49185..1e6a915b0 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -113,6 +113,9 @@ soc:
             global: True
             advanced: True
             helpLink: sigma.html
+          integrityCheckFrequencySeconds:
+            description: 'How often the ElastAlert integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
+            global: True
           rulesRepos:
             default: &eerulesRepos
               description: "Custom Git repos to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled."
@@ -211,6 +214,9 @@ soc:
             global: True
             advanced: True
             helpLink: yara.html
+          integrityCheckFrequencySeconds:
+            description: 'How often the Strelka integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
+            global: True
           rulesRepos:
             default: &serulesRepos
               description: "Custom Git repos to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled."
@@ -235,6 +241,9 @@ soc:
             global: True
             advanced: True
             helpLink: suricata.html
+          integrityCheckFrequencySeconds:
+            description: 'How often the Suricata integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
+            global: True
       client:
         enableReverseLookup:
           description: Set to true to enable reverse DNS lookups for IP addresses in the SOC UI.

From 6e97c39f5886c4e6816fd82c2472961f775c4a30 Mon Sep 17 00:00:00 2001
From: Corey Ogburn <corey.ogburn@securityonionsolutions.com>
Date: Mon, 20 May 2024 14:52:05 -0600
Subject: [PATCH 05/45] Marked as Advanced

---
 salt/soc/soc_soc.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 1e6a915b0..0cbb99e62 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -116,6 +116,7 @@ soc:
           integrityCheckFrequencySeconds:
             description: 'How often the ElastAlert integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
             global: True
+            advanced: True
           rulesRepos:
             default: &eerulesRepos
               description: "Custom Git repos to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled."
@@ -217,6 +218,7 @@ soc:
           integrityCheckFrequencySeconds:
             description: 'How often the Strelka integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
             global: True
+            advanced: True
           rulesRepos:
             default: &serulesRepos
               description: "Custom Git repos to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled."
@@ -244,6 +246,7 @@ soc:
           integrityCheckFrequencySeconds:
             description: 'How often the Suricata integrity checker runs (in seconds). This verifies the integrity of deployed rules.'
             global: True
+            advanced: True
       client:
         enableReverseLookup:
           description: Set to true to enable reverse DNS lookups for IP addresses in the SOC UI.

From 6b2219b7f26d5244f9f0285c90400769761e31c2 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 18:52:37 -0400
Subject: [PATCH 06/45] elastalert settings

---
 salt/elastalert/config.sls          | 29 ++++++++++++++++
 salt/elastalert/defaults.yaml       |  2 +-
 salt/elastalert/enabled.sls         |  2 ++
 salt/elastalert/map.jinja           | 21 ++++++++++--
 salt/elastalert/soc_elastalert.yaml | 51 ++++++++++++++++++++++++++++-
 salt/soc/soc_soc.yaml               |  2 +-
 salt/stig/soc_stig.yaml             |  2 +-
 7 files changed, 102 insertions(+), 7 deletions(-)

diff --git a/salt/elastalert/config.sls b/salt/elastalert/config.sls
index 252aa83c0..1251c9d19 100644
--- a/salt/elastalert/config.sls
+++ b/salt/elastalert/config.sls
@@ -82,6 +82,35 @@ elastasomodulesync:
     - group: 933
     - makedirs: True
 
+elastacustomdir:
+  file.directory:
+    - name: /opt/so/conf/elastalert/custom
+    - user: 933
+    - group: 933
+    - makedirs: True
+
+elastacustomsync:
+  file.recurse:
+    - name: /opt/so/conf/elastalert/custom
+    - source: salt://elastalert/files/custom
+    - user: 933
+    - group: 933
+    - makedirs: True
+    - template: jinja
+    - mode: 660
+    - context:
+        elastalert: {{ ELASTALERTMERGED }}
+    - show_changes: False
+
+elastapredefinedsync:
+  file.recurse:
+    - name: /opt/so/conf/elastalert/predefined
+    - source: salt://elastalert/files/predefined
+    - user: 933
+    - group: 933
+    - makedirs: True
+    - show_changes: False
+
 elastaconf:
   file.managed:
     - name: /opt/so/conf/elastalert/elastalert_config.yaml
diff --git a/salt/elastalert/defaults.yaml b/salt/elastalert/defaults.yaml
index 393932992..8021533ab 100644
--- a/salt/elastalert/defaults.yaml
+++ b/salt/elastalert/defaults.yaml
@@ -40,4 +40,4 @@ elastalert:
           level: INFO
           handlers:
             - file
-          propagate: false
+          propagate: False
\ No newline at end of file
diff --git a/salt/elastalert/enabled.sls b/salt/elastalert/enabled.sls
index e4b3642db..6a1ff1440 100644
--- a/salt/elastalert/enabled.sls
+++ b/salt/elastalert/enabled.sls
@@ -30,6 +30,8 @@ so-elastalert:
       - /opt/so/rules/elastalert:/opt/elastalert/rules/:ro
       - /opt/so/log/elastalert:/var/log/elastalert:rw
       - /opt/so/conf/elastalert/modules/:/opt/elastalert/modules/:ro
+      - /opt/so/conf/elastalert/predefined/:/opt/elastalert/predefined/:ro
+      - /opt/so/conf/elastalert/custom/:/opt/elastalert/custom/:ro
       - /opt/so/conf/elastalert/elastalert_config.yaml:/opt/elastalert/config.yaml:ro
       {% if DOCKER.containers['so-elastalert'].custom_bind_mounts %}
         {% for BIND in DOCKER.containers['so-elastalert'].custom_bind_mounts %}
diff --git a/salt/elastalert/map.jinja b/salt/elastalert/map.jinja
index 3db17d32b..8d4e65652 100644
--- a/salt/elastalert/map.jinja
+++ b/salt/elastalert/map.jinja
@@ -14,7 +14,22 @@
 
 {% set ELASTALERTMERGED = salt['pillar.get']('elastalert', ELASTALERTDEFAULTS.elastalert, merge=True) %}
 
-{% set params = ELASTALERTMERGED.alerter_parameters | load_yaml %}
-{% if params != None %}
-  {% do ELASTALERTMERGED.config.update(params) %}
+{% if 'ntf' in salt['pillar.get']('features', []) %}
+   {% set params = ELASTALERTMERGED.alerter_parameters | load_yaml %}
+   {% if params != None %}
+      {% do ELASTALERTMERGED.config.update(params) %}
+   {% endif %}
+
+   {% if ELASTALERTMERGED.smtp_user | length > 0 %}
+      {% do ELASTALERTMERGED.config.update({'smtp_auth_file': '/opt/elastalert/predefined/smtp_auth.yaml'}) %}
+   {% endif %}
+
+   {% if ELASTALERTMERGED.smtp_user | length > 0 %}
+      {% do ELASTALERTMERGED.config.update({'smtp_auth_file': '/opt/elastalert/predefined/smtp_auth.yaml'}) %}
+   {% endif %}
+
+   {% if ELASTALERTMERGED.jira_user | length > 0 or ELASTALERTMERGED.jira_key | length > 0 %}
+      {% do ELASTALERTMERGED.config.update({'jira_account_file': '/opt/elastalert/predefined/jira_auth.yaml'}) %}
+   {% endif %}
+
 {% endif %}
diff --git a/salt/elastalert/soc_elastalert.yaml b/salt/elastalert/soc_elastalert.yaml
index eec3f3866..81df0541f 100644
--- a/salt/elastalert/soc_elastalert.yaml
+++ b/salt/elastalert/soc_elastalert.yaml
@@ -4,12 +4,61 @@ elastalert:
     helpLink: elastalert.html
   alerter_parameters:
     title: Alerter Parameters
-    description: Custom configuration parameters for additional, optional alerters that can be enabled for all Sigma rules. Filter for 'Additional Alerters' in this Configuration screen to find the setting that allows these alerters to be enabled within the SOC ElastAlert module. Use YAML format for these parameters, and reference the ElastAlert 2 documentation, located at https://elastalert2.readthedocs.io, for available alerters and their required configuration parameters.
+    description: Optional configuration parameters for additional alerters that can be enabled for all Sigma rules. Filter for 'Alerter' in this Configuration screen to find the setting that allows these alerters to be enabled within the SOC ElastAlert module. Use YAML format for these parameters, and reference the ElastAlert 2 documentation, located at https://elastalert2.readthedocs.io, for available alerters and their required configuration parameters. A full update of the ElastAlert rule engine, via the Detections screen, is required in order to apply these changes. Requires a valid Security Onion license key.
     global: True
     multiline: True
     syntax: yaml
     helpLink: elastalert.html
     forcedType: string
+  jira_api_key:
+    title: Jira API Key
+    description: Optional configuration parameter for Jira API Key, used instead of the Jira username and password. Requires a valid Security Onion license key.
+    global: True
+    sensitive: True
+    helpLink: elastalert.html
+    forcedType: string
+  jira_pass:
+    title: Jira Password
+    description: Optional configuration parameter for Jira password. Requires a valid Security Onion license key.
+    global: True
+    sensitive: True
+    helpLink: elastalert.html
+    forcedType: string
+  jira_user:
+    title: Jira Username
+    description: Optional configuration parameter for Jira username. Requires a valid Security Onion license key.
+    global: True
+    helpLink: elastalert.html
+    forcedType: string
+  smtp_pass:
+    title: SMTP Password
+    description: Optional configuration parameter for SMTP password, required for authenticating email servers. Requires a valid Security Onion license key.
+    global: True
+    sensitive: True
+    helpLink: elastalert.html
+    forcedType: string
+  smtp_user:
+    title: SMTP Username
+    description: Optional configuration parameter for SMTP username, required for authenticating email servers. Requires a valid Security Onion license key.
+    global: True
+    helpLink: elastalert.html
+    forcedType: string
+  opsgenie_key:
+    title: OpsGenie API Key
+    description: Optional configuration parameter for OpsGenie API Key. Requires a valid Security Onion license key.
+    global: True
+    sensitive: True
+    helpLink: elastalert.html
+    forcedType: string
+  files:
+    custom:
+      filename__ext:
+        title: Custom Parameter File
+        description: Optional configuration file that can be used to specify custom file contents, such as a SMTP certificate file. When used, the corresponding parameter must be set to this setting's filename.ext path inside the custom subdirectory. For example, if specifying the SMTP cert file, the smtp_cert_file key must be set to /opt/elastalert/custom/smtp.crt in the Alerter Parameters setting for this certificate to be enabled, and assumes this duplicated setting has been named smtp__crt. Note that double underscores will be replaced with a period in the filename.
+        global: True
+        duplicating: True
+        file: True
+        helpLink: elastalert.html
   config:
     disable_rules_on_error:
       description: Disable rules on failure.
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index bc1c49185..7367c030d 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -85,7 +85,7 @@ soc:
         elastalertengine:
           additionalAlerters:
             title: Additional Alerters
-            description: Specify additional alerters to enable for all Sigma rules, one alerter name per line. Alerters refers to ElastAlert 2 alerters, as documented at https://elastalert2.readthedocs.io. Note that the configuration parameters for these alerters must be provided in the ElastAlert configuration section. Filter for 'Alerter Parameters' to find this related setting.
+            description: Specify additional alerters to enable for all Sigma rules, one alerter name per line. Alerters refers to ElastAlert 2 alerters, as documented at https://elastalert2.readthedocs.io. Note that the configuration parameters for these alerters must be provided in the ElastAlert configuration section. Filter for 'Alerter' to find this related setting. A full update of the ElastAlert rule engine, via the Detections screen, is required in order to apply these changes. Requires a valid Security Onion license key.
             global: True
             helpLink: sigma.html
             forcedType: "[]string"
diff --git a/salt/stig/soc_stig.yaml b/salt/stig/soc_stig.yaml
index 1fb030c31..597aab809 100644
--- a/salt/stig/soc_stig.yaml
+++ b/salt/stig/soc_stig.yaml
@@ -1,6 +1,6 @@
 stig:
   enabled:
-    description: You can enable or disable the application of STIGS using oscap. Note that the actions performed by OSCAP are not automatically reversible.
+    description: You can enable or disable the application of STIGS using oscap. Note that the actions performed by OSCAP are not automatically reversible. Requires a valid Security Onion license key.
     forcedType: bool
     advanced: True
   run_interval:

