 m0duspwnens
|
06c0cebb26
|
merge with dev
|
2022-01-13 09:44:26 -05:00 |
|
 Mike Reeves
|
ee44edfe75
|
Add additional highlander settings
|
2022-01-12 13:18:44 -05:00 |
|
|
m0duspwnens
|
494737549d
|
move some es script to src elasticsearch/tools/sbin and dst /usr/sbin. set requires
|
2022-01-12 10:20:05 -05:00 |
|
|
m0duspwnens
|
baf297ab0a
|
merge with dev, resolve conflict
|
2022-01-11 11:24:10 -05:00 |
|
 Josh Brower
|
5083be4ce7
|
Merge pull request #6816 from Security-Onion-Solutions/fix/wazuh-parsing-v2
Fix Wazuh WEL Parsing
|
2022-01-11 11:17:24 -05:00 |
|
|
m0duspwnens
|
328d6cdeb4
|
Merge remote-tracking branch 'remotes/origin/dev' into issue/6811
|
2022-01-11 10:02:18 -05:00 |
|
|
Mike Reeves
|
8ad36fc7b9
|
Update init.sls
|
2022-01-11 10:01:14 -05:00 |
|
|
m0duspwnens
|
87756cdbc9
|
Merge remote-tracking branch 'remotes/origin/dev' into issue/6811
|
2022-01-11 09:57:31 -05:00 |
|
|
Mike Reeves
|
770a389410
|
Update init.sls
|
2022-01-11 09:56:22 -05:00 |
|
|
m0duspwnens
|
b5c274de10
|
Merge remote-tracking branch 'remotes/origin/dev' into issue/6811
|
2022-01-11 09:48:31 -05:00 |
|
 weslambert
|
84f7c6b13b
|
Add event.acknowledged and event.escalated mappings
|
2022-01-10 16:08:35 -05:00 |
|
|
m0duspwnens
|
716c98ec61
|
requires and ordering for socusersroles state
|
2022-01-10 14:39:00 -05:00 |
|
|
Josh Brower
|
56aa24d874
|
Fix Wazuh WEL Parsing
|
2022-01-10 13:55:38 -05:00 |
|
|
Mike Reeves
|
b7a90a88f9
|
Merge pull request #6815 from Security-Onion-Solutions/esbackup
Add ability to specify local backup dir
|
2022-01-10 13:31:24 -05:00 |
|
|
weslambert
|
1c3eeb5a34
|
Fix typo -- replace period with comma
|
2022-01-10 13:29:06 -05:00 |
|
|
m0duspwnens
|
beb9a33628
|
only include curl.config if elasticsearch:auth is enabled
|
2022-01-10 11:48:16 -05:00 |
|
|
Mike Reeves
|
dbba7d7226
|
Add ability to specify local backup dir
|
2022-01-10 11:31:41 -05:00 |
|
 Jason Ertel
|
d3656a7777
|
Merge branch 'dev' into kilo
|
2022-01-07 13:41:35 -05:00 |
|
|
Jason Ertel
|
391db568b0
|
Update field mappings based on Wes' feedback
|
2022-01-07 13:28:36 -05:00 |
|
|
weslambert
|
770e53d914
|
Add keyword subfield for event.severity_label
|
2022-01-07 11:21:57 -05:00 |
|
|
weslambert
|
c69e1353d9
|
Add event.severity_label
|
2022-01-07 11:19:54 -05:00 |
|
|
Josh Brower
|
5d4ea2ba3a
|
Revert Wazuh parser update
|
2022-01-07 10:51:24 -05:00 |
|
|
weslambert
|
a7e7566532
|
Merge pull request #6780 from Security-Onion-Solutions/feature/datatype_compliance
Initial commit for data type compliance
|
2022-01-06 16:38:17 -05:00 |
|
|
Josh Brower
|
277c7f1ef8
|
Uppercase first char in Wazuh WEL
|
2022-01-06 14:58:50 -05:00 |
|
|
weslambert
|
900d12b556
|
Add logger stanza to suppress deprecation warning messages for now due to current system index access warning messages flooding the ES log
