  weslambertandGitHub
|
9c83b775ee
|
Merge pull request #9604 from Security-Onion-Solutions/feature/sensoroni_scripts
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 16:59:29 -05:00 |
|
|
Wes
|
739c174898
|
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 21:50:10 +00:00 |
|
|
weslambertandGitHub
|
8c4e00cfbd
|
Merge pull request #9600 from Security-Onion-Solutions/fix/elasticsearch_template_logs_default_remove
Remove default "logs-*" template settings for now
|
2023-01-19 10:30:44 -05:00 |
|
|
weslambertandGitHub
|
7d3f6121eb
|
Remove default "logs-*" template settings for now
|
2023-01-19 10:29:10 -05:00 |
|
|
weslambertandGitHub
|
90f3e33cc6
|
Merge pull request #9597 from Security-Onion-Solutions/fix/elasticsearch_template_logs_default_priority_modification
Modify default 'logs-*' Elasticsearch template priority
|
2023-01-18 17:30:52 -05:00 |
|
|
weslambertandGitHub
|
7a499c9051
|
Modify default 'logs-*' template priority
|
2023-01-18 17:24:07 -05:00 |
|
|
weslambertandGitHub
|
1bf088e976
|
Merge pull request #9591 from Security-Onion-Solutions/fix/kibana_basepath_rewrite_disable
Disable Kibana's native base path rewrite and add publicBaseUrl
|
2023-01-17 16:59:06 -05:00 |
|
|
weslambertandGitHub
|
1fed3cf474
|
Disable Kibana's native base path rewrite and add publicBaseUrl
|
2023-01-17 16:54:31 -05:00 |
|
|
weslambertandGitHub
|
1723f58c04
|
Merge pull request #9579 from Security-Onion-Solutions/fix/elasticsearch_templates_so-ids
Remove so-ids since the data stream is now 'logs-suricata-*'
|
2023-01-13 16:17:38 -05:00 |
|
|
weslambertandGitHub
|
ca80548bf0
|
Remove so-ids since the data stream is now 'logs-suricata-*'
|
2023-01-13 16:15:58 -05:00 |
|
|
weslambertandGitHub
|
3e5127810d
|
Merge pull request #9577 from Security-Onion-Solutions/fix/elasticsearch_elastic_agent_templates
Make sure Elastic Agent data streams do not use replicas
|
2023-01-13 16:12:09 -05:00 |
|
|
weslambertandGitHub
|
73a4dae28e
|
Make sure Elastic Agent data streams do not use replicas
|
2023-01-13 16:10:44 -05:00 |
|
|
weslambertandGitHub
|
7cba5626b7
|
Merge pull request #9570 from Security-Onion-Solutions/fix/elasticsearch_templates_elastic_agent
Change priority for Elastic Agent Elasticsearch index templates
|
2023-01-12 16:48:12 -05:00 |
|
|
weslambertandGitHub
|
654d869e3e
|
Change priority from 500 to 200 for Elastic Agent index templates to avoid collisions with other templates
|
2023-01-12 16:46:08 -05:00 |
|
|
weslambertandGitHub
|
be6b42494c
|
Merge pull request #9569 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_kratos
Kratos Index Changes
|
2023-01-12 15:33:51 -05:00 |
|
|
weslambertandGitHub
|
fb8d8ea972
|
Update Elasticsearch index template for Kratos
|
2023-01-12 15:31:41 -05:00 |
|
|
weslambertandGitHub
|
9416552338
|
Don't set the Kratos index explicitly
|
2023-01-12 15:25:35 -05:00 |
|
|
weslambertandGitHub
|
66f9a06458
|
Merge pull request #9566 from Security-Onion-Solutions/fix/elastic_fleet_integration_policy_load
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 16:17:40 -05:00 |
|
|
Wes
|
0e437f84e7
|
Add back echo statement to print the import policy being loaded