From c594168b650f83fb015b7d6cb8dd6180ba225294 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 19:05:43 -0400
Subject: [PATCH 07/45] elastalert settings

---
 salt/elastalert/config.sls                      | 3 ++-
 salt/elastalert/files/custom/placeholder        | 1 +
 salt/elastalert/files/predefined/jira_auth.yaml | 6 ++++++
 salt/elastalert/files/predefined/smtp_auth.yaml | 2 ++
 4 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 salt/elastalert/files/custom/placeholder
 create mode 100644 salt/elastalert/files/predefined/jira_auth.yaml
 create mode 100644 salt/elastalert/files/predefined/smtp_auth.yaml

diff --git a/salt/elastalert/config.sls b/salt/elastalert/config.sls
index 1251c9d19..0583cadfd 100644
--- a/salt/elastalert/config.sls
+++ b/salt/elastalert/config.sls
@@ -97,7 +97,7 @@ elastacustomsync:
     - group: 933
     - makedirs: True
     - template: jinja
-    - mode: 660
+    - file_mode: 660
     - context:
         elastalert: {{ ELASTALERTMERGED }}
     - show_changes: False
@@ -109,6 +109,7 @@ elastapredefinedsync:
     - user: 933
     - group: 933
     - makedirs: True
+    - file_mode: 660
     - show_changes: False
 
 elastaconf:
diff --git a/salt/elastalert/files/custom/placeholder b/salt/elastalert/files/custom/placeholder
new file mode 100644
index 000000000..42e4ae4f0
--- /dev/null
+++ b/salt/elastalert/files/custom/placeholder
@@ -0,0 +1 @@
+THIS IS A PLACEHOLDER FILE
\ No newline at end of file
diff --git a/salt/elastalert/files/predefined/jira_auth.yaml b/salt/elastalert/files/predefined/jira_auth.yaml
new file mode 100644
index 000000000..3f537c92b
--- /dev/null
+++ b/salt/elastalert/files/predefined/jira_auth.yaml
@@ -0,0 +1,6 @@
+{% if elastalert.jira_user | length > 0 %}
+user: {{ elastalert.jira_user }}
+password: {{ elastalert.jira_pass }}
+{% else %}
+apikey: {{ elastalert.jira_key }}
+{% endif %}
\ No newline at end of file
diff --git a/salt/elastalert/files/predefined/smtp_auth.yaml b/salt/elastalert/files/predefined/smtp_auth.yaml
new file mode 100644
index 000000000..483dd6810
--- /dev/null
+++ b/salt/elastalert/files/predefined/smtp_auth.yaml
@@ -0,0 +1,2 @@
+user: {{ elastalert.smtp_user }}
+password: {{ elastalert.smtp_pass }}
\ No newline at end of file

From 8a3061fe3e2369a61e7d6c3a7b12752ac9a51528 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 19:36:06 -0400
Subject: [PATCH 08/45] elastalert settings

---
 .../files/predefined/{jira_auth.yaml => jira_auth.yaml.jinja}     | 0
 .../files/predefined/{smtp_auth.yaml => smtp_auth.yaml.jinja}     | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename salt/elastalert/files/predefined/{jira_auth.yaml => jira_auth.yaml.jinja} (100%)
 rename salt/elastalert/files/predefined/{smtp_auth.yaml => smtp_auth.yaml.jinja} (100%)

diff --git a/salt/elastalert/files/predefined/jira_auth.yaml b/salt/elastalert/files/predefined/jira_auth.yaml.jinja
similarity index 100%
rename from salt/elastalert/files/predefined/jira_auth.yaml
rename to salt/elastalert/files/predefined/jira_auth.yaml.jinja
diff --git a/salt/elastalert/files/predefined/smtp_auth.yaml b/salt/elastalert/files/predefined/smtp_auth.yaml.jinja
similarity index 100%
rename from salt/elastalert/files/predefined/smtp_auth.yaml
rename to salt/elastalert/files/predefined/smtp_auth.yaml.jinja

From e2d0b8f4c7caa825de0ae494ebad01b5d2454f6d Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 19:38:36 -0400
Subject: [PATCH 09/45] elastalert settings

---
 salt/elastalert/config.sls | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/salt/elastalert/config.sls b/salt/elastalert/config.sls
index 0583cadfd..c435a212b 100644
--- a/salt/elastalert/config.sls
+++ b/salt/elastalert/config.sls
@@ -109,7 +109,10 @@ elastapredefinedsync:
     - user: 933
     - group: 933
     - makedirs: True
+    - template: jinja
     - file_mode: 660
+    - context:
+        elastalert: {{ ELASTALERTMERGED }}
     - show_changes: False
 
 elastaconf:

From f8ce039065e970dfce0a8fc47632b6395e9e1c65 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 19:58:12 -0400
Subject: [PATCH 10/45] elastalert settings

---
 salt/elastalert/files/predefined/jira_auth.yaml.jinja | 4 ++--
 salt/elastalert/files/predefined/smtp_auth.yaml.jinja | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/salt/elastalert/files/predefined/jira_auth.yaml.jinja b/salt/elastalert/files/predefined/jira_auth.yaml.jinja
index 3f537c92b..8ae240157 100644
--- a/salt/elastalert/files/predefined/jira_auth.yaml.jinja
+++ b/salt/elastalert/files/predefined/jira_auth.yaml.jinja
@@ -1,6 +1,6 @@
-{% if elastalert.jira_user | length > 0 %}
+{% if elastalert.get('jira_user', '') | length > 0 and elastalert.get('jira_pass', '') | length > 0 %}
 user: {{ elastalert.jira_user }}
 password: {{ elastalert.jira_pass }}
 {% else %}
-apikey: {{ elastalert.jira_key }}
+apikey: {{ elastalert.get('jira_key', '') }}
 {% endif %}
\ No newline at end of file
diff --git a/salt/elastalert/files/predefined/smtp_auth.yaml.jinja b/salt/elastalert/files/predefined/smtp_auth.yaml.jinja
index 483dd6810..0d488dd5c 100644
--- a/salt/elastalert/files/predefined/smtp_auth.yaml.jinja
+++ b/salt/elastalert/files/predefined/smtp_auth.yaml.jinja
@@ -1,2 +1,2 @@
-user: {{ elastalert.smtp_user }}
-password: {{ elastalert.smtp_pass }}
\ No newline at end of file
+user: {{ elastalert.get('smtp_user', '') }}
+password: {{ elastalert.get('smtp_pass', '') }}
\ No newline at end of file

From 02b4d37c11e8f162c358bd02929de41d9ce7c24c Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 20:00:31 -0400
Subject: [PATCH 11/45] elastalert settings

---
 .../files/predefined/{jira_auth.yaml.jinja => jira_auth.yaml}     | 0
 .../files/predefined/{smtp_auth.yaml.jinja => smtp_auth.yaml}     | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename salt/elastalert/files/predefined/{jira_auth.yaml.jinja => jira_auth.yaml} (100%)
 rename salt/elastalert/files/predefined/{smtp_auth.yaml.jinja => smtp_auth.yaml} (100%)

diff --git a/salt/elastalert/files/predefined/jira_auth.yaml.jinja b/salt/elastalert/files/predefined/jira_auth.yaml
similarity index 100%
rename from salt/elastalert/files/predefined/jira_auth.yaml.jinja
rename to salt/elastalert/files/predefined/jira_auth.yaml
diff --git a/salt/elastalert/files/predefined/smtp_auth.yaml.jinja b/salt/elastalert/files/predefined/smtp_auth.yaml
similarity index 100%
rename from salt/elastalert/files/predefined/smtp_auth.yaml.jinja
rename to salt/elastalert/files/predefined/smtp_auth.yaml

