reyesj2
de3306e73c
ES 9.4.5
2026-08-17 16:45:41 -05:00
Josh Patterson
e5969a12aa
Merge pull request #16109 from Security-Onion-Solutions/fixESHEAP
...
Add default esheap value so nodes highstate without the pillar value
2026-07-24 09:04:58 -04:00
Josh Patterson
6bd3c414bb
Add default esheap value so nodes highstate without the pillar value
...
Previously salt/vars/elasticsearch.map.jinja read the elasticsearch heap
size via a raw pillar access (INIT.PILLAR.elasticsearch.esheap). If the
esheap key was missing from a minion pillar, building GLOBALS raised
'dict object has no attribute esheap', cascading into every state that
imports GLOBALS (elasticsearch.enabled, logstash.config, telegraf.config,
etc.) and blocking highstate entirely.
Add an esheap default ('600m', matching the es_heapsize() floor) to
elasticsearch/defaults.yaml and fall back to it via dict .get() so a
missing pillar value degrades gracefully. The per-node pillar value still
wins when present.
2026-07-23 15:16:26 -04:00
reyesj2
f4aa9932ff
add default templates for system integration metrics indices
2026-07-22 12:13:45 -05:00
reyesj2
99e9fc1c3b
ES 9.3.7
2026-07-10 13:50:55 -05:00
reyesj2
d10f21399c
remove comments
2026-06-15 13:31:23 -05:00
reyesj2
c505160480
set default DLM retention 90d
2026-06-11 15:13:28 -05:00
reyesj2
9aa9ea3255
Iniitial DLM support
2026-06-09 23:19:26 -05:00
Jorge Reyes
4a2177c827
update redis index template
...
missing redis integration component templates
2026-05-11 16:15:56 -05:00
reyesj2
a232cd89cc
ES 9.3.3
2026-04-13 13:36:51 -05:00
reyesj2
8101bc4941
ES 9.3.2
2026-04-06 15:08:30 -05:00
reyesj2
c16ff2bd99
so-idh and so-redis datastream config
2026-03-18 14:31:23 -05:00
Jorge Reyes
20c4da50b1
Merge pull request #15632 from Security-Onion-Solutions/reyesj2-15601
...
fix global override settings affecting non-data stream indices
2026-03-18 10:51:17 -05:00
reyesj2
2c6c502067
use elasticsearch recommended vm.max_map_count
2026-03-17 15:12:29 -05:00
reyesj2
a52e5d0474
update index template priorities + explicity add datastream config options
2026-03-17 13:50:15 -05:00
reyesj2
eaf3f10adc
remove unused close/delete configs on datastream index templates
2026-03-16 17:26:45 -05:00
reyesj2
84f4e460f6
update index patterns
2026-03-16 16:53:22 -05:00
reyesj2
88841c9814
remove ilm configs from non-datastream indices
2026-03-16 16:52:42 -05:00
reyesj2
f4be73fdde
re-add event-mappings to kratos index for event.ingested mapping
2026-02-24 14:23:08 -06:00
reyesj2
742649a337
rename kratos file to file.path
2026-02-24 14:21:28 -06:00
reyesj2
d540b024b2
keep logsdb disabled
2026-01-30 16:02:46 -06:00
reyesj2
2038227308
remove reference to .fleet_final_pipeline-1
...
- configure global@custom ingest pipeline to run .fleet_final_pipeline-1 when available (heavynodes do not have this pipeline).
- Update global@custom pipeline to remove error message related to sending EA logs through logstash (https://github.com/elastic/kibana/issues/183959 )
2026-01-26 14:01:58 -06:00
reyesj2
cb1e59fa49
Merge branch '2.4/dev' of github.com:Security-Onion-Solutions/securityonion into reyesj2/elastic9-autosoup
2026-01-07 10:30:45 -06:00
reyesj2
33c34cdeca
Merge branch '2.4/dev' of github.com:Security-Onion-Solutions/securityonion into reyesj2/elastic9-autosoup
2025-12-29 15:49:49 -06:00
reyesj2
7977a020ac
elasticsearch 9.0.8
2025-12-16 16:03:47 -06:00
DefensiveDepth
a945768251
Refactor backup
2025-12-11 11:15:30 -05:00
reyesj2
b52dd53e29
advanced ilm actions
2025-11-19 13:24:55 -06:00
reyesj2
de4424fab0
remove typos
2025-11-14 19:15:51 -06:00
reyesj2
378d37d74e
add event.module to elasticsearch server logs
2025-10-14 12:44:51 -05:00
reyesj2
8675193d1f
elasticsearch upgrade 8.18.8
2025-10-06 12:56:31 -05:00
Jorge Reyes
4d24c57903
Merge pull request #15028 from Security-Onion-Solutions/reyesj2/ea-alerter
...
agent monitor template & dataset name update
2025-09-12 14:45:20 -05:00
reyesj2
0606c0a454
agent monitor template & dataset name update
2025-09-12 14:26:22 -05:00
reyesj2
588a1b86d1
suricata metadata index rollover 1d -> 30d
2025-09-11 15:46:45 -05:00
Corey Ogburn
2535ae953d
Fix Index Patterns
...
so-assistant-chat and so-assistant-session both had templates with a trailing dash that prevented the pattern from applying to the name of the indices.
2025-09-09 14:00:01 -06:00
reyesj2
855b489c4b
datastream
2025-09-08 09:13:24 -06:00
Corey Ogburn
673f9cb544
Responding to Feedback
2025-09-08 09:13:24 -06:00
Corey Ogburn
73776f8d11
Cleaning up New ES Indexes
2025-09-08 09:13:23 -06:00
reyesj2
1a32a0897c
Merge remote-tracking branch 'origin/2.4/dev' into reyesj2/ea-alerter
2025-09-02 17:11:21 -05:00
reyesj2
e26310d172
elastic agent offline alerter
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-09-02 17:00:03 -05:00
reyesj2
1ea7b3c09f
es 8.18.6
2025-08-28 18:27:56 -05:00
reyesj2
3fc244ee85
8.18.4
2025-07-22 16:56:51 -05:00
reyesj2
b3eb06f53e
ja4
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-07-16 15:56:34 -05:00
reyesj2
d8be6e42e1
es 8.18.3
2025-07-07 12:58:00 -05:00
Josh Patterson
07ef3d632c
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-04-15 08:08:12 -04:00
reyesj2
58df566c79
add mapping for metadata.kafka.timestamp
2025-04-14 14:30:40 -05:00
Josh Patterson
21bb325157
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-04-14 08:22:42 -04:00
Josh Brower
4c3518385b
Change timeout to 1s
2025-04-11 07:37:09 -04:00
Josh Patterson
44a5b3b1e5
MANAGERHYPE setup is now complete!
2025-03-12 21:05:04 -04:00
reyesj2
4dd72ad15c
fix osquery action_data mapping conflict
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-03-07 17:05:13 -06:00
reyesj2
d2884ef00b
typo
2025-03-05 14:02:45 -06:00
reyesj2
Josh Patterson
DefensiveDepth
Corey Ogburn