CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-15 13:23:11 +02:00
Code Issues Packages Projects Releases Wiki Activity
9,835 Commits 42 Branches 127 Tags
1aba4da2bbd2a31969600d65cfef683bd658ce9c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 7f7eaf173b Merge pull request #7663 from Security-Onion-Solutions/fix/strelka_fw 
Add strelka_frontend to heavynode, sensor, and standalone role FW por…
 2022-03-28 16:14:25 -04:00
weslambertandGitHub 6004dde54a Add strelka_frontend to heavynode, sensor, and standalone role FW portgroups 2022-03-28 16:05:07 -04:00
weslambertandGitHub fb7160cba5 Merge pull request #7644 from Security-Onion-Solutions/fix/syslog_pr_adjustment 
Update with changes from Abe's PR and other fixes
 2022-03-25 13:59:20 -04:00
weslambertandGitHub e6599cd10e Update with changes from Abe's PR and other fixes 2022-03-25 13:57:44 -04:00
weslambertandGitHub c02d7fab50 Merge pull request #7636 from Security-Onion-Solutions/feature/rita 
Parsing of RITA Logs
 2022-03-24 13:05:22 -04:00
weslambertandGitHub fbc86f43ec Add exclude filter for logs for when there are no results from analysis 2022-03-24 13:03:03 -04:00
weslambertandGitHub 4c93217aac Merge pull request #7635 from Security-Onion-Solutions/fix/process_mappings_keyword 
Additional .keyword shims for process mappings
 2022-03-24 12:53:16 -04:00
Wes Lambert fe1b72655b Additional .keyword shims for process mappings 2022-03-24 16:45:06 +00:00
weslambertandGitHub 5160a55dcf Merge pull request #7629 from Security-Onion-Solutions/fix/roles_load_check_cluster_health 
Check ES cluster health before trying to load roles
 2022-03-23 11:07:24 -04:00
weslambertandGitHub 1f2bca599f Check cluster health before trying to load roles for ES 2022-03-23 11:00:26 -04:00
Wes Lambert 8a56c88773 Adjust log file paths 2022-03-22 17:51:17 +00:00
Wes Lambert 57f01c70ec Remove extra forward slash in log path 2022-03-22 17:45:23 +00:00
Wes Lambert 2487d468ab Add RITA Elasticsearch ingest pipeline config 2022-03-22 17:38:22 +00:00
Wes Lambert f613d8ad86 Add RITA Logstash config 2022-03-22 17:36:18 +00:00
weslambertandGitHub aaded58131 Merge pull request #7565 from Security-Onion-Solutions/fix/es_template_fix 
Custom ES template fixes
 2022-03-15 11:09:46 -04:00
Wes Lambert 42d6c3a956 Replace Elastic connection check using ELASTICCURL with so-elasticsearch-query 2022-03-15 14:55:04 +00:00
Wes Lambert 5f56c7a261 Replace ELASTICCURL with so-elasticsearch-query 2022-03-15 14:32:00 +00:00
weslambertandGitHub d46620ea2a Merge pull request #7561 from Security-Onion-Solutions/es_template_map_fix 
Custom ES Template Fixes
 2022-03-15 10:01:42 -04:00
Wes Lambert ba24f75893 Fix index typo 2022-03-11 18:11:16 +00:00
Wes Lambert 70ed20f691 Add new sls file for custom ES index templates 2022-03-11 18:07:23 +00:00
Wes Lambert d12ff503c2 Chage role loading verbiage 2022-03-11 16:23:19 +00:00
Wes Lambert dc258cf043 Load custom component templates in so-elasticsearch-templates-load 2022-03-11 16:22:55 +00:00
Wes Lambert 8e43a6e571 Don't generate index template if index_template definition is not present in pillar 2022-03-11 16:22:06 +00:00
weslambertandGitHub 262e68cb75 Merge pull request #7469 from Security-Onion-Solutions/fix/kibana_config_load_template 
Add .template extension to ensure we are loading the template and not the resultant file
 2022-03-08 21:12:29 -05:00
weslambertandGitHub c83b63d0d8 Add .template extension to load template file 2022-03-08 20:53:16 -05:00
weslambertandGitHub 8d9ddf5f1b Add .template extension to load template 2022-03-08 20:52:13 -05:00
weslambertandGitHub 8115da358f Add .template extension to load template file 2022-03-08 20:51:50 -05:00
weslambertandGitHub 5f3c29b7f8 Merge pull request #7466 from Security-Onion-Solutions/fix/process_name_keyword 
Add process.name.keyword
 2022-03-08 12:47:31 -05:00
weslambertandGitHub 65f998d6f7 Remove process.name.keyword for future-proofing 2022-03-08 12:44:51 -05:00