From b7a4f20c61be693f893c92c008831192a6fce1d0 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Mon, 20 May 2024 20:11:30 -0400
Subject: [PATCH 12/45] elastalert settings

---
 salt/elastalert/files/predefined/jira_auth.yaml | 2 +-
 salt/elastalert/files/predefined/smtp_auth.yaml | 2 +-
 salt/elastalert/soc_elastalert.yaml             | 9 +--------
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/salt/elastalert/files/predefined/jira_auth.yaml b/salt/elastalert/files/predefined/jira_auth.yaml
index 8ae240157..9bf0425c0 100644
--- a/salt/elastalert/files/predefined/jira_auth.yaml
+++ b/salt/elastalert/files/predefined/jira_auth.yaml
@@ -2,5 +2,5 @@
 user: {{ elastalert.jira_user }}
 password: {{ elastalert.jira_pass }}
 {% else %}
-apikey: {{ elastalert.get('jira_key', '') }}
+apikey: {{ elastalert.get('jira_api_key', '') }}
 {% endif %}
\ No newline at end of file
diff --git a/salt/elastalert/files/predefined/smtp_auth.yaml b/salt/elastalert/files/predefined/smtp_auth.yaml
index 0d488dd5c..d09d101f1 100644
--- a/salt/elastalert/files/predefined/smtp_auth.yaml
+++ b/salt/elastalert/files/predefined/smtp_auth.yaml
@@ -1,2 +1,2 @@
 user: {{ elastalert.get('smtp_user', '') }}
-password: {{ elastalert.get('smtp_pass', '') }}
\ No newline at end of file
+password: {{ elastalert.get('smtp_pass', '') }}
diff --git a/salt/elastalert/soc_elastalert.yaml b/salt/elastalert/soc_elastalert.yaml
index 81df0541f..ab315c482 100644
--- a/salt/elastalert/soc_elastalert.yaml
+++ b/salt/elastalert/soc_elastalert.yaml
@@ -43,20 +43,13 @@ elastalert:
     global: True
     helpLink: elastalert.html
     forcedType: string
-  opsgenie_key:
-    title: OpsGenie API Key
-    description: Optional configuration parameter for OpsGenie API Key. Requires a valid Security Onion license key.
-    global: True
-    sensitive: True
-    helpLink: elastalert.html
-    forcedType: string
   files:
     custom:
       filename__ext:
         title: Custom Parameter File
         description: Optional configuration file that can be used to specify custom file contents, such as a SMTP certificate file. When used, the corresponding parameter must be set to this setting's filename.ext path inside the custom subdirectory. For example, if specifying the SMTP cert file, the smtp_cert_file key must be set to /opt/elastalert/custom/smtp.crt in the Alerter Parameters setting for this certificate to be enabled, and assumes this duplicated setting has been named smtp__crt. Note that double underscores will be replaced with a period in the filename.
         global: True
-        duplicating: True
+        duplicates: True
         file: True
         helpLink: elastalert.html
   config:

From 03826dd32c02acfdea0a4a94722a5fa853166571 Mon Sep 17 00:00:00 2001
From: Doug Burks <doug.burks@securityonionsolutions.com>
Date: Tue, 21 May 2024 06:43:07 -0400
Subject: [PATCH 13/45] Update README.md with new Detections screenshot number

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a990326a8..530a21813 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Hunt
 ![Hunt](https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion-docs/2.4/images/56_hunt.png)
 
 Detections
-![Detections](https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion-docs/2.4/images/59_detections.png)
+![Detections](https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion-docs/2.4/images/57_detections.png)
 
 PCAP
 ![PCAP](https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion-docs/2.4/images/62_pcap.png)

From d315b95d77d5e9fed89f03d0bb21ada98d74d8a7 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 21 May 2024 07:15:19 -0400
Subject: [PATCH 14/45] elastalert settings

---
 salt/elastalert/config.sls          |  3 --
 salt/elastalert/soc_elastalert.yaml | 51 ++++++++++++++++++++++++++---
 2 files changed, 47 insertions(+), 7 deletions(-)

diff --git a/salt/elastalert/config.sls b/salt/elastalert/config.sls
index c435a212b..25d5bf5f8 100644
--- a/salt/elastalert/config.sls
+++ b/salt/elastalert/config.sls
@@ -96,10 +96,7 @@ elastacustomsync:
     - user: 933
     - group: 933
     - makedirs: True
-    - template: jinja
     - file_mode: 660
-    - context:
-        elastalert: {{ ELASTALERTMERGED }}
     - show_changes: False
 
 elastapredefinedsync:
diff --git a/salt/elastalert/soc_elastalert.yaml b/salt/elastalert/soc_elastalert.yaml
index ab315c482..435c5be6a 100644
--- a/salt/elastalert/soc_elastalert.yaml
+++ b/salt/elastalert/soc_elastalert.yaml
@@ -45,11 +45,54 @@ elastalert:
     forcedType: string
   files:
     custom:
-      filename__ext:
-        title: Custom Parameter File
-        description: Optional configuration file that can be used to specify custom file contents, such as a SMTP certificate file. When used, the corresponding parameter must be set to this setting's filename.ext path inside the custom subdirectory. For example, if specifying the SMTP cert file, the smtp_cert_file key must be set to /opt/elastalert/custom/smtp.crt in the Alerter Parameters setting for this certificate to be enabled, and assumes this duplicated setting has been named smtp__crt. Note that double underscores will be replaced with a period in the filename.
+      alertmanager_ca__crt:
+        description: Optional custom Certificate Authority for connecting to an AlertManager server. To utilize this custom file, the alertmanager_ca_certs key must be set to /opt/elastalert/custom/alertmanager_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      gelf_ca__crt:
+        description: Optional custom Certificate Authority for connecting to a Graylog server. To utilize this custom file, the graylog_ca_certs key must be set to /opt/elastalert/custom/graylog_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      http_post_ca__crt:
+        description: Optional custom Certificate Authority for connecting to a generic HTTP server, via the legacy HTTP POST alerter. To utilize this custom file, the http_post_ca_certs key must be set to /opt/elastalert/custom/http_post2_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      http_post2_ca__crt:
+        description: Optional custom Certificate Authority for connecting to a generic HTTP server, via the newer HTTP POST 2 alerter. To utilize this custom file, the http_post2_ca_certs key must be set to /opt/elastalert/custom/http_post2_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      ms_teams_ca__crt:
+        description: Optional custom Certificate Authority for connecting to Microsoft Teams server. To utilize this custom file, the ms_teams_ca_certs key must be set to /opt/elastalert/custom/ms_teams_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      pagerduty_ca__crt:
+        description: Optional custom Certificate Authority for connecting to PagerDuty server. To utilize this custom file, the pagerduty_ca_certs key must be set to /opt/elastalert/custom/pagerduty_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      rocket_chat_ca__crt:
+        description: Optional custom Certificate Authority for connecting to PagerDuty server. To utilize this custom file, the rocket_chart_ca_certs key must be set to /opt/elastalert/custom/rocket_chat_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      smtp__crt:
+        description: Optional custom certificate for connecting to an SMTP server. To utilize this custom file, the smtp_cert_file key must be set to /opt/elastalert/custom/smtp.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      smtp__key:
+        description: Optional custom certificate key for connecting to an SMTP server. To utilize this custom file, the smtp_key_file key must be set to /opt/elastalert/custom/smtp.key in the Alerter Parameters setting. Requires a valid Security Onion license key.
+        global: True
+        file: True
+        helpLink: elastalert.html
+      slack_ca__crt:
+        description: Optional custom Certificate Authority for connecting to Slack. To utilize this custom file, the slack_ca_certs key must be set to /opt/elastalert/custom/slack_ca.crt in the Alerter Parameters setting. Requires a valid Security Onion license key.
         global: True
-        duplicates: True
         file: True
         helpLink: elastalert.html
   config:

From 8ce19a93b96ff04d35f99b0c403bf6dc1ec0651b Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 21 May 2024 13:29:20 -0400
Subject: [PATCH 15/45] exclude false positives related to detections

---
 salt/common/tools/sbin/so-log-check | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/salt/common/tools/sbin/so-log-check b/salt/common/tools/sbin/so-log-check
index 5bee4d254..cf1691589 100755
--- a/salt/common/tools/sbin/so-log-check
+++ b/salt/common/tools/sbin/so-log-check
@@ -203,6 +203,8 @@ if [[ $EXCLUDE_KNOWN_ERRORS == 'Y' ]]; then
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|context deadline exceeded"
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|Error running query:"         # Specific issues with detection rules
     EXCLUDED_ERRORS="$EXCLUDED_ERRORS|detect-parse"                 # Suricata encountering a malformed rule
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|integrity check failed"       # Detections: Exclude false positive due to automated testing
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|syncErrors"                   # Detections: Not an actual error
 fi
 
 RESULT=0

From d57cc9627f1273401cf25fe515cf9c474100d088 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 21 May 2024 13:31:50 -0400
Subject: [PATCH 16/45] exclude false positives related to detections

---
 salt/elastalert/defaults.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elastalert/defaults.yaml b/salt/elastalert/defaults.yaml
index 8021533ab..393932992 100644
--- a/salt/elastalert/defaults.yaml
+++ b/salt/elastalert/defaults.yaml
@@ -40,4 +40,4 @@ elastalert:
           level: INFO
           handlers:
             - file
-          propagate: False
\ No newline at end of file
+          propagate: false

From deb140e38e2223aa1d727a78cbf2e73d8a8f1701 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Tue, 21 May 2024 13:38:52 -0400
Subject: [PATCH 17/45] Exclude detections from template name matching

