Doug Burks
7f9bc1fc0f
Merge pull request #12817 from Security-Onion-Solutions/dougburks-patch-1
...
FEATURE: Add queue=True to so-checkin so that it will wait for any ru…
2024-04-18 09:30:55 -04:00
Doug Burks
8d9aae1983
FEATURE: Add queue=True to so-checkin so that it will wait for any running states #12815
2024-04-18 09:28:30 -04:00
m0duspwnens
4caa6a10b5
watch a pillar in files and take action
2024-04-17 18:09:04 -04:00
reyesj2
665b7197a6
Update Kafka nodeid
...
Update so-minion to include running kafka.nodes state to ensure nodeid is generated for new brokers
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-17 17:08:41 -04:00
Mike Reeves
3854620bcd
Merge pull request #12810 from Security-Onion-Solutions/TOoSmOotH-patch-1
...
Update limited-analyst.json
2024-04-17 13:21:04 -04:00
Mike Reeves
67a57e9df7
Update limited-analyst.json
2024-04-17 13:14:45 -04:00
m0duspwnens
4b79623ce3
watch pillar files for changes and do something
2024-04-16 16:51:35 -04:00
DefensiveDepth
ff28476191
Fix compile_yara path
2024-04-16 13:10:17 -04:00
DefensiveDepth
8cc4d2668e
Move compile_yara
2024-04-16 12:52:14 -04:00
DefensiveDepth
dbfb178556
Add test
2024-04-16 12:22:53 -04:00
m0duspwnens
c4994a208b
restart salt minion if a manager and signing policies change
2024-04-15 11:37:21 -04:00
reyesj2
eedea2ca88
Merge remote-tracking branch 'remotes/origin/kaffytaffy' into reyesj2/kafka
2024-04-12 16:24:33 -04:00
reyesj2
de6ea29e3b
update default process.role to broker only
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 16:18:53 -04:00
m0duspwnens
bb983d4ba2
just broker as default process
2024-04-12 16:16:03 -04:00
Josh Brower
5e8b16569f
Merge pull request #12793 from Security-Onion-Solutions/2.4/detectiondefaults
...
Add docs for ruleset change
2024-04-12 13:54:06 -04:00
m0duspwnens
c014508519
need /opt/so/conf/ca/cacerts on receiver for kafka to run
2024-04-12 13:50:25 -04:00
DefensiveDepth
f5e42e73af
Add docs for ruleset change
2024-04-12 13:30:20 -04:00
reyesj2
fcfbb1e857
Merge kaffytaffy
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 12:50:56 -04:00
reyesj2
911ee579a9
Typo
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 12:16:20 -04:00
reyesj2
a6ff92b099
Note to remove so-kafka-clusterid. Update soup and setup to generate needed kafka pillar values
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 12:11:18 -04:00
m0duspwnens
d73ba7dd3e
order kafka pillar assignment
2024-04-12 11:55:26 -04:00
m0duspwnens
04ddcd5c93
add receiver managersearch and standalone to kafka.nodes pillar
2024-04-12 11:52:57 -04:00
reyesj2
af29ae1968
Merge kaffytaffy
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 11:43:46 -04:00
reyesj2
fbd3cff90d
Make global.pipeline use GLOBALMERGED value
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-12 11:21:19 -04:00
m0duspwnens
0ed9894b7e
create kratos local pillar dirs during setup
2024-04-12 11:19:46 -04:00
m0duspwnens
a54a72c269
move kafka_cluster_id to kafka:cluster_id
2024-04-12 11:19:20 -04:00
Josh Brower
5b81a73e58
Merge pull request #12791 from Security-Onion-Solutions/2.4/detectiondefaults
...
Fix fingerprint paths
2024-04-12 09:01:38 -04:00
DefensiveDepth
49ccd86c39
Fix fingerprint paths
2024-04-12 08:35:44 -04:00
m0duspwnens
f514e5e9bb
add kafka to receiver
2024-04-11 16:23:05 -04:00
reyesj2
3955587372
Use global.pipeline for redis / kafka states
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 16:20:09 -04:00
reyesj2
6b28dc72e8
Update annotation for global.pipeline
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 15:38:33 -04:00
reyesj2
ca7253a589
Run kafka-clusterid script when pillar values are missing
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 15:38:03 -04:00
reyesj2
af53dcda1b
Remove references to kafkanode
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 15:32:00 -04:00
reyesj2
55cf90f477
merge 2.4/dev
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:44:59 -04:00
reyesj2
c269fb90ac
Added a Kismet Wifi devices dashboard for an overview of kismet data
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:41:54 -04:00
Mike Reeves
1250a728ac
Merge pull request #12769 from Security-Onion-Solutions/TOoSmOotH-patch-3
...
Update analyst.json
2024-04-11 14:30:17 -04:00
reyesj2
68e016090b
Fix network.wireless.ssid not parsing
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 13:21:54 -04:00
reyesj2
fd689a4607
Fix typo in ingest pipeline
...
Test to fix duplicate events in SOC, by removing conflicting field event.created
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 11:18:04 -04:00
Josh Brower
ae09869417
Merge pull request #12780 from Security-Onion-Solutions/2.4/detectiondefaults
...
Enable Detections Adv by default
2024-04-11 09:32:34 -04:00
DefensiveDepth
1c5f02ade2
Update annotations
2024-04-11 09:21:08 -04:00
DefensiveDepth
ed97aa4e78
Enable Detections Adv by default
2024-04-11 08:21:20 -04:00
reyesj2
7124f04138
Update ingest pipelines to match updated mappings
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-10 16:13:06 -04:00
reyesj2
2ab9cbba61
Update wording for Kismet poll interval annotation
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-10 16:12:22 -04:00
reyesj2
4097e1d81a
Create mappings for Kismet integration
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-10 16:10:27 -04:00
m0duspwnens
d3bd56b131
disable logstash and redis if kafka enabled
2024-04-10 14:13:27 -04:00
m0duspwnens
e9e61ea2d8
Merge remote-tracking branch 'origin/2.4/dev' into kaffytaffy
2024-04-10 13:14:13 -04:00
m0duspwnens
86b984001d
annotations and enable/disable from ui
2024-04-10 10:39:06 -04:00
Mike Reeves
2206553e03
Update analyst.json
2024-04-10 09:49:21 -04:00
m0duspwnens
fa7f8104c8
Merge remote-tracking branch 'origin/reyesj2/kafka' into kaffytaffy
2024-04-09 11:13:02 -04:00
m0duspwnens
bd5fe43285
jinja config files
2024-04-09 11:07:53 -04:00
