5634aed679
support minion node descriptions containing spaces
2026-04-13 15:19:39 -04:00
a232cd89cc
ES 9.3.3
2026-04-13 13:36:51 -05:00
dd40e44530
show when addon integrations are already loaded
2026-04-13 12:36:42 -05:00
47d226e189
Merge pull request #15765 from Security-Onion-Solutions/3/dev
...
3/dev
2026-04-13 10:40:38 -05:00
440537140b
Merge pull request #15764 from Security-Onion-Solutions/reyesj2-es932
...
elasticsearch ilm policy load script
2026-04-13 10:39:12 -05:00
29e13b2c0b
elasticsearch ilm policy load script
2026-04-13 10:00:17 -05:00
2006a07637
Merge pull request #15763 from Security-Onion-Solutions/reyesj2-es932
...
start loading addon integration index templates
2026-04-12 00:40:18 -05:00
abcad9fde0
addon statefile
2026-04-12 00:36:30 -05:00
a43947cca5
elasticsearch template load script -- for addon index templates
2026-04-12 00:23:26 -05:00
f51de6569f
Merge pull request #15762 from Security-Onion-Solutions/reyesj2-es932
...
only append "-mappings" to component template names as needed
2026-04-11 15:42:33 -05:00
b0584a4dc5
only append "-mappings" to component template names as needed
2026-04-11 15:22:50 -05:00
08f34d408f
Merge pull request #15761 from Security-Onion-Solutions/reyesj2-es932
...
rework elasticsearch template load script -- for core templates
2026-04-11 04:42:45 -05:00
6298397534
rework elasticsearch template load script -- for core templates
2026-04-11 04:40:47 -05:00
9ccd0acb4f
Add ES credentials to postgres module config for migration
...
Postgres module now queries Elasticsearch directly via HTTP
for the chat migration (bypasses RBAC that needs user context).
Pass esHostUrl, esUsername, esPassword alongside postgres creds.
2026-04-10 11:41:33 -04:00
1ffdcab3be
Add postgres adminPassword to SOC module config
...
Injects the postgres superuser password from secrets pillar so
SOC can run schema migrations as admin before switching to the
app user for normal operations.
2026-04-09 22:21:35 -04:00
da1045e052
Fix init-users.sh password escaping for special characters
...
Use format() with %L for SQL literal escaping instead of raw
string interpolation. Also ALTER ROLE if user already exists
to keep password in sync with pillar.
2026-04-09 21:52:20 -04:00
55be1f1119
Only add postgres module config on manager nodes
...
Removed postgres from soc/defaults.yaml (shared by all nodes)
and moved it entirely into defaults.map.jinja, which only injects
the config when postgres auth pillar exists (manager-type nodes).
Sensors and other non-manager nodes will not have a postgres module
section in their sensoroni.json, so sensoroni won't try to connect.
2026-04-09 21:09:43 -04:00
9272afa9e5
Merge pull request #15754 from Security-Onion-Solutions/reyesj2-es932
...
initialize vars
2026-04-09 18:42:14 -05:00
378d1ec81b
initialize vars
2026-04-09 18:41:40 -05:00
c1b1452bd9
Use manager IP for postgres hostUrl instead of container hostname
...
SOC connects to postgres via the host network, not the Docker
bridge network, so it needs the manager's IP address rather than
the container hostname.
2026-04-09 19:34:14 -04:00
cdbacdcd7e
Merge pull request #15751 from Security-Onion-Solutions/reyesj2-es932
...
rework elasticsearch index template generation
2026-04-09 16:46:56 -05:00
6b8a6267da
remove unused elasticsearch:index_template pillar references
2026-04-09 16:45:26 -05:00
89e49d0bf3
rework elasticsearch index template generation
2026-04-09 16:44:51 -05:00
2dfa83dd7d
Wire postgres credentials into SOC module config
...
- Create vars/postgres.map.jinja for postgres auth globals
- Add POSTGRES_GLOBALS to all manager-type role vars
(manager, eval, standalone, managersearch, import)
- Add postgres module config to soc/defaults.yaml
- Inject so_postgres credentials from auth pillar into
soc/defaults.map.jinja (conditional on auth pillar existing)
2026-04-09 14:09:32 -04:00
f0b67a415a
more filestream integration policy updates
2026-04-09 12:40:55 -05:00
b87af8ea3d
Add postgres.auth to allowed_states
...
Matches the elasticsearch.auth pattern where auth states use
the full sls path check and are explicitly listed.
2026-04-09 12:39:46 -04:00
46e38d39bb
Enable postgres by default
...