|
2023-01-11 21:13:30 +00:00 |
|
|
Wes
|
ea01e68846
|
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 21:01:31 +00:00 |
|
|
weslambertandGitHub
|
acad7acc4a
|
Merge pull request #9562 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_load_suricata_import
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:27:37 -05:00 |
|
|
weslambertandGitHub
|
4391c22335
|
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:23:50 -05:00 |
|
|
weslambertandGitHub
|
39d1f07fab
|
Merge pull request #9561 from Security-Onion-Solutions/fix/filebeat_remove_module_setup
Remove pipeline.load from top.sls so that Filebeat module loading is not attempted
|
2023-01-11 12:21:39 -05:00 |
|
|
weslambertandGitHub
|
b3e0183e39
|
Remove pipeline.load from top.sls so that Filebeat module loading is not attempted
|
2023-01-11 12:19:06 -05:00 |
|
|
weslambertandGitHub
|
355953427c
|
Merge pull request #9553 from Security-Onion-Solutions/feature/filebeat_to_elastic_agent_conversion
Initial Conversion of Filebeat Inputs to Elastic Agent Inputs
|
2023-01-11 09:22:40 -05:00 |
|
|
Wes
|
52b620b137
|
Add additional conditional logic for Filebeat and disable Filebeat
|
2023-01-11 14:10:11 +00:00 |
|
|
Wes
|
33e2affb1d
|
Remove newlines from end of Syslog processor definitions
|
2023-01-11 14:08:28 +00:00 |
|
|
Wes
|
c3b83f1fc8
|
Update template settings to use data streams
|
2023-01-11 14:03:11 +00:00 |
|
|
Wes
|
5062dd2873
|
Suricata Elasticsearch ingest node pipeline changes - set 'alert' dataset
|
2023-01-11 14:02:09 +00:00 |
|
|
Wes
|
2e886d0c55
|
Remove data_index_name processor since we are using data streams
|
2023-01-11 13:58:38 +00:00 |
|
|
Wes
|
5d86edeed4
|
Modify Logstash Elastic Agent output to accomodate for events with and without 'metadata.pipeline'
|
2023-01-11 13:57:32 +00:00 |
|
|
Wes
|
caf0ea6b53
|
Add Elastic Agent policy view script
|
2023-01-11 13:56:21 +00:00 |
|
|
Wes
|
a146f1134e
|
Add Elastic Agent utility scripts
|
2023-01-11 13:54:42 +00:00 |
|
|
weslambertandGitHub
|
2c3bd6e3fd
|
Merge pull request #9502 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_rita_beacon_2_4
Update RITA beacon parsing
|
2023-01-03 11:14:04 -05:00 |
|
|
Wes
|
c8ff2c7a06
|
Update RITA beacon parsing
|
2023-01-03 16:03:49 +00:00 |
|
|
weslambertandGitHub
|
c220c322ef
|
Merge pull request #9431 from Security-Onion-Solutions/fix/elasticsearch_templates_elastic_agent
Remove 'so-' prefix for Elastic Agent/Fleet component templates
|
2022-12-19 10:14:39 -05:00 |
|
|
weslambertandGitHub
|
fd1be0ab2c
|
Remove 'so-' prefix for Elastic Agent/Fleet component templates
|
2022-12-19 10:11:26 -05:00 |
|
|
weslambertandGitHub
|
09b012ad4e
|
Merge pull request #9372 from Security-Onion-Solutions/fix/sensoroni_analyzers_configuration_check_2_4
Fix localfile analyzer 'file_path' check and add new list value verification function for helpers
|
2022-12-13 11:47:18 -05:00 |
|
|
Wes
|
3ab8a0be60
|
Update tests to account for change in 'file_path' value verification
|
2022-12-13 16:29:18 +00:00 |
|
|
Wes
|
eae05e83e6
|
Use new list verification function for 'file_path'
|
