CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-10 05:12:54 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,067 Commits 53 Branches 125 Tags
feature/postgres-integration
Commit Graph

11677 Commits

Author SHA1 Message Date
Jorge Reyes 696a1a729c Merge pull request #15768 from Security-Onion-Solutions/reyesj2-es932 
ES 9.3.3
 2026-04-13 15:02:19 -05:00
Jason Ertel 5634aed679 support minion node descriptions containing spaces 2026-04-13 15:19:39 -04:00
reyesj2 a232cd89cc ES 9.3.3 2026-04-13 13:36:51 -05:00
reyesj2 dd40e44530 show when addon integrations are already loaded 2026-04-13 12:36:42 -05:00
Jorge Reyes 47d226e189 Merge pull request #15765 from Security-Onion-Solutions/3/dev 
3/dev
 2026-04-13 10:40:38 -05:00
reyesj2 29e13b2c0b elasticsearch ilm policy load script 2026-04-13 10:00:17 -05:00
reyesj2 abcad9fde0 addon statefile 2026-04-12 00:36:30 -05:00
reyesj2 a43947cca5 elasticsearch template load script -- for addon index templates 2026-04-12 00:23:26 -05:00
reyesj2 b0584a4dc5 only append "-mappings" to component template names as needed 2026-04-11 15:22:50 -05:00
reyesj2 6298397534 rework elasticsearch template load script -- for core templates 2026-04-11 04:40:47 -05:00
Mike Reeves 9ccd0acb4f Add ES credentials to postgres module config for migration 
Postgres module now queries Elasticsearch directly via HTTP
for the chat migration (bypasses RBAC that needs user context).
Pass esHostUrl, esUsername, esPassword alongside postgres creds.
 2026-04-10 11:41:33 -04:00
Mike Reeves 1ffdcab3be Add postgres adminPassword to SOC module config 
Injects the postgres superuser password from secrets pillar so
SOC can run schema migrations as admin before switching to the
app user for normal operations.
 2026-04-09 22:21:35 -04:00
Mike Reeves da1045e052 Fix init-users.sh password escaping for special characters 
Use format() with %L for SQL literal escaping instead of raw
string interpolation. Also ALTER ROLE if user already exists
to keep password in sync with pillar.
 2026-04-09 21:52:20 -04:00
Mike Reeves 55be1f1119 Only add postgres module config on manager nodes 
Removed postgres from soc/defaults.yaml (shared by all nodes)
and moved it entirely into defaults.map.jinja, which only injects
the config when postgres auth pillar exists (manager-type nodes).
Sensors and other non-manager nodes will not have a postgres module
section in their sensoroni.json, so sensoroni won't try to connect.
 2026-04-09 21:09:43 -04:00
reyesj2 378d1ec81b initialize vars 2026-04-09 18:41:40 -05:00
Mike Reeves c1b1452bd9 Use manager IP for postgres hostUrl instead of container hostname 
SOC connects to postgres via the host network, not the Docker
bridge network, so it needs the manager's IP address rather than
the container hostname.
 2026-04-09 19:34:14 -04:00
reyesj2 89e49d0bf3 rework elasticsearch index template generation 2026-04-09 16:44:51 -05:00
Mike Reeves 2dfa83dd7d Wire postgres credentials into SOC module config 
- Create vars/postgres.map.jinja for postgres auth globals
- Add POSTGRES_GLOBALS to all manager-type role vars
  (manager, eval, standalone, managersearch, import)
- Add postgres module config to soc/defaults.yaml
- Inject so_postgres credentials from auth pillar into
  soc/defaults.map.jinja (conditional on auth pillar existing)
 2026-04-09 14:09:32 -04:00
reyesj2 f0b67a415a more filestream integration policy updates 2026-04-09 12:40:55 -05:00
Mike Reeves b87af8ea3d Add postgres.auth to allowed_states 
Matches the elasticsearch.auth pattern where auth states use
the full sls path check and are explicitly listed.
 2026-04-09 12:39:46 -04:00
Mike Reeves 46e38d39bb Enable postgres by default 
Safe because postgres states are only applied to manager-type
nodes via top.sls and allowed_states.map.jinja.