---
 .../tools/sbin_jinja/so-elasticsearch-templates-load            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-templates-load b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-templates-load
index 8f45d6c36..080348522 100755
--- a/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-templates-load
+++ b/salt/elasticsearch/tools/sbin_jinja/so-elasticsearch-templates-load
@@ -133,7 +133,7 @@ if [ ! -f $STATE_FILE_SUCCESS ]; then
     for i in $pattern; do
       TEMPLATE=${i::-14}
       COMPONENT_PATTERN=${TEMPLATE:3}
-      MATCH=$(echo "$TEMPLATE" | grep -E "^so-logs-|^so-metrics" | grep -v osquery)
+      MATCH=$(echo "$TEMPLATE" | grep -E "^so-logs-|^so-metrics" | grep -vE "detections|osquery")
       if [[ -n "$MATCH" && ! "$COMPONENT_LIST" =~ "$COMPONENT_PATTERN" ]]; then
         load_failures=$((load_failures+1))
         echo "Component template does not exist for $COMPONENT_PATTERN. The index template will not be loaded. Load failures: $load_failures"

From f4490fab58954a864942425c4f909f55d7679ffc Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Tue, 21 May 2024 17:05:39 -0400
Subject: [PATCH 18/45] Add rule.uuid for YARA matches

---
 salt/elasticsearch/files/ingest/strelka.file | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/elasticsearch/files/ingest/strelka.file b/salt/elasticsearch/files/ingest/strelka.file
index d55e19350..f66a98857 100644
--- a/salt/elasticsearch/files/ingest/strelka.file
+++ b/salt/elasticsearch/files/ingest/strelka.file
@@ -56,6 +56,7 @@
     { "set":         { "if": "ctx.exiftool?.Subsystem != null", "field": "host.subsystem",        "value": "{{exiftool.Subsystem}}", "ignore_failure": true }},
     { "set":         { "if": "ctx.scan?.yara?.matches instanceof List", "field": "rule.name",        "value": "{{scan.yara.matches.0}}" }},
     { "set":         { "if": "ctx.rule?.name != null", "field": "event.dataset",        "value": "alert", "override": true }},
+    { "set":         { "if": "ctx.rule?.name != null", "field": "rule.uuid",        "value": "rule.name", "override": true }},
     { "rename":         { "field": "file.flavors.mime", "target_field": "file.mime_type",        "ignore_missing": true }},
     { "set":         { "if": "ctx.rule?.name != null && ctx.rule?.score == null",   "field": "event.severity", "value": 3, "override": true }  },
     { "convert" :    { "if": "ctx.rule?.score != null", "field" : "rule.score","type": "integer"}},

From 3992ef108207b88644198cb88e42860f515bf02d Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 21 May 2024 17:45:56 -0400
Subject: [PATCH 19/45] Add rule.uuid to default groupbys

---
 salt/soc/defaults.yaml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 0113f22cc..d19f7ed40 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -2020,6 +2020,7 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
+              - rule.uuid
             ':sigma:':
               - soc_timestamp
               - event.dataset
@@ -2033,6 +2034,7 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
+              - rule.uuid
             ':strelka:':
               - soc_timestamp
               - event.dataset
@@ -2042,6 +2044,7 @@ soc:
               - file.source
               - file.mime_type
               - log.id.fuid
+              - rule.uuid
           queryBaseFilter: tags:alert
           queryToggleFilters:
             - name: acknowledged
@@ -2056,17 +2059,17 @@ soc:
                 - acknowledged
           queries:
             - name: 'Group By Name, Module'
-              query: '* | groupby rule.name event.module* event.severity_label'
+              query: '* | groupby rule.name event.module* event.severity_label rule.uuid'
             - name: 'Group By Sensor, Source IP/Port, Destination IP/Port, Name'
-              query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label'
+              query: '* | groupby observer.name source.ip source.port destination.ip destination.port rule.name network.community_id event.severity_label rule.uuid'
             - name: 'Group By Source IP, Name'
-              query: '* | groupby source.ip rule.name event.severity_label'
+              query: '* | groupby source.ip rule.name event.severity_label rule.uuid'
             - name: 'Group By Source Port, Name'
-              query: '* | groupby source.port rule.name event.severity_label'
+              query: '* | groupby source.port rule.name event.severity_label rule.uuid'
             - name: 'Group By Destination IP, Name'
-              query: '* | groupby destination.ip rule.name event.severity_label'
+              query: '* | groupby destination.ip rule.name event.severity_label rule.uuid'
             - name: 'Group By Destination Port, Name'
-              query: '* | groupby destination.port rule.name event.severity_label'
+              query: '* | groupby destination.port rule.name event.severity_label rule.uuid'
             - name: Ungroup
               query: '*'
         grid:

From f9e9b825cffe381115f9aa965f07c084001d866b Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 21 May 2024 17:53:20 -0400
Subject: [PATCH 20/45] Removed unneeded groupby

---
 salt/soc/defaults.yaml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index d19f7ed40..15f1fd8ce 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -2020,7 +2020,6 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
-              - rule.uuid
             ':sigma:':
               - soc_timestamp
               - event.dataset
@@ -2034,7 +2033,6 @@ soc:
               - event_data.destination.port
               - event_data.process.executable
               - event_data.process.pid
-              - rule.uuid
             ':strelka:':
               - soc_timestamp
               - event.dataset
@@ -2044,7 +2042,6 @@ soc:
               - file.source
               - file.mime_type
               - log.id.fuid
-              - rule.uuid
           queryBaseFilter: tags:alert
           queryToggleFilters:
             - name: acknowledged

From 8af3158ea7bd3cdc7dfe22f1c6103db06ebbd7ac Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 21 May 2024 18:28:21 -0400
Subject: [PATCH 21/45] fix elastalert settings

---
 salt/elastalert/map.jinja | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/salt/elastalert/map.jinja b/salt/elastalert/map.jinja
index 8d4e65652..b8ceca277 100644
--- a/salt/elastalert/map.jinja
+++ b/salt/elastalert/map.jinja
@@ -15,20 +15,16 @@
 {% set ELASTALERTMERGED = salt['pillar.get']('elastalert', ELASTALERTDEFAULTS.elastalert, merge=True) %}
 
 {% if 'ntf' in salt['pillar.get']('features', []) %}
-   {% set params = ELASTALERTMERGED.alerter_parameters | load_yaml %}
-   {% if params != None %}
+   {% set params = ELASTALERTMERGED.get('alerter_parameters', '') | load_yaml %}
+   {% if params != None and params | length > 0 %}
       {% do ELASTALERTMERGED.config.update(params) %}
    {% endif %}
 
-   {% if ELASTALERTMERGED.smtp_user | length > 0 %}
+   {% if ELASTALERTMERGED.get('smtp_user', '') | length > 0 %}
       {% do ELASTALERTMERGED.config.update({'smtp_auth_file': '/opt/elastalert/predefined/smtp_auth.yaml'}) %}
    {% endif %}
 
-   {% if ELASTALERTMERGED.smtp_user | length > 0 %}
-      {% do ELASTALERTMERGED.config.update({'smtp_auth_file': '/opt/elastalert/predefined/smtp_auth.yaml'}) %}
-   {% endif %}
-
-   {% if ELASTALERTMERGED.jira_user | length > 0 or ELASTALERTMERGED.jira_key | length > 0 %}
+   {% if ELASTALERTMERGED.get('jira_user', '') | length > 0 or ELASTALERTMERGED.get('jira_key', '') | length > 0 %}
       {% do ELASTALERTMERGED.config.update({'jira_account_file': '/opt/elastalert/predefined/jira_auth.yaml'}) %}
    {% endif %}
 

From 3cfd71075602fa04b104f004a22cbf151258f970 Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Wed, 22 May 2024 13:41:32 -0400
Subject: [PATCH 22/45] Change tab casing to be consistent with other whiptail
 prompts

---
 setup/so-whiptail | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/so-whiptail b/setup/so-whiptail
index 06d62a027..1dab63237 100755
--- a/setup/so-whiptail
+++ b/setup/so-whiptail
@@ -475,7 +475,7 @@ whiptail_end_settings() {
 	read -r -d '' msg <<-EOM
 	$end_msg
 
-	Press the Tab key to select yes or no.
+	Press the TAB key to select yes or no.
 	EOM
 
 	whiptail --title "The following options have been set, would you like to proceed?" --yesno "$msg" 24 75 --scrolltext

From d19c1a514bee994b03a3f3f54df531bbcabcbd7c Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Wed, 22 May 2024 15:12:23 -0400
Subject: [PATCH 23/45] Detections backup script

---
 salt/soc/config.sls                        |  20 ++++
 salt/soc/files/soc/so-detections-backup.py | 111 +++++++++++++++++++++
 2 files changed, 131 insertions(+)
 create mode 100644 salt/soc/files/soc/so-detections-backup.py

diff --git a/salt/soc/config.sls b/salt/soc/config.sls
index a85032295..65d6bd2fa 100644
--- a/salt/soc/config.sls
+++ b/salt/soc/config.sls
@@ -80,6 +80,15 @@ socmotd:
     - mode: 600
     - template: jinja
 
+filedetectionsbackup:
+  file.managed:
+    - name: /opt/so/conf/soc/so-detections-backup.py
+    - source: salt://soc/files/soc/so-detections-backup.py
+    - user: 939
+    - group: 939
+    - mode: 600
+    - show_changes: False
+
 crondetectionsruntime:
   cron.present:
     - name: /usr/sbin/so-detections-runtime-status cron 
@@ -91,6 +100,17 @@ crondetectionsruntime:
     - month: '*'
     - dayweek: '*'
 