weslambertandGitHub 406267a892 Add process.name.keyword 2022-03-08 12:42:34 -05:00
weslambertandGitHub d9c3160fbf Merge pull request #7465 from Security-Onion-Solutions/fix/kibana_saved_objects_load 
Kibana dashboard/saved objects loading improvements
 2022-03-08 12:22:55 -05:00
Wes Lambert d392cb258c Switch Kibana state to kibana.so_savedobjects_defaults in top file 2022-03-08 16:59:48 +00:00
Wes Lambert 86e228b200 Add .template extension for future-proofing config files 2022-03-08 16:58:37 +00:00
Wes Lambert a6fd1023b4 Fix criteria for successful execution 2022-03-08 16:57:26 +00:00
Wes Lambert 3f31f7fd41 Add .template extension to fix script behavior and not modify watched file 2022-03-08 16:43:43 +00:00
Wes Lambert 28554164cd Remove drop file when securitySolution saved objects change 2022-03-08 14:39:23 +00:00
Wes Lambert 14dddd8649 Remove drop file when config saved objects change 2022-03-08 14:37:15 +00:00
Wes Lambert c0f49f6fb0 Remove drop file when dashbaord saved objects change 2022-03-08 14:35:04 +00:00
Wes Lambert d10d4acf9f Modify Kibana config load script to drop file if successfully executed 2022-03-08 14:33:15 +00:00
weslambertandGitHub e2bda255cc Merge pull request #7447 from Security-Onion-Solutions/fix/es_templates_soup 
Remove old Elasticsearch index templates during SOUP
 2022-03-07 15:10:44 -05:00
Wes Lambert fa9be58b23 Specify index templates 2022-03-07 20:04:23 +00:00
Wes Lambert 647b316a96 Remove old ES index templates 
Signed-off-by: Wes Lambert <wlambertts@gmail.com>
 2022-03-07 20:02:45 +00:00
weslambertandGitHub eac120f4c2 Merge pull request #7444 from Security-Onion-Solutions/fix/dtc_client_override 
Add DTC client mappings
 2022-03-07 13:38:19 -05:00
Wes Lambert c549b20221 Add DTC client mappings 2022-03-07 18:36:26 +00:00
weslambertandGitHub 5600b55f05 Merge pull request #7427 from Security-Onion-Solutions/fix/syslog_kibana_viz 
Replace syslog facility and severity with label fields in Kibana syslog dashboard
 2022-03-07 08:14:35 -05:00
Wes Lambert 33ba45472f Replace syslog facility and severity with label fields 2022-03-04 21:40:41 +00:00
weslambertandGitHub ee4035f022 Merge pull request #7426 from Security-Onion-Solutions/fix/syslog_zeek 
Change to label fields for syslog facility and severity
 2022-03-04 16:31:45 -05:00
weslambertandGitHub f71ccadb8a Change to label fields for Zeek syslog 2022-03-04 16:29:55 -05:00
weslambertandGitHub fc3273fa49 Change to label fields to comply with what's defined in Filebeat template 2022-03-04 16:29:01 -05:00
weslambertandGitHub 3148fa0e06 Merge pull request #7422 from Security-Onion-Solutions/fix/syslog_dot_keyword 
.keyword additions and increase max_clause_count
 2022-03-04 15:32:29 -05:00
weslambertandGitHub 254cf53c2f Increase clause count to 3500 2022-03-04 10:36:37 -05:00
Wes Lambert ffae22beef Add DTC syslog mappings for .keyword and add refs to defaults.yml 2022-03-04 13:04:11 +00:00
weslambertandGitHub 93c2f82345 Merge pull request #7413 from Security-Onion-Solutions/fix/add_keyword_subfield 
Add .keyword subfield for more mappings
 2022-03-03 10:42:38 -05:00
Wes Lambert 1f71816ad7 Add keyword subfield for DTC winlog mappings 2022-03-03 14:54:30 +00:00
Wes Lambert 1c086e36da Add missing comma for file mappings 2022-03-03 13:49:54 +00:00
Wes Lambert aa8d24b6cd Add DTC destination, source, and winlog mapping references to templates in defaults file 2022-03-03 13:42:20 +00:00
Wes Lambert 85979cbce8 Add file, process, and winlog mapping changes 2022-03-03 13:37:27 +00:00
Wes Lambert 8f97f09c9c Additional .keyword changes for host.hostname client.address, and event.action 2022-03-02 21:54:46 +00:00
Wes Lambert 3ee46e4c29 Add .keyword for destination/source geo.country_name 2022-03-02 21:50:03 +00:00
weslambertandGitHub a21060306c Merge pull request #7404 from Security-Onion-Solutions/fix/field_limit_adjustment 
Adjust field limit for now due to component template errors