 2026-04-09 12:23:47 -04:00
Matthew Wright 81afbd32d4 Merge pull request #15742 from Security-Onion-Solutions/mwright/ai-query-length 
Assistant: charsPerTokenEstimate
 2026-04-09 11:28:37 -04:00
Mike Reeves 61bdfb1a4b Add daily PostgreSQL database backup 
- pg_dumpall piped through gzip, stored in /nsm/backup/
- Runs daily at 00:05 (4 minutes after config backup)
- 7-day retention matching existing config backup policy
- Skips gracefully if container isn't running
 2026-04-09 10:29:10 -04:00
Josh Patterson 9ec4a26f97 define options in annotation files 2026-04-09 10:18:36 -04:00
Mike Reeves 358a2e6d3f Add so-postgres to container image pull list 
Add to both the import and default manager container lists so
the image gets downloaded during installation.
 2026-04-09 10:02:41 -04:00
Mike Reeves 762e73faf5 Add so-postgres host management scripts 
- so-postgres-manage: wraps docker exec for psql operations
  (sql, sqlfile, shell, dblist, userlist)
- so-postgres-start/stop/restart: standard container lifecycle
- Scripts installed to /usr/sbin via file.recurse in config.sls
 2026-04-09 09:55:42 -04:00
Matthew Wright 28d31f4840 add charsPerTokenEstimate 2026-04-08 15:25:51 -04:00
Josh Patterson 2166bb749a ensure max-files is 1 at minimum 2026-04-08 14:59:05 -04:00
Mike Reeves 868cd11874 Add so-postgres Salt states and integration wiring 
Phase 1 of the PostgreSQL central data platform:
- Salt states: init, enabled, disabled, config, ssl, auth, sostatus
- TLS via SO CA-signed certs with postgresql.conf template
- Two-tier auth: postgres superuser + so_postgres application user
- Firewall restricts port 5432 to manager-only (HA-ready)
- Wired into top.sls, pillar/top.sls, allowed_states, firewall
  containers map, docker defaults, CA signing policies, and setup
  scripts for all manager-type roles
 2026-04-08 10:58:52 -04:00
reyesj2 dd56e7f1ac filestream integration policy updates 2026-04-07 11:08:10 -05:00
reyesj2 8101bc4941 ES 9.3.2 2026-04-06 15:08:30 -05:00
Mike Reeves 5b3ca98b80 Fix JA4+ license link in soc_zeek.yaml 
Updated the license link in the JA4+ fingerprinting description.
 2026-04-06 10:12:37 -04:00
Mike Reeves c91deb97b1 Update SOUP_BRANCH to use 3/main instead of 2.4/main 2026-03-31 15:07:23 -04:00
Josh Brower c7e865aa1c Remove hardcoded index 2026-03-30 12:42:48 -04:00
Josh Patterson 922c008b11 ensure bool sliders soc 2026-03-27 15:02:54 -04:00
Mike Reeves 0a55592d7e Make AI adapter settings visible 
Changed 'advanced' field from True to False for AI adapters and available models.
 2026-03-26 09:37:39 -04:00
Josh Brower 9e53bd3f2d update yara template 2026-03-24 15:56:26 -04:00
Josh Brower 1f9bf45b66 Lowercase network transport 2026-03-24 11:24:59 -04:00
Mike Reeves d4ac352b5a Enable clean option for Zeek configuration 2026-03-24 09:54:49 -04:00
Jorge Reyes afcef1d0e7 Merge pull request #15661 from Security-Onion-Solutions/reyesj2-361 
update stig profile v1r3
 2026-03-23 18:09:33 -05:00
Josh Patterson 91b164b728 Merge pull request #15665 from Security-Onion-Solutions/delta 
allow negation in suricata address-group vars
 2026-03-23 17:34:21 -04:00
Josh Patterson 6a4501241d allow negation in suricata address-group vars 2026-03-23 17:24:12 -04:00
Josh Brower 7300513636 Remove hardcoded path 2026-03-23 16:26:56 -04:00
reyesj2 67162357a3 update stig profile v1r3 2026-03-23 14:04:48 -05:00
Jason Ertel 8ea97e4af3 Merge pull request #15658 from Security-Onion-Solutions/jertel/wip 
do not attempt to redirect to a source map after login
 2026-03-23 09:55:31 -04:00
Jason Ertel 2f9a2e15b3 do not attempt to redirect to a source map after login 2026-03-23 09:48:06 -04:00
Josh Brower 165e69cd11 Add support for websockets 2026-03-23 07:52:36 -04:00
Josh Patterson f0f9de4b44 add status updates for pillar conversions 2026-03-20 16:12:10 -04:00
Josh Patterson e857a8487a convert suricata pillar data yes/no to true/false 2026-03-20 15:35:44 -04:00
Josh Patterson 2186872317 update telegraf lower true/false 2026-03-20 09:19:22 -04:00