110 Commits

Author	SHA1	Message	Date
weslambert	c8870eae65	Add detection alerts template	2024-05-13 14:23:47 -04:00
weslambert	6294f751ee	Cold min_age to 60d	2024-05-01 10:59:41 -04:00
m0duspwnens	c9d9979f22	allow for enabled/disable of so-elasticsearch-indices-delete cronjob	2024-04-24 16:18:45 -04:00
reyesj2	55cf90f477	merge 2.4/dev ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 14:44:59 -04:00
reyesj2	4097e1d81a	Create mappings for Kismet integration ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-10 16:10:27 -04:00
Wes	105eadf111	Add cef	2024-04-03 14:40:41 +00:00
reyesj2	000d15a53c	Kismet integration: TODO Elasticsearch mappings ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-03-29 13:56:01 -04:00
Wes	c6df805556	Add SOC template	2024-03-18 14:53:36 +00:00
weslambert	d8e8933ea0	Add AWS Security Hub template	2024-03-05 09:25:41 -05:00
weslambert	d85ac39e28	Add AWS Inspector template	2024-03-05 09:23:17 -05:00
weslambert	1514f1291e	Add AWS GuardDuty template	2024-03-05 09:21:48 -05:00
weslambert	b64d61065a	Add AWS Cloudfront template	2024-03-05 09:19:43 -05:00
weslambert	df3943b465	Daily rollover	2024-02-27 17:24:27 -05:00
weslambert	1d099f97d2	Update pattern for endpoint diagnostic template	2024-02-26 11:27:56 -05:00
Josh Brower	686304f24a	Merge remote-tracking branch 'origin/2.4/dev' into kilo	2024-02-15 09:47:51 -05:00
Wes	182667bafb	Change numbers for Elasticsearch	2024-02-01 13:59:23 +00:00
Wes	cd4bd6460a	Custom pipelines	2024-01-31 20:16:18 +00:00
Corey Ogburn	585147d1de	Added so-detection mapping in elasticsearch	2024-01-31 10:39:47 -07:00
weslambert	cd54d4becb	Fix indent	2024-01-25 13:57:02 -05:00
weslambert	5f1c76f6ec	endpoint.diagnostic.collection	2024-01-25 09:46:25 -05:00
Wes	05aa8b013a	Add additional integration to templates	2024-01-19 22:02:39 +00:00
weslambert	3f9678056d	OTX pulses template	2024-01-12 16:42:32 -05:00
Wes	5eae349938	Add endpoint metrics templates	2024-01-12 13:47:35 +00:00
Wes	9b1ddcacb4	Add additional templates for integrations	2024-01-11 14:00:09 +00:00
weslambert	cdac2bfa16	Add Anomali, Cybersixgill, Snort, and ThreatQuotient	2023-12-13 11:03:25 -05:00
Wes	5bfef3f527	Add checkpoint and vsphere templates	2023-11-02 21:10:01 +00:00
weslambert	c354924b68	Add import roles	2023-10-31 10:05:29 -04:00
weslambert	ed6473a34b	Add roles for eval mode	2023-10-30 20:41:49 -04:00
weslambert	76dd6f07ab	Remove policy for OSQuery manager indices	2023-10-27 17:26:33 -04:00
weslambert	c955f9210a	Remove policy for Cases indices	2023-10-27 17:24:27 -04:00
Mike Reeves	b37e38e3c3	Update defaults.yaml	2023-10-26 16:03:58 -04:00
Mike Reeves	2e0100fd35	Update defaults.yaml	2023-10-26 12:37:55 -04:00
Wes	891ea997e7	Add lifecycle policies and warm settings	2023-10-26 12:25:37 +00:00
Josh Patterson	5f168a33ed	Update defaults.yaml	2023-10-25 16:16:01 -04:00
Josh Patterson	af4b34801f	Update defaults.yaml	2023-10-25 15:48:27 -04:00
Wes	28b7a24cc1	Add templates for integrations	2023-10-18 20:36:04 +00:00
Wes	2e0ea3f374	Set final pipeline	2023-09-19 13:33:12 +00:00
weslambert	d090852895	Correct fortigate template name	2023-08-30 15:40:40 -04:00
weslambert	706a6e2d56	Make sure a data stream is created for syslog	2023-08-30 08:34:04 -04:00
weslambert	d40bbf6b09	Add Apache templates	2023-08-29 10:59:40 -04:00
Wes	31a49268cb	Add o365 and okta	2023-08-23 20:20:06 +00:00
Wes	3f2793088a	Add templates	2023-08-23 19:02:50 +00:00
m0duspwnens	9cba9d9ae0	allow to override number_of_replicas from one place in soc ui	2023-08-17 15:00:01 -04:00
m0duspwnens	4d497022db	replace . with _x_ for soc ui compat	2023-08-10 09:52:18 -04:00
Wes	d84dbf9535	Add fleet	2023-07-24 18:53:52 +00:00
Wes	de7b7ff989	Add endpoint	2023-07-24 18:35:02 +00:00
weslambert	e02bdffe34	Fix typos	2023-06-23 16:10:22 -04:00
Wes	b96d3473f2	Fix indentation	2023-06-23 18:38:04 +00:00
Wes	62fa15c63e	Add more templates	2023-06-23 14:43:15 +00:00
weslambert	e995576b1d	Remove extra templates	2023-06-23 09:41:49 -04:00