2022-12-13 16:28:50 +00:00 |
|
|
Wes
|
117d230b9d
|
Add new test for list value verification function
|
2022-12-13 16:28:22 +00:00 |
|
|
Wes
|
5422c5b3e2
|
Add new function to verify list value
|
2022-12-13 16:27:58 +00:00 |
|
|
weslambertandGitHub
|
69c7bb11c6
|
Merge pull request #9343 from Security-Onion-Solutions/fix/analyzers_localfile_file_path
FIX: Ensure file path is ascertainable by localfile.py for localfile analyzer
|
2022-12-08 17:08:19 -05:00 |
|
|
weslambertandGitHub
|
9477f29432
|
Remove double quotes to fix issue with file path sourcing from 'localfile.py'
|
2022-12-08 17:06:43 -05:00 |
|
|
weslambertandGitHub
|
2240283457
|
Merge pull request #9316 from Security-Onion-Solutions/fix/ics_scada_filebeat_disable_ecat_arp_info
Disable Filebeat input for 'ecat_arp_info' Zeek logs
|
2022-12-07 08:08:42 -05:00 |
|
|
weslambertandGitHub
|
def0c85349
|
Disable Filebeat input for 'ecat_arp_info' Zeek logs
|
2022-12-07 08:00:21 -05:00 |
|
|
weslambertandGitHub
|
31832ae150
|
Merge pull request #9309 from Security-Onion-Solutions/fix/ignore_additional_strelka_rules_causing_compilation_errors
Ignore additional rules causing YARA compilation errors
|
2022-12-06 14:01:14 -05:00 |
|
|
weslambertandGitHub
|
7ce0924382
|
Ignore additional rules causing compilation errors
|
2022-12-06 13:59:21 -05:00 |
|
|
weslambertandGitHub
|
73304e049c
|
Merge pull request #9304 from Security-Onion-Solutions/feature/ics_scada_additions
Port STUN, TDS, WireGuard, and ICS/SCADA Changes from 2.3 to 2.4
|
2022-12-06 13:14:47 -05:00 |
|
|
weslambertandGitHub
|
a626acced0
|
Add new ICS/SCADA event fields to the dashboards section of the configuration and remove extra space in key names.
|
2022-12-06 13:11:55 -05:00 |
|
|
Wes
|
1b5c1fecd4
|
Revert SOC default 'alerts' event fields and specify additional event fields for ICS/SCADA events
|
2022-12-06 17:28:30 +00:00 |
|
|
Wes
|
b048eec3c0
|
Add STUN, TDS, WireGuard, and ICS/SCADA dashboard queries
|
2022-12-06 17:17:49 +00:00 |
|
|
Wes
|
f44eee134a
|
Add default queries and ICS/SCADA queries
|
2022-12-06 16:52:20 +00:00 |
|
|
Wes
|
c741fe6b4d
|
Ensure ICS/SCADA plugins/scripts are enabled
|
2022-12-06 16:23:26 +00:00 |
|
|
Wes
|
be5775e4a0
|
Ensure Filebeat defaults file is updated with ICS/SCADA log references
|
2022-12-06 16:15:09 +00:00 |
|
|
Wes
|
499b5d95f2
|
Add 'ics' tag for 'bsap'-prefixed events/logs
|
2022-12-06 16:01:57 +00:00 |
|
|
Wes
|
14af1d36cb
|
Ensure ICS/SCADA pipelines are present
|
2022-12-06 15:58:47 +00:00 |
|
|
weslambertandGitHub
|
117a3d486a
|
Merge pull request #9210 from Security-Onion-Solutions/fix/add_missing_opcua_activate_session_pipelines_2_4
Add Missing OPCUA Activate Session Pipelines
|
2022-11-22 16:01:45 -05:00 |
|
|
Wes
|
7f324bc47e
|
Remove extra space used during testing
|
2022-11-22 20:52:08 +00:00 |
|
|
Wes
|
a6bc5b108f
|
Add missing OPCUA 'activate_session' pipelines
|
2022-11-22 20:51:44 +00:00 |
|
|
weslambertandGitHub
|
090f8309c2
|
Merge pull request #9207 from Security-Onion-Solutions/fix/ingest_typos_2_4
Fix spelling of 'wireguard.responses' field name
|
2022-11-22 15:36:04 -05:00 |
|
|