+crondetectionsbackup:
+  cron.present:
+    - name: python3 /opt/so/conf/soc/so-detections-backup.py 
+    - identifier: detections-backup
+    - user: root
+    - minute: '0'
+    - hour: '0'
+    - daymonth: '*'
+    - month: '*'
+    - dayweek: '*'
+
 socsigmafinalpipeline:
   file.managed:
     - name: /opt/so/conf/soc/sigma_final_pipeline.yaml
diff --git a/salt/soc/files/soc/so-detections-backup.py b/salt/soc/files/soc/so-detections-backup.py
new file mode 100644
index 000000000..b7e6e2491
--- /dev/null
+++ b/salt/soc/files/soc/so-detections-backup.py
@@ -0,0 +1,111 @@
+# Copyright 2020-2023 Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
+# This script queries Elasticsearch for Custom Detections and all Overrides,
+# and git commits them to disk at $OUTPUT_DIR
+
+import os
+import subprocess
+import json
+import requests
+from requests.auth import HTTPBasicAuth
+import urllib3
+from datetime import datetime
+
+# Suppress SSL warnings
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+# Constants
+ES_URL = "https://localhost:9200/so-detection/_search"
+QUERY_DETECTIONS = '{"query": {"bool": {"must": [{"match_all": {}}, {"term": {"so_detection.ruleset": "__custom__"}}]}},"size": 10000}'
+QUERY_OVERRIDES = '{"query": {"bool": {"must": [{"exists": {"field": "so_detection.overrides"}}]}},"size": 10000}'
+OUTPUT_DIR = "/nsm/backup/detections/repo"
+AUTH_FILE = "/opt/so/conf/elasticsearch/curl.config"
+
+def get_auth_credentials(auth_file):
+    with open(auth_file, 'r') as file:
+        for line in file:
+            if line.startswith('user ='):
+                return line.split('=', 1)[1].strip().replace('"', '')
+
+def query_elasticsearch(query, auth):
+    headers = {"Content-Type": "application/json"}
+    response = requests.get(ES_URL, headers=headers, data=query, auth=auth, verify=False)
+    response.raise_for_status()
+    return response.json()
+
+def save_content(hit, base_folder, subfolder="", extension="txt"):
+    so_detection = hit["_source"]["so_detection"]
+    public_id = so_detection["publicId"]
+    content = so_detection["content"]
+    file_dir = os.path.join(base_folder, subfolder)
+    os.makedirs(file_dir, exist_ok=True)
+    file_path = os.path.join(file_dir, f"{public_id}.{extension}")
+    with open(file_path, "w") as f:
+        f.write(content)
+    return file_path
+
+def save_overrides(hit):
+    so_detection = hit["_source"]["so_detection"]
+    public_id = so_detection["publicId"]
+    overrides = so_detection["overrides"]
+    language = so_detection["language"]
+    folder = os.path.join(OUTPUT_DIR, language, "overrides")
+    os.makedirs(folder, exist_ok=True)
+    extension = "yaml" if language == "sigma" else "txt"
+    file_path = os.path.join(folder, f"{public_id}.{extension}")
+    with open(file_path, "w") as f:
+        f.write('\n'.join(json.dumps(override) for override in overrides) if isinstance(overrides, list) else overrides)
+    return file_path
+
+def ensure_git_repo():
+    if not os.path.isdir(os.path.join(OUTPUT_DIR, '.git')):
+        subprocess.run(["git", "config", "--global", "init.defaultBranch", "main"], check=True)
+        subprocess.run(["git", "-C", OUTPUT_DIR, "init"], check=True)
+        subprocess.run(["git", "-C", OUTPUT_DIR, "remote", "add", "origin", "default"], check=True)
+
+def commit_changes():
+    ensure_git_repo()
+    subprocess.run(["git", "-C", OUTPUT_DIR, "config", "user.email", "securityonion@local.invalid"], check=True)
+    subprocess.run(["git", "-C", OUTPUT_DIR, "config", "user.name", "securityonion"], check=True)
+    subprocess.run(["git", "-C", OUTPUT_DIR, "add", "."], check=True)
+    status_result = subprocess.run(["git", "-C", OUTPUT_DIR, "status"], capture_output=True, text=True)
+    print(status_result.stdout)
+    commit_result = subprocess.run(["git", "-C", OUTPUT_DIR, "commit", "-m", "Update detections and overrides"], check=False, capture_output=True)
+    if commit_result.returncode == 1:
+        print("No changes to commit.")
+    elif commit_result.returncode == 0:
+        print("Changes committed successfully.")
+    else:
+        commit_result.check_returncode()
+
+def main():
+    try:
+        timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+        print(f"Backing up Custom Detections and all Overrides to {OUTPUT_DIR} - {timestamp}\n")
+        
+        auth_credentials = get_auth_credentials(AUTH_FILE)
+        username, password = auth_credentials.split(':', 1)
+        auth = HTTPBasicAuth(username, password)
+        
+        # Query and save custom detections
+        detections = query_elasticsearch(QUERY_DETECTIONS, auth)["hits"]["hits"]
+        for hit in detections:
+            save_content(hit, OUTPUT_DIR, hit["_source"]["so_detection"]["language"], "yaml" if hit["_source"]["so_detection"]["language"] == "sigma" else "txt")
+        
+        # Query and save overrides
+        overrides = query_elasticsearch(QUERY_OVERRIDES, auth)["hits"]["hits"]
+        for hit in overrides:
+            save_overrides(hit)
+        
+        commit_changes()
+        
+        timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
+        print(f"Backup Completed - {timestamp}")
+    except Exception as e:
+        print(f"An error occurred: {e}")
+
+if __name__ == "__main__":
+    main()
\ No newline at end of file

From a072e34cfeaaabdb24090f6c99eb2bf4b8057b88 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Wed, 22 May 2024 17:12:41 -0400
Subject: [PATCH 24/45] Fix casing issue

---
 salt/soc/soc_soc.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 78f541982..60de637b4 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -200,7 +200,7 @@ soc:
             global: True
             advanced: True
             helpLink: yara.html
-          autoEnabledYARARules:
+          autoEnabledYaraRules:
             description: 'YARA rules to automatically enable on initial import. Format is $Ruleset - for example, for the default shipped ruleset: securityonion-yara'
             global: True
             advanced: True

From 3d4f3a04a3c855e758f00ecbfa0fd9376607f8aa Mon Sep 17 00:00:00 2001
From: Doug Burks <doug.burks@securityonionsolutions.com>
Date: Thu, 23 May 2024 05:56:18 -0400
Subject: [PATCH 25/45] Update defaults.yaml to fix order of groupby tables and
 eliminate duplicate

---
 salt/soc/defaults.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 15f1fd8ce..6ecf1f183 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1817,7 +1817,7 @@ soc:
               query: 'tags:dhcp | groupby host.hostname | groupby -sankey host.hostname client.address | groupby client.address | groupby -sankey client.address server.address | groupby server.address | groupby dhcp.message_types | groupby host.domain'
             - name: DNS
               description: DNS (Domain Name System) queries
-              query: 'tags:dns | groupby dns.query.name | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby dns.highest_registered_domain | groupby dns.parent_domain | groupby dns.response.code_name | groupby dns.answers.name | groupby dns.query.type_name | groupby dns.response.code_name | groupby destination_geo.organization_name'
+              query: 'tags:dns | groupby dns.query.name | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby dns.highest_registered_domain | groupby dns.parent_domain | groupby dns.query.type_name | groupby dns.response.code_name | groupby dns.answers.name | groupby destination_geo.organization_name'
             - name: DPD
               description: DPD (Dynamic Protocol Detection) errors
               query: 'tags:dpd | groupby error.reason | groupby -sankey error.reason source.ip | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby network.protocol | groupby destination_geo.organization_name'

From 8e7c487cb0e0e13a28ea71896dd2b52fb2ab1ac6 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Thu, 23 May 2024 05:59:31 -0400
Subject: [PATCH 26/45] Fix strelka rule.uuid

---
 salt/elasticsearch/files/ingest/strelka.file | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/elasticsearch/files/ingest/strelka.file b/salt/elasticsearch/files/ingest/strelka.file
index f66a98857..d9aed3b29 100644
--- a/salt/elasticsearch/files/ingest/strelka.file
+++ b/salt/elasticsearch/files/ingest/strelka.file
@@ -56,7 +56,7 @@
     { "set":         { "if": "ctx.exiftool?.Subsystem != null", "field": "host.subsystem",        "value": "{{exiftool.Subsystem}}", "ignore_failure": true }},
     { "set":         { "if": "ctx.scan?.yara?.matches instanceof List", "field": "rule.name",        "value": "{{scan.yara.matches.0}}" }},
     { "set":         { "if": "ctx.rule?.name != null", "field": "event.dataset",        "value": "alert", "override": true }},
-    { "set":         { "if": "ctx.rule?.name != null", "field": "rule.uuid",        "value": "rule.name", "override": true }},
+    { "set":         { "if": "ctx.rule?.name != null", "field": "rule.uuid",        "value": "{{rule.name}}", "override": true }},
     { "rename":         { "field": "file.flavors.mime", "target_field": "file.mime_type",        "ignore_missing": true }},
     { "set":         { "if": "ctx.rule?.name != null && ctx.rule?.score == null",   "field": "event.severity", "value": 3, "override": true }  },
     { "convert" :    { "if": "ctx.rule?.score != null", "field" : "rule.score","type": "integer"}},

From 1e6161f89c82277a409d0051f82a0fa5a79582d9 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Thu, 23 May 2024 08:19:43 -0400
Subject: [PATCH 27/45] Update defaults.yaml

---
 salt/soc/defaults.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 6ecf1f183..86170b4ce 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1482,7 +1482,7 @@ soc:
               showSubtitle: true
             - name: Elastalerts
               description: ''
-              query: '_type:elastalert | groupby rule.name'
+              query: 'event.dataset:sigma.alert | groupby rule.name'
               showSubtitle: true
             - name: Alerts
               description: Show all alerts grouped by alert source

From 0b9ebefdb670e9ad85bd4bb415291e82ef71c505 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 23 May 2024 10:08:23 -0400
Subject: [PATCH 28/45] only show telem status in final whiptail if new
 deployment

---
 setup/so-whiptail | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/so-whiptail b/setup/so-whiptail
index 1dab63237..4fab6dbe4 100755
--- a/setup/so-whiptail
+++ b/setup/so-whiptail
@@ -451,7 +451,7 @@ whiptail_end_settings() {
 		done
 	fi
 
-	if [[ ! $is_airgap ]]; then
+	if [[ ! $is_airgap ]] && [[ $dist_option == "NEWDEPLOYMENT" ]]; then
 		if [[ $telemetry -eq 0 ]]; then
 			__append_end_msg "SOC Telemetry: enabled"
 		else

From ea7715f7297c426956b7074193ca331f0aaa0b18 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 23 May 2024 10:41:10 -0400
Subject: [PATCH 29/45] use waitforstate var instead.