Safe because postgres states are only applied to manager-type
nodes via top.sls and allowed_states.map.jinja.
2026-04-09 12:23:47 -04:00
81afbd32d4
Merge pull request #15742 from Security-Onion-Solutions/mwright/ai-query-length
...
Assistant: charsPerTokenEstimate
2026-04-09 11:28:37 -04:00
e9c4f40735
Merge pull request #15745 from Security-Onion-Solutions/delta
...
define options in annotation files
2026-04-09 10:39:13 -04:00
61bdfb1a4b
Add daily PostgreSQL database backup
...
- pg_dumpall piped through gzip, stored in /nsm/backup/
- Runs daily at 00:05 (4 minutes after config backup)
- 7-day retention matching existing config backup policy
- Skips gracefully if container isn't running
2026-04-09 10:29:10 -04:00
9ec4a26f97
define options in annotation files
2026-04-09 10:18:36 -04:00
358a2e6d3f
Add so-postgres to container image pull list
...
Add to both the import and default manager container lists so
the image gets downloaded during installation.
2026-04-09 10:02:41 -04:00
762e73faf5
Add so-postgres host management scripts
...
- so-postgres-manage: wraps docker exec for psql operations
(sql, sqlfile, shell, dblist, userlist)
- so-postgres-start/stop/restart: standard container lifecycle
- Scripts installed to /usr/sbin via file.recurse in config.sls
2026-04-09 09:55:42 -04:00
ef3cfc8722
Merge pull request #15741 from Security-Onion-Solutions/fix/suricata-pcap-log-max-files
...
ensure max-files is 1 at minimum
2026-04-08 16:00:26 -04:00
28d31f4840
add charsPerTokenEstimate
2026-04-08 15:25:51 -04:00
2166bb749a
ensure max-files is 1 at minimum
2026-04-08 14:59:05 -04:00
868cd11874
Add so-postgres Salt states and integration wiring
...
Phase 1 of the PostgreSQL central data platform:
- Salt states: init, enabled, disabled, config, ssl, auth, sostatus
- TLS via SO CA-signed certs with postgresql.conf template
- Two-tier auth: postgres superuser + so_postgres application user
- Firewall restricts port 5432 to manager-only (HA-ready)
- Wired into top.sls, pillar/top.sls, allowed_states, firewall
containers map, docker defaults, CA signing policies, and setup
scripts for all manager-type roles
2026-04-08 10:58:52 -04:00
7356f3affd
Merge pull request #15733 from Security-Onion-Solutions/reyesj2-es932
...
filestream integration policy updates
2026-04-07 11:14:10 -05:00
dd56e7f1ac
filestream integration policy updates
2026-04-07 11:08:10 -05:00
075b592471
Merge pull request #15728 from Security-Onion-Solutions/reyesj2-es932
...
foxtrot version
2026-04-06 17:36:08 -05:00
51a3c04c3d
foxtrot version
2026-04-06 17:35:08 -05:00
1a8aae3039
Merge pull request #15727 from Security-Onion-Solutions/reyesj2-es932
...
ES 9.3.2
2026-04-06 15:09:45 -05:00
8101bc4941
ES 9.3.2
2026-04-06 15:08:30 -05:00
88de246ce3
Merge pull request #15725 from Security-Onion-Solutions/3/main
...
License Link to dev
2026-04-06 10:59:22 -04:00
3643b57167
Merge pull request #15724 from Security-Onion-Solutions/TOoSmOotH-patch-2
...
Fix JA4+ license link in soc_zeek.yaml
2026-04-06 10:24:04 -04:00
5b3ca98b80
Fix JA4+ license link in soc_zeek.yaml
...
Updated the license link in the JA4+ fingerprinting description.
2026-04-06 10:12:37 -04:00
51e0ca2602
Merge branch '3/main' of github.com:Security-Onion-Solutions/securityonion into reyesj2-es932
2026-04-01 14:46:05 -05:00
664f3fd18a
Fix soup
2026-04-01 14:47:05 -04:00
76f4ccf8c8
Merge pull request #15705 from Security-Onion-Solutions/3/main
...
Merge pr/workflow changes back to dev
2026-04-01 10:57:34 -04:00
2a37ad82b2
Merge pull request #15704 from Security-Onion-Solutions/jertel/mainpr
...
pr/workflow changes
2026-04-01 10:55:57 -04:00
Jason Ertel
reyesj2
Mike Reeves
Matthew Wright
Josh Patterson
Matthew Wright
Mike Reeves
Jason Ertel