|
2022-01-06 10:35:50 -05:00 |
|
|
Josh Patterson
|
eaa6597cd7
|
Merge pull request #6773 from Security-Onion-Solutions/issue/6765
Issue/6765
|
2022-01-05 18:11:06 -05:00 |
|
|
weslambert
|
c1a88977cf
|
Disable fielddata for _id field by default (since it is deprecated and can be memory-intensive)
|
2022-01-05 15:23:52 -05:00 |
|
|
m0duspwnens
|
0ff5e3cf6f
|
require so-elasticsearch container to be running to run the scripts
|
2022-01-05 14:48:41 -05:00 |
|
|
Wes Lambert
|
b60837e71a
|
Initial commit for data type compliance
|
2022-01-05 16:38:56 +00:00 |
|
|
Jason Ertel
|
e87cbc37a4
|
Add case template
|
2021-12-28 19:17:15 -05:00 |
|
|
Jason Ertel
|
9aeaa1fccc
|
resolved merge conflicts
|
2021-12-21 09:35:57 -05:00 |
|
|
Jason Ertel
|
2c9062efb7
|
resolved merge conflicts
|
2021-12-21 09:34:39 -05:00 |
|
|
Jason Ertel
|
35617acaeb
|
Update cacerts to reflect new path; this changed due to ES 7.16.2
|
2021-12-20 12:12:00 -05:00 |
|
|
Jason Ertel
|
6f116a2d01
|
Switch to new Ubuntu SSL dir
|
2021-12-20 09:43:59 -05:00 |
|
|
Jason Ertel
|
d6c651af1c
|
Remove old patch dir from previously-patched installations
|
2021-12-20 09:42:27 -05:00 |
|
|
Jason Ertel
|
b8fcec04b8
|
Remove patched jar due to upgrade of Elastic images to 7.16.2
|
2021-12-20 09:27:03 -05:00 |
|
|
Mike Reeves
|
465ba1b7d3
|
Change CA certs location
|
2021-12-15 17:08:36 -05:00 |
|
|
Mike Reeves
|
61955b7928
|
Change CA certs location
|
2021-12-15 13:50:19 -05:00 |
|
|
Mike Reeves
|
7cd1b1c482
|
Remove some previous hotfix code
|
2021-12-15 12:26:53 -05:00 |
|
|
Jason Ertel
|
8365b5f140
|
Strip JndiLookup.class from log4j-core jars, to match Elastic's mitigation approach
|
2021-12-13 09:02:41 -05:00 |
|
|
Mike Reeves
|
3d7b963912
|
Update log4j2.properties
|
2021-12-10 14:16:16 -05:00 |
|
|
Mike Reeves
|
8dcb64d87c
|
Update init.sls
|
2021-12-10 11:56:33 -05:00 |
|
|
Mike Reeves
|
ea26e402c8
|
Update log4j2.properties
|
2021-12-10 10:17:49 -05:00 |
|
|
Mike Reeves
|
f5761c73a5
|
Fix for the clustername used in wrong context
|
2021-12-02 15:30:35 -05:00 |
|
|
m0duspwnens
|
5945326817
|
soup for es ingest common and watch esingestdynamicconf for so-elastic docker
|
2021-11-16 14:00:41 -05:00 |
|
|
m0duspwnens
|
6bf4d5a576
|
https://github.com/Security-Onion-Solutions/securityonion/issues/6206
|
2021-11-12 11:37:55 -05:00 |
|
|
m0duspwnens
|
1890c7244a
|
set elasticsearch:auth to persist through user pw change
|
2021-11-09 18:25:17 -05:00 |
|
|
m0duspwnens
|
a8c4ed7bbf
|
set elasticsearch:auth:enabled True in auth pillar
|
2021-11-09 18:05:05 -05:00 |
|
|
m0duspwnens
|
91f54537d7
|
handle elasticsearch.auth state like kibana.secrets
|
2021-11-09 17:52:38 -05:00 |
|
|
weslambert
|
9301b8f5b9
|
Add dynamic conf to config change check
|
2021-11-09 15:56:52 -05:00 |
|