---
 setup/so-whiptail | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/setup/so-whiptail b/setup/so-whiptail
index 4fab6dbe4..d950f2921 100755
--- a/setup/so-whiptail
+++ b/setup/so-whiptail
@@ -451,7 +451,7 @@ whiptail_end_settings() {
 		done
 	fi
 
-	if [[ ! $is_airgap ]] && [[ $dist_option == "NEWDEPLOYMENT" ]]; then
+	if [[ ! $is_airgap ]] && [[ $waitforstate ]]; then
 		if [[ $telemetry -eq 0 ]]; then
 			__append_end_msg "SOC Telemetry: enabled"
 		else

From 15155613c3d60a2e48a7e0c922ae09eb5d225acb Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Fri, 24 May 2024 08:23:45 -0400
Subject: [PATCH 30/45] provide default columns when viewing SOC logs

---
 salt/soc/defaults.yaml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 86170b4ce..39960d946 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1271,6 +1271,14 @@ soc:
         - netflow.type
         - netflow.exporter.version
         - observer.ip
+      ':soc:':
+        - soc_timestamp
+        - source.ip
+        - soc.fields.requestMethod
+        - soc.fields.requestPath
+        - soc.fields.statusCode
+        - event.action
+        - soc.fields.error
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /

From bd11d59c15fb711332ab0c67423e217f2b4b1b70 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Fri, 24 May 2024 08:38:12 -0400
Subject: [PATCH 31/45] add event.dataset since there are other datasets in soc
 logs

---
 salt/soc/defaults.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 39960d946..9f5faf50b 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1273,6 +1273,7 @@ soc:
         - observer.ip
       ':soc:':
         - soc_timestamp
+        - event.dataset
         - source.ip
         - soc.fields.requestMethod
         - soc.fields.requestPath

From 66725b11b304d1742caad49854bd968f71196c97 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Fri, 24 May 2024 09:55:10 -0400
Subject: [PATCH 32/45] Added unit tests

---
 salt/soc/config.sls                           |   3 +-
 salt/soc/files/soc/so-detections-backup.py    |   2 +
 .../files/soc/so-detections-backup_test.py    | 159 ++++++++++++++++++
 3 files changed, 162 insertions(+), 2 deletions(-)
 create mode 100644 salt/soc/files/soc/so-detections-backup_test.py

diff --git a/salt/soc/config.sls b/salt/soc/config.sls
index 65d6bd2fa..8d1f0f694 100644
--- a/salt/soc/config.sls
+++ b/salt/soc/config.sls
@@ -87,7 +87,6 @@ filedetectionsbackup:
     - user: 939
     - group: 939
     - mode: 600
-    - show_changes: False
 
 crondetectionsruntime:
   cron.present:
@@ -102,7 +101,7 @@ crondetectionsruntime:
 
 crondetectionsbackup:
   cron.present:
-    - name: python3 /opt/so/conf/soc/so-detections-backup.py 
+    - name: python3 /opt/so/conf/soc/so-detections-backup.py &>> /opt/so/log/soc/detections-backup.log
     - identifier: detections-backup
     - user: root
     - minute: '0'
diff --git a/salt/soc/files/soc/so-detections-backup.py b/salt/soc/files/soc/so-detections-backup.py
index b7e6e2491..085b1e4c7 100644
--- a/salt/soc/files/soc/so-detections-backup.py
+++ b/salt/soc/files/soc/so-detections-backup.py
@@ -86,6 +86,8 @@ def main():
         timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
         print(f"Backing up Custom Detections and all Overrides to {OUTPUT_DIR} - {timestamp}\n")
         
+        os.makedirs(OUTPUT_DIR, exist_ok=True)
+
         auth_credentials = get_auth_credentials(AUTH_FILE)
         username, password = auth_credentials.split(':', 1)
         auth = HTTPBasicAuth(username, password)
diff --git a/salt/soc/files/soc/so-detections-backup_test.py b/salt/soc/files/soc/so-detections-backup_test.py
new file mode 100644
index 000000000..3afa11886
--- /dev/null
+++ b/salt/soc/files/soc/so-detections-backup_test.py
@@ -0,0 +1,159 @@
+# Copyright 2020-2023 Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at
+# https://securityonion.net/license; you may not use this file except in compliance with the
+# Elastic License 2.0.
+
+import unittest
+from unittest.mock import patch, MagicMock, mock_open, call
+import requests
+import os
+import subprocess
+import json
+from datetime import datetime
+import importlib
+
+ds = importlib.import_module('so-detections-backup')
+
+class TestBackupScript(unittest.TestCase):
+
+    def setUp(self):
+        self.output_dir = '/nsm/backup/detections/repo'
+        self.auth_file_path = '/nsm/backup/detections/repo'
+        self.mock_auth_data = 'user = "so_elastic:@Tu_dv_[7SvK7[-JZN39BBlSa;WAyf8rCY+3w~Sntp=7oR9*~34?Csi)a@v?)K*vK4vQAywS"'
+        self.auth_credentials = 'so_elastic:@Tu_dv_[7SvK7[-JZN39BBlSa;WAyf8rCY+3w~Sntp=7oR9*~34?Csi)a@v?)K*vK4vQAywS'
+        self.auth = requests.auth.HTTPBasicAuth('so_elastic', '@Tu_dv_[7SvK7[-JZN39BBlSa;WAyf8rCY+3w~Sntp=7oR9*~34?Csi)a@v?)K*vK4vQAywS')
+        self.mock_detection_hit = {
+            "_source": {
+                "so_detection": {
+                    "publicId": "test_id",
+                    "content": "test_content",
+                    "language": "suricata"
+                }
+            }
+        }
+        self.mock_override_hit = {
+            "_source": {
+                "so_detection": {
+                    "publicId": "test_id",
+                    "overrides": [{"key": "value"}],
+                    "language": "sigma"
+                }
+            }
+        }
+
+    def assert_file_written(self, mock_file, expected_path, expected_content):
+        mock_file.assert_called_once_with(expected_path, 'w')
+        mock_file().write.assert_called_once_with(expected_content)
+
+    @patch('builtins.open', new_callable=mock_open, read_data='user = "so_elastic:@Tu_dv_[7SvK7[-JZN39BBlSa;WAyf8rCY+3w~Sntp=7oR9*~34?Csi)a@v?)K*vK4vQAywS"')
+    def test_get_auth_credentials(self, mock_file):
+        credentials = ds.get_auth_credentials(self.auth_file_path)
+        self.assertEqual(credentials, self.auth_credentials)
+        mock_file.assert_called_once_with(self.auth_file_path, 'r')
+
+    @patch('requests.get')
+    def test_query_elasticsearch(self, mock_get):
+        mock_response = MagicMock()
+        mock_response.json.return_value = {'hits': {'hits': []}}
+        mock_response.raise_for_status = MagicMock()
+        mock_get.return_value = mock_response
+        
+        response = ds.query_elasticsearch(ds.QUERY_DETECTIONS, self.auth)
+        
+        self.assertEqual(response, {'hits': {'hits': []}})
+        mock_get.assert_called_once_with(
+            ds.ES_URL,
+            headers={"Content-Type": "application/json"},
+            data=ds.QUERY_DETECTIONS,
+            auth=self.auth,
+            verify=False
+        )
+
+    @patch('os.makedirs')
+    @patch('builtins.open', new_callable=mock_open)
+    def test_save_content(self, mock_file, mock_makedirs):
+        file_path = ds.save_content(self.mock_detection_hit, self.output_dir, 'subfolder', 'txt')
+        expected_path = f'{self.output_dir}/subfolder/test_id.txt'
+        self.assertEqual(file_path, expected_path)
+        mock_makedirs.assert_called_once_with(f'{self.output_dir}/subfolder', exist_ok=True)
+        self.assert_file_written(mock_file, expected_path, 'test_content')
+
+    @patch('os.makedirs')
+    @patch('builtins.open', new_callable=mock_open)
+    def test_save_overrides(self, mock_file, mock_makedirs):
+        file_path = ds.save_overrides(self.mock_override_hit)
+        expected_path = f'{self.output_dir}/sigma/overrides/test_id.yaml'
+        self.assertEqual(file_path, expected_path)
+        mock_makedirs.assert_called_once_with(f'{self.output_dir}/sigma/overrides', exist_ok=True)
+        self.assert_file_written(mock_file, expected_path, json.dumps({"key": "value"}))
+
+    @patch('subprocess.run')
+    def test_ensure_git_repo(self, mock_run):
+        mock_run.return_value = MagicMock(returncode=0)
+        
+        ds.ensure_git_repo()
+        
+        mock_run.assert_has_calls([
+            call(["git", "config", "--global", "init.defaultBranch", "main"], check=True),
+            call(["git", "-C", self.output_dir, "init"], check=True),
+            call(["git", "-C", self.output_dir, "remote", "add", "origin", "default"], check=True)
+        ])
+
+    @patch('subprocess.run')
+    def test_commit_changes(self, mock_run):
+        mock_status_result = MagicMock()
+        mock_status_result.stdout = "On branch main\nnothing to commit, working tree clean"
+        mock_commit_result = MagicMock(returncode=1)
+        # Ensure sufficient number of MagicMock instances for each subprocess.run call
+        mock_run.side_effect = [mock_status_result, mock_commit_result, MagicMock(returncode=0), MagicMock(returncode=0), MagicMock(returncode=0), MagicMock(returncode=0), MagicMock(returncode=0), MagicMock(returncode=0)]
+        
+        print("Running test_commit_changes...")
+        ds.commit_changes()
+        print("Finished test_commit_changes.")
+
+        mock_run.assert_has_calls([
+            call(["git", "-C", self.output_dir, "config", "user.email", "securityonion@local.invalid"], check=True),
+            call(["git", "-C", self.output_dir, "config", "user.name", "securityonion"], check=True),
+            call(["git", "-C", self.output_dir, "add", "."], check=True),
+            call(["git", "-C", self.output_dir, "status"], capture_output=True, text=True),
+            call(["git", "-C", self.output_dir, "commit", "-m", "Update detections and overrides"], check=False, capture_output=True)
+        ])
+
+    @patch('builtins.print')
+    @patch('so-detections-backup.commit_changes')
+    @patch('so-detections-backup.save_overrides')
+    @patch('so-detections-backup.save_content')
+    @patch('so-detections-backup.query_elasticsearch')
+    @patch('so-detections-backup.get_auth_credentials')
+    @patch('os.makedirs')
+    def test_main(self, mock_makedirs, mock_get_auth, mock_query, mock_save_content, mock_save_overrides, mock_commit, mock_print):
+        mock_get_auth.return_value = self.auth_credentials
+        mock_query.side_effect = [
+            {'hits': {'hits': [{"_source": {"so_detection": {"publicId": "1", "content": "content1", "language": "sigma"}}}]}},
+            {'hits': {'hits': [{"_source": {"so_detection": {"publicId": "2", "overrides": [{"key": "value"}], "language": "suricata"}}}]}}
+        ]
+        
+        with patch('datetime.datetime') as mock_datetime:
+            mock_datetime.now.return_value.strftime.return_value = "2024-05-23 20:49:44"
+            ds.main()
+        
+        mock_makedirs.assert_called_once_with(self.output_dir, exist_ok=True)
+        mock_get_auth.assert_called_once_with(ds.AUTH_FILE)
+        mock_query.assert_has_calls([
+            call(ds.QUERY_DETECTIONS, self.auth),
+            call(ds.QUERY_OVERRIDES, self.auth)
+        ])
+        mock_save_content.assert_called_once_with(
+            {"_source": {"so_detection": {"publicId": "1", "content": "content1", "language": "sigma"}}}, 
+            self.output_dir, 
+            "sigma", 
+            "yaml"
+        )
+        mock_save_overrides.assert_called_once_with(
+            {"_source": {"so_detection": {"publicId": "2", "overrides": [{"key": "value"}], "language": "suricata"}}}
+        )
+        mock_commit.assert_called_once()
+        mock_print.assert_called()
+
+if __name__ == '__main__':
+    unittest.main(verbosity=2)

