47d226e189
Merge pull request #15765 from Security-Onion-Solutions/3/dev
...
3/dev
2026-04-13 10:40:38 -05:00
29e13b2c0b
elasticsearch ilm policy load script
2026-04-13 10:00:17 -05:00
abcad9fde0
addon statefile
2026-04-12 00:36:30 -05:00
a43947cca5
elasticsearch template load script -- for addon index templates
2026-04-12 00:23:26 -05:00
b0584a4dc5
only append "-mappings" to component template names as needed
2026-04-11 15:22:50 -05:00
6298397534
rework elasticsearch template load script -- for core templates
2026-04-11 04:40:47 -05:00
9ccd0acb4f
Add ES credentials to postgres module config for migration
...
Postgres module now queries Elasticsearch directly via HTTP
for the chat migration (bypasses RBAC that needs user context).
Pass esHostUrl, esUsername, esPassword alongside postgres creds.
2026-04-10 11:41:33 -04:00
1ffdcab3be
Add postgres adminPassword to SOC module config
...
Injects the postgres superuser password from secrets pillar so
SOC can run schema migrations as admin before switching to the
app user for normal operations.
2026-04-09 22:21:35 -04:00
da1045e052
Fix init-users.sh password escaping for special characters
...
Use format() with %L for SQL literal escaping instead of raw
string interpolation. Also ALTER ROLE if user already exists
to keep password in sync with pillar.
2026-04-09 21:52:20 -04:00
55be1f1119
Only add postgres module config on manager nodes
...
Removed postgres from soc/defaults.yaml (shared by all nodes)
and moved it entirely into defaults.map.jinja, which only injects
the config when postgres auth pillar exists (manager-type nodes).
Sensors and other non-manager nodes will not have a postgres module
section in their sensoroni.json, so sensoroni won't try to connect.
2026-04-09 21:09:43 -04:00
378d1ec81b
initialize vars
2026-04-09 18:41:40 -05:00
c1b1452bd9
Use manager IP for postgres hostUrl instead of container hostname
...
SOC connects to postgres via the host network, not the Docker
bridge network, so it needs the manager's IP address rather than
the container hostname.
2026-04-09 19:34:14 -04:00
89e49d0bf3
rework elasticsearch index template generation
2026-04-09 16:44:51 -05:00
2dfa83dd7d
Wire postgres credentials into SOC module config
...
- Create vars/postgres.map.jinja for postgres auth globals
- Add POSTGRES_GLOBALS to all manager-type role vars
(manager, eval, standalone, managersearch, import)
- Add postgres module config to soc/defaults.yaml
- Inject so_postgres credentials from auth pillar into
soc/defaults.map.jinja (conditional on auth pillar existing)
2026-04-09 14:09:32 -04:00
f0b67a415a
more filestream integration policy updates
2026-04-09 12:40:55 -05:00
b87af8ea3d
Add postgres.auth to allowed_states
...
Matches the elasticsearch.auth pattern where auth states use
the full sls path check and are explicitly listed.
2026-04-09 12:39:46 -04:00
46e38d39bb
Enable postgres by default
...
Safe because postgres states are only applied to manager-type
nodes via top.sls and allowed_states.map.jinja.
2026-04-09 12:23:47 -04:00
81afbd32d4
Merge pull request #15742 from Security-Onion-Solutions/mwright/ai-query-length
...
Assistant: charsPerTokenEstimate
2026-04-09 11:28:37 -04:00
61bdfb1a4b
Add daily PostgreSQL database backup
...
- pg_dumpall piped through gzip, stored in /nsm/backup/
- Runs daily at 00:05 (4 minutes after config backup)
- 7-day retention matching existing config backup policy
- Skips gracefully if container isn't running
2026-04-09 10:29:10 -04:00
9ec4a26f97
define options in annotation files
2026-04-09 10:18:36 -04:00
358a2e6d3f
Add so-postgres to container image pull list
...
Add to both the import and default manager container lists so
the image gets downloaded during installation.
2026-04-09 10:02:41 -04:00
762e73faf5
Add so-postgres host management scripts
...