weslambertandGitHub
|
356904f751
|
Fix spelling of 'wireguard.responses' field name
|
2022-11-22 13:03:04 -05:00 |
|
|
weslambertandGitHub
|
f9cc7888f4
|
Merge pull request #9204 from Security-Onion-Solutions/fix/ics_ingest_field_names_2_4
Fix ICS Ingest Field Names
|
2022-11-22 12:30:17 -05:00 |
|
|
weslambertandGitHub
|
6b77843e52
|
Fix format/speliing for 'enip.status_code' field name
|
2022-11-22 12:07:55 -05:00 |
|
|
weslambertandGitHub
|
13faf63770
|
Fix spelling for 'stun.class' field name
|
2022-11-22 12:07:15 -05:00 |
|
|
weslambertandGitHub
|
b801997709
|
Merge pull request #9196 from Security-Onion-Solutions/fix/missing_ics_pipelines_2_4
Add COTP and TDS ingest pipelines
|
2022-11-22 08:44:19 -05:00 |
|
|
Wes
|
a38e312df4
|
Add COTP and TDS ingest pipelines
|
2022-11-22 13:36:27 +00:00 |
|
|
weslambertandGitHub
|
bde899e7cb
|
Merge pull request #9194 from Security-Onion-Solutions/fix/ics_tag_syntax_error_2_4
Fix syntax error for 'ics' tag logic
|
2022-11-22 07:32:54 -05:00 |
|
|
weslambertandGitHub
|
d2bc1a5523
|
Fix syntax error for 'ics' tag logic
|
2022-11-22 07:24:54 -05:00 |
|
|
weslambertandGitHub
|
68efd817e0
|
Merge pull request #9189 from Security-Onion-Solutions/feature/filebeat_config_ics_event_tag_2_4
Add 'ics' tag to events generated from ICS protocol logs
|
2022-11-21 17:06:14 -05:00 |
|
|
weslambertandGitHub
|
fe180d5657
|
Fix indentation
|
2022-11-21 17:02:17 -05:00 |
|
|
weslambertandGitHub
|
9994d47a43
|
Add 'ics' tag to events generated from ICS protocol logs
|
2022-11-21 16:46:47 -05:00 |
|
|
weslambertandGitHub
|
061f0b0595
|
Merge pull request #9159 from Security-Onion-Solutions/feature/additional_ics_scada_ingest_pipelines_2_4
Add additional ICS/SCADA ingest node pipelines
|
2022-11-21 10:32:00 -05:00 |
|
|
Wes
|
05b9a067fd
|
Add additional ICS/SCADA ingest node pipelines
|
2022-11-17 16:03:21 +00:00 |
|
|
weslambertandGitHub
|
c14c8c1306
|
Merge pull request #9154 from Security-Onion-Solutions/fix/ics_scada_ingest_pipeline_updates_2_4
Update ingest node pipelines for ICS/SCADA protocols
|
2022-11-16 16:17:19 -05:00 |
|
|
Wes
|
638a3568b0
|
Update ingest node pipelines for ICS/SCADA protocols
|
2022-11-16 21:11:21 +00:00 |
|
|
weslambertandGitHub
|
8b0ea7104f
|
Merge pull request #9003 from Security-Onion-Solutions/fix/remove_ja3er_references
Remove JA3er references
|
2022-10-26 10:37:45 -04:00 |
|
|
weslambertandGitHub
|
0ede5a7313
|
Remove JA3er references
|
2022-10-26 10:24:25 -04:00 |
|
|
weslambertandGitHub
|
409b8c276e
|
Merge pull request #8999 from Security-Onion-Solutions/fix/sensoroni_analyzers_pyyaml_wheel_name
Fix PyYAML .whl file name and remove JA3er analyzer
|
2022-10-25 15:32:20 -04:00 |
|
|
Wes
|
803d2d4d75
|
Add PyYAML .whl files back since they were 'deleted' in the previous commit
|
2022-10-25 19:15:54 +00:00 |
|
|
Wes
|
0267ece4bf
|
Fix PyYAML .whl file name and remove JA3er analyzer
|
2022-10-25 19:11:52 +00:00 |
|
|
weslambertandGitHub
|
078213ddb3
|
Merge pull request #8898 from Security-Onion-Solutions/feature/elastic-agent-configuration-log-package
Add log package for Fleet to allow for custom log ingestion
|