From 4344988abeafe731e26f0305cdd62af1034c4e59 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Fri, 24 May 2024 12:54:36 -0400
Subject: [PATCH 33/45] Add instructions for sigma and yara repos

---
 salt/soc/soc_soc.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 60de637b4..415829460 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -119,14 +119,14 @@ soc:
             advanced: True
           rulesRepos:
             default: &eerulesRepos
-              description: "Custom Git repos to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled."
+              description: "Custom Git repositories to pull Sigma rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Elastalert --> Full Update." 
               global: True
               advanced: True
               forcedType: "[]{}"
               helpLink: sigma.html
             airgap: *eerulesRepos
           sigmaRulePackages:
-            description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). Once you have changed the ruleset here, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Elastalert --> Full Update. WARNING! Changing the ruleset will remove all existing non-overlapping Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.'
+            description: 'Defines the Sigma Community Ruleset you want to run. One of these (core | core+ | core++ | all ) as well as an optional Add-on (emerging_threats_addon). Once you have changed the ruleset here, the new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Elastalert --> Full Update. WARNING! Changing the ruleset will remove all existing non-overlapping Sigma rules of the previous ruleset and their associated overrides. This removal cannot be undone.'
             global: True
             advanced: False
             helpLink: sigma.html
@@ -221,7 +221,7 @@ soc:
             advanced: True
           rulesRepos:
             default: &serulesRepos
-              description: "Custom Git repos to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled."
+              description: "Custom Git repositories to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Strelka --> Full Update.""
               global: True
               advanced: True
               forcedType: "[]{}"

From f90d40b4714073c640bccfa05e36755f6a31c6af Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Fri, 24 May 2024 12:56:17 -0400
Subject: [PATCH 34/45] Fix typo

---
 salt/soc/soc_soc.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 415829460..1f64eb0bc 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -221,7 +221,7 @@ soc:
             advanced: True
           rulesRepos:
             default: &serulesRepos
-              description: "Custom Git repositories to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Strelka --> Full Update.""
+              description: "Custom Git repositories to pull YARA rules from. 'license' field is required, 'folder' is optional. 'community' disables some management options for the imported rules - they can't be deleted or edited, just tuned, duplicated and Enabled | Disabled. The new settings will be applied within 15 minutes. At that point, you will need to wait for the scheduled rule update to take place (by default, every 24 hours), or you can force the update by nagivating to Detections -->  Options dropdown menu --> Strelka --> Full Update."
               global: True
               advanced: True
               forcedType: "[]{}"

From 550b3ee92d02d4d6ce6bb11610532b68fb02089c Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Fri, 24 May 2024 14:46:24 -0400
Subject: [PATCH 35/45] Add IDH mappings

---
 salt/soc/files/soc/sigma_so_pipeline.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/salt/soc/files/soc/sigma_so_pipeline.yaml b/salt/soc/files/soc/sigma_so_pipeline.yaml
index 312d07965..8314361f5 100644
--- a/salt/soc/files/soc/sigma_so_pipeline.yaml
+++ b/salt/soc/files/soc/sigma_so_pipeline.yaml
@@ -17,6 +17,16 @@ transformations:
         dst_ip: destination.ip.keyword
         dst_port: destination.port
         winlog.event_data.User: user.name
+        logtype: event.code # OpenCanary
+    # Maps "opencanary" product to SO IDH logs
+    - id: opencanary_idh_add-fields
+      type: add_condition
+      conditions:
+        event.module: 'opencanary'
+        event.dataset: 'opencanary.idh'
+      rule_conditions:
+      - type: logsource
+        product: opencanary
     # Maps "antivirus" category to Windows Defender logs shipped by Elastic Agent Winlog Integration
     # winlog.event_data.threat_name has to be renamed prior to ingestion, it is originally winlog.event_data.Threat Name
     - id: antivirus_field-mappings_windows-defender
@@ -88,3 +98,11 @@ transformations:
       - type: logsource
         product: linux
         service: auth
+    # event.code should always be a string
+    - id: convert_event_code_to_string
+      type: convert_type
+      target_type: 'str'
+      field_name_conditions:
+        - type: include_fields
+          fields:
+          - event.code

From 58b565558df8acf341d2419fb27fb92e8725056e Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Fri, 24 May 2024 16:21:59 -0400
Subject: [PATCH 36/45] Dont bail - just wait for enter

---
 salt/manager/tools/sbin/soup | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 525fce3f6..b6bf61d2a 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -680,16 +680,15 @@ playbook_migration() {
     active_rules_count=$(find /opt/so/rules/elastalert/playbook/ -type f -name "*.yaml" | wc -l)
 
     if [[ "$active_rules_count" -gt 0 ]]; then
-        # Prompt the user to AGREE if active Elastalert rules found
+        # Prompt the user to press ENTER if active Elastalert rules found
         echo
         echo "$active_rules_count Active Elastalert/Playbook rules found."
         echo "In preparation for the new Detections module, they will be backed up and then disabled."
         echo
-        echo "If you would like to proceed, then type AGREE and press ENTER."
+        echo "Press ENTER to proceed."
         echo
         # Read user input
-        read INPUT
-        if [ "${INPUT^^}" != 'AGREE' ]; then fail "SOUP canceled."; fi
+        read -r
 
         echo "Backing up the Elastalert rules..."
         rsync -av --stats /opt/so/rules/elastalert/playbook/*.yaml /nsm/backup/detections-migration/elastalert/

From 81ee60e6586f2fac5e47c96c40fa2ca32245f6c6 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 28 May 2024 06:42:18 -0400
Subject: [PATCH 37/45] Backup .yml files too

---
 salt/manager/tools/sbin/soup | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index b6bf61d2a..c37138e19 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -677,7 +677,7 @@ playbook_migration() {
   if grep -A 1 'playbook:'  /opt/so/saltstack/local/pillar/minions/* | grep -q 'enabled: True'; then
   
     # Check for active Elastalert rules
-    active_rules_count=$(find /opt/so/rules/elastalert/playbook/ -type f -name "*.yaml" | wc -l)
+    active_rules_count=$(find /opt/so/rules/elastalert/playbook/ -type f \( -name "*.yaml" -o -name "*.yml" \) | wc -l)
 
     if [[ "$active_rules_count" -gt 0 ]]; then
         # Prompt the user to press ENTER if active Elastalert rules found
@@ -691,7 +691,8 @@ playbook_migration() {
         read -r
 
         echo "Backing up the Elastalert rules..."
-        rsync -av --stats /opt/so/rules/elastalert/playbook/*.yaml /nsm/backup/detections-migration/elastalert/
+        rsync -av --stats /opt/so/rules/elastalert/playbook/*.{yaml,yml} /nsm/backup/detections-migration/elastalert/
+    fi
 