- so-postgres-manage: wraps docker exec for psql operations
(sql, sqlfile, shell, dblist, userlist)
- so-postgres-start/stop/restart: standard container lifecycle
- Scripts installed to /usr/sbin via file.recurse in config.sls
2026-04-09 09:55:42 -04:00
28d31f4840
add charsPerTokenEstimate
2026-04-08 15:25:51 -04:00
2166bb749a
ensure max-files is 1 at minimum
2026-04-08 14:59:05 -04:00
868cd11874
Add so-postgres Salt states and integration wiring
...
Phase 1 of the PostgreSQL central data platform:
- Salt states: init, enabled, disabled, config, ssl, auth, sostatus
- TLS via SO CA-signed certs with postgresql.conf template
- Two-tier auth: postgres superuser + so_postgres application user
- Firewall restricts port 5432 to manager-only (HA-ready)
- Wired into top.sls, pillar/top.sls, allowed_states, firewall
containers map, docker defaults, CA signing policies, and setup
scripts for all manager-type roles
2026-04-08 10:58:52 -04:00
dd56e7f1ac
filestream integration policy updates
2026-04-07 11:08:10 -05:00
8101bc4941
ES 9.3.2
2026-04-06 15:08:30 -05:00
5b3ca98b80
Fix JA4+ license link in soc_zeek.yaml
...
Updated the license link in the JA4+ fingerprinting description.
2026-04-06 10:12:37 -04:00
c91deb97b1
Update SOUP_BRANCH to use 3/main instead of 2.4/main
2026-03-31 15:07:23 -04:00
c7e865aa1c
Remove hardcoded index
2026-03-30 12:42:48 -04:00
922c008b11
ensure bool sliders soc
2026-03-27 15:02:54 -04:00
0a55592d7e
Make AI adapter settings visible
...
Changed 'advanced' field from True to False for AI adapters and available models.
2026-03-26 09:37:39 -04:00
9e53bd3f2d
update yara template
2026-03-24 15:56:26 -04:00
1f9bf45b66
Lowercase network transport
2026-03-24 11:24:59 -04:00
d4ac352b5a
Enable clean option for Zeek configuration
2026-03-24 09:54:49 -04:00
afcef1d0e7
Merge pull request #15661 from Security-Onion-Solutions/reyesj2-361
...
update stig profile v1r3
2026-03-23 18:09:33 -05:00
91b164b728
Merge pull request #15665 from Security-Onion-Solutions/delta
...
allow negation in suricata address-group vars
2026-03-23 17:34:21 -04:00
6a4501241d
allow negation in suricata address-group vars
2026-03-23 17:24:12 -04:00
7300513636
Remove hardcoded path
2026-03-23 16:26:56 -04:00
67162357a3
update stig profile v1r3
2026-03-23 14:04:48 -05:00
8ea97e4af3
Merge pull request #15658 from Security-Onion-Solutions/jertel/wip
...
do not attempt to redirect to a source map after login
2026-03-23 09:55:31 -04:00
2f9a2e15b3
do not attempt to redirect to a source map after login
2026-03-23 09:48:06 -04:00
165e69cd11
Add support for websockets
2026-03-23 07:52:36 -04:00
f0f9de4b44
add status updates for pillar conversions
2026-03-20 16:12:10 -04:00
e857a8487a
convert suricata pillar data yes/no to true/false
2026-03-20 15:35:44 -04:00
2186872317
update telegraf lower true/false
2026-03-20 09:19:22 -04:00
6e3986b0b0
set community-id annotation to advanced
2026-03-19 17:37:40 -04:00
2585bdd23f
add more description to checksum-checks
2026-03-19 17:30:47 -04:00
ca588d2e78
new elastalert options advanced
2026-03-19 17:19:42 -04:00
f756ecb396
remove quotes from suricata af-packet config
2026-03-19 17:14:55 -04:00
Jorge Reyes
Mike Reeves
Matthew Wright
Josh Patterson
Matthew Wright
Mike Reeves
Josh Brower
Jason Ertel
Jason Ertel