2022-10-11 12:14:15 -04:00 |
|
|
weslambertandGitHub
|
dd09ce7aab
|
Add log package for Fleet to allow for custom log ingestion
|
2022-10-11 12:00:57 -04:00 |
|
|
weslambertandGitHub
|
8437592bb5
|
Merge pull request #8869 from Security-Onion-Solutions/feature/elastic-8.4.3
Elastic 8.4.3
|
2022-10-06 16:03:36 -04:00 |
|
|
weslambertandGitHub
|
bee1b06f76
|
Update to Kibana 8.4.3
|
2022-10-06 15:14:43 -04:00 |
|
|
weslambertandGitHub
|
985e1728d7
|
Update to Kibana 8.4.3
|
2022-10-06 15:13:27 -04:00 |
|
|
weslambertandGitHub
|
49dace66de
|
Merge pull request #8796 from Security-Onion-Solutions/fix/elasticsearch_fleet_component_template_syntax
Fix syntax for Fleet component templates
|
2022-09-22 11:14:16 -04:00 |
|
|
Wes
|
0fd5fee868
|
Fix syntax for Fleet component templates
|
2022-09-22 15:07:43 +00:00 |
|
|
weslambertandGitHub
|
e35c77be62
|
Merge pull request #8785 from Security-Onion-Solutions/fix/elasticsearch_component_templates_fleet_main
Add additional component templates for Fleet and fix references for Elastic Agent index templates in defaults.yaml
|
2022-09-20 17:02:02 -04:00 |
|
|
Wes
|
46dd4c2749
|
Rename component mappings and references for Security Onion
|
2022-09-20 20:33:06 +00:00 |
|
|
Wes
|
7f2c5bc757
|
Add component templates for Fleet
|
2022-09-20 20:27:26 +00:00 |
|
|
weslambertandGitHub
|
d4fb78fe3b
|
Merge pull request #8775 from Security-Onion-Solutions/fix/elasticsearch_elastic_agent_index_templates_load
Update so-elasticsearch-templates-load to allow for proper loading of differently formatted Elastic Agent index templates
|
2022-09-19 16:44:21 -04:00 |
|
|
weslambertandGitHub
|
509c32482f
|
Update so-elasticsearch-templates-load to allow for proper loading of differently formatted Elastic Agent index templates
|
2022-09-19 16:39:49 -04:00 |
|
|
weslambertandGitHub
|
4c2ac9dd93
|
Merge pull request #8770 from Security-Onion-Solutions/fix/elasticsearch_cluster_settings
Re-establish Elasticsearch cluster (search) settings
|
2022-09-19 12:10:55 -04:00 |
|
|
Wes
|
9095bc2205
|
Re-establish Elasticsearch cluster (search) settings
|
2022-09-19 15:41:54 +00:00 |
|
|
weslambertandGitHub
|
0a8aae8180
|
Merge pull request #8757 from Security-Onion-Solutions/fix/elastic_agent_templates_managed_by_securityonion
Change managed_by value from 'fleet' to 'security_onion' for Elastic Agent templates in defaults.yaml
|
2022-09-16 17:20:03 -04:00 |
|
|
Wes
|
12e940f809
|
Change managed_by value from 'fleet' to 'security_onion' for Elastic Agent templates in defaults.yaml
|
2022-09-16 20:55:49 +00:00 |
|
|
weslambertandGitHub
|
6212a288e4
|
Merge pull request #8752 from Security-Onion-Solutions/fix/logstash_remove_osquery_livequery_output_configuration
Remove Osquery live query Logstash output configuration
|
2022-09-15 15:53:49 -04:00 |
|
|
Wes
|
1a90eeb1b1
|
Remove Osquery live query Logstash output configuration
|
2022-09-15 19:45:28 +00:00 |
|
|
weslambertandGitHub
|
39c7c8cf80
|
Merge pull request #8738 from Security-Onion-Solutions/fix/remove_old_pipeline_config
Remove old Logstash pipeline configuration - initial cleanup
|
2022-09-14 10:30:37 -04:00 |
|