         # Verify that rsync completed successfully
         if [[ $? -eq 0 ]]; then

From 74dfc25376d845d042cfd1c00b57541ec40cffcc Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 28 May 2024 09:29:10 -0400
Subject: [PATCH 38/45] backup local rules

---
 salt/manager/tools/sbin/soup | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index c37138e19..9b61f3c8c 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -660,6 +660,11 @@ suricata_idstools_migration() {
   	fail "Error: rsync failed to copy the files. Thresholds have not been backed up."
   fi
 
+  #Backup local rules
+  mkdir -p /nsm/backup/detections-migration/suricata/local-rules
+  rsync -av /opt/so/rules/nids/suri/local.rules /nsm/backup/detections-migration/suricata/local-rules
+  rsync -av /opt/so/saltstack/local/salt/idstools/rules/local.rules /nsm/backup/detections-migration/suricata/local-rules
+
   #Tell SOC to migrate
   mkdir -p /opt/so/conf/soc/migrations
   echo "0" > /opt/so/conf/soc/migrations/suricata-migration-2.4.70

From 2a2b86ebe62b2690b4c2b0e51d0124f60c976b24 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 28 May 2024 09:43:45 -0400
Subject: [PATCH 39/45] Dont overwrite

---
 salt/manager/tools/sbin/soup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 9b61f3c8c..7d94fcf55 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -663,7 +663,7 @@ suricata_idstools_migration() {
   #Backup local rules
   mkdir -p /nsm/backup/detections-migration/suricata/local-rules
   rsync -av /opt/so/rules/nids/suri/local.rules /nsm/backup/detections-migration/suricata/local-rules
-  rsync -av /opt/so/saltstack/local/salt/idstools/rules/local.rules /nsm/backup/detections-migration/suricata/local-rules
+  rsync -av /opt/so/saltstack/local/salt/idstools/rules/local.rules /nsm/backup/detections-migration/suricata/local-rules/local.rules.bak
 
   #Tell SOC to migrate
   mkdir -p /opt/so/conf/soc/migrations

From f68ac23f0eb69334e78fb0c8c45ddd71f6a7f8d4 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 28 May 2024 10:03:31 -0400
Subject: [PATCH 40/45] Fix fi

Signed-off-by: DefensiveDepth <Josh@defensivedepth.com>
---
 salt/manager/tools/sbin/soup | 1 -
 1 file changed, 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 7d94fcf55..39c684c08 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -697,7 +697,6 @@ playbook_migration() {
 
         echo "Backing up the Elastalert rules..."
         rsync -av --stats /opt/so/rules/elastalert/playbook/*.{yaml,yml} /nsm/backup/detections-migration/elastalert/
-    fi
 
         # Verify that rsync completed successfully
         if [[ $? -eq 0 ]]; then

From ee4ca0d7a214ee764f841d0d90e9119ced80fe07 Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Tue, 28 May 2024 10:24:09 -0400
Subject: [PATCH 41/45] Check to see if local exists

---
 salt/manager/tools/sbin/soup | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 39c684c08..b8297ad44 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -663,7 +663,9 @@ suricata_idstools_migration() {
   #Backup local rules
   mkdir -p /nsm/backup/detections-migration/suricata/local-rules
   rsync -av /opt/so/rules/nids/suri/local.rules /nsm/backup/detections-migration/suricata/local-rules
-  rsync -av /opt/so/saltstack/local/salt/idstools/rules/local.rules /nsm/backup/detections-migration/suricata/local-rules/local.rules.bak
+  if [[ -f /opt/so/saltstack/local/salt/idstools/rules/local.rules ]]; then
+      rsync -av /opt/so/saltstack/local/salt/idstools/rules/local.rules /nsm/backup/detections-migration/suricata/local-rules/local.rules.bak
+  fi 
 
   #Tell SOC to migrate
   mkdir -p /opt/so/conf/soc/migrations

From 0d034e7adcacc414cce6531f95e94da65ee9f56e Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Wed, 29 May 2024 10:55:56 -0400
Subject: [PATCH 42/45] fix rsync

---
 salt/manager/tools/sbin/soup | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index b8297ad44..1e9585987 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -698,7 +698,7 @@ playbook_migration() {
         read -r
 
         echo "Backing up the Elastalert rules..."
-        rsync -av --stats /opt/so/rules/elastalert/playbook/*.{yaml,yml} /nsm/backup/detections-migration/elastalert/
+        rsync -av --ignore-missing-args --stats /opt/so/rules/elastalert/playbook/*.{yaml,yml} /nsm/backup/detections-migration/elastalert/
 
         # Verify that rsync completed successfully
         if [[ $? -eq 0 ]]; then

From e98b8566c942a4557b9ab33ced61524f4d2e725c Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Wed, 29 May 2024 14:50:22 -0400
Subject: [PATCH 43/45] 2.4.70

---
 DOWNLOAD_AND_VERIFY_ISO.md                 |  22 ++++++++++-----------
 sigs/securityonion-2.4.70-20240529.iso.sig | Bin 0 -> 566 bytes
 2 files changed, 11 insertions(+), 11 deletions(-)
 create mode 100644 sigs/securityonion-2.4.70-20240529.iso.sig

diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md
index 4493f210d..fcefce469 100644
--- a/DOWNLOAD_AND_VERIFY_ISO.md
+++ b/DOWNLOAD_AND_VERIFY_ISO.md
@@ -1,17 +1,17 @@
-### 2.4.60-20240320 ISO image released on 2024/03/20
+### 2.4.70-20240529 ISO image released on 2024/03/20
 
 
 ### Download and Verify
 
-2.4.60-20240320 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-2.4.60-20240320.iso
+2.4.70-20240529 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-2.4.70-20240529.iso
  
-MD5: 178DD42D06B2F32F3870E0C27219821E  
-SHA1: 73EDCD50817A7F6003FE405CF1808A30D034F89D  
-SHA256: DD334B8D7088A7B78160C253B680D645E25984BA5CCAB5CC5C327CA72137FC06  
+MD5: 8FCCF31C2470D1ABA380AF196B611DEC  
+SHA1: EE5E8F8C14819E7A1FE423E6920531A97F39600B  
+SHA256: EF5E781D50D50660F452ADC54FD4911296ECBECED7879FA8E04687337CA89BEC  
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.60-20240320.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.70-20240529.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.4/main/KEYS  
@@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.60-20240320.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.70-20240529.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-2.4.60-20240320.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-2.4.70-20240529.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-2.4.60-20240320.iso.sig securityonion-2.4.60-20240320.iso
+gpg --verify securityonion-2.4.70-20240529.iso.sig securityonion-2.4.70-20240529.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Tue 19 Mar 2024 03:17:58 PM EDT using RSA key ID FE507013
+gpg: Signature made Wed 29 May 2024 11:40:59 AM EDT using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
diff --git a/sigs/securityonion-2.4.70-20240529.iso.sig b/sigs/securityonion-2.4.70-20240529.iso.sig
new file mode 100644
index 0000000000000000000000000000000000000000..c3825eb6e72a860f67708c45b3926d7fdc90b650
GIT binary patch
literal 566
zcmV-60?GY}0y6{v0SEvc79j-41gSkXz6^6dp_W8^5Ma0dP;e6k0%liCivS7<5PT3|
zxBgIY6IO;00GUA4^4cz_ff*If5}A0oP7{X5>Z=GC&kVQad2loDR}h58qGE)=Rx^yp
z-+xRh;q#;TL)Clt%_Pqf`(+Z<J$eR+)~VXhj4ID4LJ1AX+tzp-HLOS{jQ?+;Ojm5h
zGi!J%DM1&0HtiM>rTTxv(K=m6LP%GfSK4WmEzCYmDGF{x`Aax-QCl14M?B(?m6}F<
z8ytoSd0DJjf3dNdp<PGm)@bs!|N4I>rN}#!)CDM%UoA1<6_PF(m7Ed~UxN<0?0bGK
zYZmg%ne6j4P621BW!vQmH~#^`e1^aJc(KS3%i>sop?;h9<rBNJsHLcVy?7O`uq>?k
z$XnSrS90)^;tYA8-5UvbUO{ZLYxgUGGhIA}2I}y$to?u$rExzvc+R*l{a!nVSe@G}
zA9x@C>(y#~9Pmj<<|Xctul<WKZ_sohV2Wi2wL0CFuzQJKoDW$ZmGH;C-zl4z&hW3b
zY(k&E-TM5oZsssx%+ei|!;elcr#bN)KpN1o*=Ul5FOi170Hz{c@rDVslzlw3aZ0B7
z$r>~dkY1TD+#W?!T-m;neL){fdtG)HlsOCQTaX0s?y^bC10U|My|kDl##27<oEfGI
zYqstOP$*;Jl(C@IMM+x-_YH&=c-GF*V!#&OnMI3+^}4Bmr<U2#KjcT}s$*Ys-XbYZ
E9dXDH`2YX_

literal 0
HcmV?d00001


From a655f8dc049e6826be41e8e02baff4962312fd78 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Wed, 29 May 2024 14:52:47 -0400
Subject: [PATCH 44/45] 2.4.70

---
 DOWNLOAD_AND_VERIFY_ISO.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md
index fcefce469..a5fd6e157 100644
--- a/DOWNLOAD_AND_VERIFY_ISO.md
+++ b/DOWNLOAD_AND_VERIFY_ISO.md
@@ -1,4 +1,4 @@
-### 2.4.70-20240529 ISO image released on 2024/03/20
+### 2.4.70-20240529 ISO image released on 2024/05/29
 
 
 ### Download and Verify

From 62bdb2627aea9378f7c11ae9a72f04cbf2a14e96 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Wed, 29 May 2024 16:53:27 -0400
Subject: [PATCH 45/45] Update VERSION

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index b3c5d8c27..d2587d896 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4.70
+2.4.80