reyesj2
e8ab6433ab
remove thehive scripted field from kibana saved objects
2026-08-06 14:03:27 -05:00
Josh Patterson
f958212bea
Merge remote-tracking branch 'origin/3/dev' into saltthangs
2026-07-15 15:07:09 -04:00
reyesj2
99e9fc1c3b
ES 9.3.7
2026-07-10 13:50:55 -05:00
Josh Patterson
3310e19ee4
Merge remote-tracking branch 'origin/3/dev' into saltthangs
2026-07-02 10:27:54 -04:00
reyesj2
87b9276c79
increase wait_for_so-kibana timeout to 10m
2026-07-01 13:19:47 -05:00
Josh Patterson
d71e80cf66
Merge remote-tracking branch 'origin/3/dev' into saltthangs
2026-06-23 10:32:32 -04:00
Josh Brower
9031c1fd22
userid vs names
2026-06-12 11:18:59 -04:00
reyesj2
4741cc92bd
fleet manager start kibana if it isn't already running and wait for healthly status
2026-06-10 17:52:08 -05:00
reyesj2
46655860e9
http
2026-06-10 17:27:23 -05:00
reyesj2
289ddda5e8
kibana health check for fleet scripts
2026-06-10 17:06:22 -05:00
Josh Patterson
034711d148
Merge remote-tracking branch 'origin/3/dev' into saltthangs
2026-04-28 10:47:29 -04:00
reyesj2
398bc9e4ed
update kibana discardCorruptObjects version
2026-04-22 20:38:13 -05:00
Mike Reeves
a0cf0489d6
reduce highstate frequency with active push for rules and pillars
...
- schedule highstate every 2 hours (was 15 minutes); interval lives in
global:push:highstate_interval_hours so the SOC admin UI can tune it and
so-salt-minion-check derives its threshold as (interval + 1) * 3600
- add inotify beacon on the manager + master reactor + orch.push_batch that
writes per-app intent files, with a so-push-drainer schedule on the manager
that debounces, dedupes, and dispatches a single orchestration
- pillar_push_map.yaml allowlists the apps whose pillar changes trigger an
immediate targeted state.apply (targets verified against salt/top.sls);
edits under pillar/minions/ trigger a state.highstate on that one minion
- host-batch every push orchestration (batch: 25%, batch_wait: 15) so rule
changes don't thundering-herd large fleets
- new global:push:enabled kill-switch tears down the beacon, reactor config,
and drainer schedule on the next highstate for operators who want to keep
highstate-only behavior
- set restart_policy: unless-stopped on 23 container states so docker
recovers crashes without waiting for the next highstate; leave registry
(always), strelka/backend (on-failure), kratos, and hydra alone with
inline comments explaining why
2026-04-10 15:43:16 -04:00
reyesj2
8101bc4941
ES 9.3.2
2026-04-06 15:08:30 -05:00
Josh Patterson
8251d56a96
ensure bool sliders for kibana
2026-03-19 14:24:13 -04:00
Josh Patterson
c2c5aea244
ensure bool sliders for each state:enabled annotation
2026-03-19 12:35:38 -04:00
Josh Patterson
74ad2990a7
Merge remote-tracking branch 'origin/3/dev' into delta
2026-03-18 13:05:02 -04:00
Josh Patterson
e19e83bebb
allow user defined ulimits
2026-03-18 10:38:15 -04:00
Doug Burks
930985b770
update helpLink references for new documentation
2026-03-18 09:46:45 -04:00
Josh Patterson
2349750e13
DOCKER to DOCKERMERGED
2026-03-17 16:19:02 -04:00
Josh Patterson
00986dc2fd
Merge remote-tracking branch 'origin/delta' into customulimit
2026-03-17 16:04:09 -04:00
Mike Reeves and Claude Opus 4.6
2d97dfc8a1
Add customizable ulimit settings for all Docker containers
...
Add ulimits as a configurable advanced setting for every container,
allowing customization through the web UI. Move hardcoded ulimits
from elasticsearch and zeek into defaults.yaml and fix elasticsearch
ulimits that were incorrectly nested under the environment key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-17 15:10:42 -04:00
Josh Patterson
4dc377c99f
DOCKER to DOCKERMERGED
2026-03-17 15:06:06 -04:00
Josh Patterson
17881c9a36
cleanup highlander
2026-03-16 15:56:16 -04:00
Jason Ertel
9bd5e1897a
prepare for nextgen docs
2026-02-27 13:09:55 -05:00
reyesj2
0cd3d7b5a8
deprecated kibana config
2026-01-15 15:17:22 -06:00
reyesj2
8675193d1f
elasticsearch upgrade 8.18.8
2025-10-06 12:56:31 -05:00
reyesj2
1ea7b3c09f
es 8.18.6
2025-08-28 18:27:56 -05:00
reyesj2
3fc244ee85
8.18.4
2025-07-22 16:56:51 -05:00
reyesj2
81d2c52867
kibana listingLimit
2025-07-14 16:08:11 -05:00
reyesj2
f1cbe23f57
update default kibana space
2025-07-08 21:17:57 -05:00
reyesj2
d8be6e42e1
es 8.18.3
2025-07-07 12:58:00 -05:00
Josh Patterson
77f88371b8
manage default and local in separate states
2025-04-23 08:30:37 -04:00
Jorge Reyes
e59ebc89f8
Merge pull request #14346 from Security-Onion-Solutions/reyesj2-patch-2
...
bump version
2025-03-05 14:40:36 -06:00
reyesj2
6a5377ceac
bump version
2025-03-05 14:39:01 -06:00
Jason Ertel
0047246cf2
reduce stdout verbosity
2025-03-04 10:55:12 -05:00
reyesj2
df350b5a56
ES 8.17.2
2025-02-20 14:20:09 -06:00
reyesj2
64f6a2d81e
re-enable security (siem) in default kibana space
2025-02-19 10:38:37 -06:00
reyesj2
85dcfbf368
update kibana default space
2025-02-17 12:27:36 -06:00
reyesj2
8568c372f6
disable fleet apm
2025-02-17 12:21:31 -06:00
reyesj2
40cb3a53ae
Revert ES 8.17.2 upgrade -> 8.17.1
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-02-12 13:18:08 -06:00
reyesj2
fb0cd436d3
ES 8.17.2 TODO: Check import-evtx-logs.json for updated pipeline versions
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-02-11 11:23:04 -06:00
reyesj2
1113c3924f
zeek http2
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-11-14 09:09:23 -06:00
defensivedepth
219cb5e044
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/defend-filters
2024-09-23 13:03:32 -04:00
defensivedepth
074cc8e6ff
Initial commit
2024-09-20 11:58:21 -04:00
Jason Ertel
cce9e162d4
remove colon to avoid yaml parsing problems
2024-09-16 15:30:14 -04:00
Jason Ertel
217bb388a0
Clarify enabled settings
2024-09-16 10:05:17 -04:00
m0duspwnens
8702d95434
only elasticsearch image uses es version
2024-09-09 16:38:38 -04:00
m0duspwnens
cd9c9a25d3
reference elastic versions from defaults
2024-08-21 11:25:56 -04:00
m0duspwnens
3d61897522
ref es version from defaults for kibana
2024-08-21 08:51:35 -04:00
reyesj2
Josh Patterson
Josh Brower
Mike Reeves
Doug Burks
Mike ReevesandClaude Opus 4.6
Jason Ertel