 2022-03-02 11:41:35 -05:00
Wes Lambert c5b16fdf3b Adjust field limit for now 2022-03-02 16:33:39 +00:00
weslambertandGitHub b80e82aaf6 Merge pull request #7396 from Security-Onion-Solutions/fix/dot_security 
Revert back to usage of .security field
 2022-03-02 10:42:29 -05:00
Wes Lambert ab9b81ea39 Change match_only_text to text for mac in host mappings 2022-03-02 15:01:05 +00:00
Wes Lambert ed620b93b7 Add custom analyzer definition to all SO/DTC mappings 2022-03-02 14:43:19 +00:00
Wes Lambert 27c8eaa630 Update all other mappings for .security where applicable 2022-03-02 14:39:23 +00:00
Wes Lambert e925d435ff Update event, file, and host mappings to include .security 2022-03-02 14:33:52 +00:00
Wes Lambert 496b161253 Update ECS mappings to include .security 2022-03-02 14:27:36 +00:00
Wes Lambert aae2fd1fbb Update DNS mappings to include .security 2022-03-02 14:27:15 +00:00
Wes Lambert 0b45cf7ae1 Update base mappings to include .security 2022-03-02 14:25:57 +00:00
Wes Lambert d89af5f04f Update agent mappings to include .security 2022-03-02 14:25:14 +00:00
Wes Lambert 2d2ec45029 Modify base ECS mappings to include .security where possible, as well as custom analyzer definition 2022-03-02 14:19:36 +00:00
weslambertandGitHub 93386f4620 Merge pull request #7389 from Security-Onion-Solutions/fix/revert_text 
Fix/revert text
 2022-03-02 09:17:46 -05:00
Wes Lambert 5489b8559d Revert "Switch from .security to match_only_text" 
This reverts commit f7862af934.
 2022-03-01 18:44:00 +00:00
Wes Lambert 2a9caccc7c Revert "Add additional .text subfield mappings" 
This reverts commit 61dadc6249.
 2022-03-01 18:43:24 +00:00
Wes Lambert a290602a70 Revert syslog pipeline updates from Abe' PR for now 2022-03-01 15:31:07 +00:00
weslambertandGitHub 4201ee45c6 Merge pull request #7369 from Security-Onion-Solutions/fix/ingest_timestamp 
Rename ingest timestamp to event.ingested
 2022-03-01 10:11:16 -05:00
Wes Lambert 038dc49098 Temporarily increase field limit before trimming efforts 2022-03-01 15:06:28 +00:00
Wes Lambert dc07adca63 Rename ingest.timestamp to event.ingested 2022-03-01 15:05:08 +00:00
weslambertandGitHub a1c0ae4aab Merge pull request #7356 from Security-Onion-Solutions/fix/es_config_load_order 
Run template load first to prevent issues with pipeline changes that …
 2022-02-28 14:50:22 -05:00
weslambertandGitHub 414b9dcd59 Run template load first to prevent issues with pipeline changes that generate new indices 2022-02-28 12:33:18 -05:00
weslambertandGitHub a9caef9596 Merge pull request #7338 from Security-Onion-Solutions/fix/endgame_template 
Revert Endgame index name changes
 2022-02-28 08:13:09 -05:00
Wes Lambert bd1b21a5b6 Revert Endgame index name changes 2022-02-26 02:53:57 +00:00
weslambertandGitHub 56cb8d62ab Merge pull request #7337 from Security-Onion-Solutions/fix/pb_overrides 
Fix formatting for PB overrides
 2022-02-25 20:48:38 -05:00
weslambertandGitHub e942d81433 Ensure correct formatting for source override 2022-02-25 19:14:58 -05:00
weslambertandGitHub a511fd33e9 Ensure correct formatting for destination override 2022-02-25 19:14:21 -05:00
weslambertandGitHub c95f48e49a Merge pull request #7330 from Security-Onion-Solutions/fix/pb-override 
Override destination/source mappings with .keyword for Playbook
 2022-02-25 13:07:31 -05:00
Wes Lambert a8bdff89ae Move files into SO component template directory 2022-02-25 18:00:16 +00:00
Wes Lambert 08097fe9ec Add Playbook override mappings 2022-02-25 17:58:51 +00:00
weslambertandGitHub a6ab09501e Merge pull request #7326 from Security-Onion-Solutions/fix/additional_text_subfield_mappings 
Add additional .text subfield mappings
 2022-02-25 11:29:26 -05:00
Wes Lambert 61dadc6249 Add additional .text subfield mappings 2022-02-25 16:27:37 +00:00
weslambertandGitHub 22b01dab1e Merge pull request #7317 from Security-Onion-Solutions/fix/add_text_subfield_to_dtc_mappings 
Add .text subfield mappings for DTC where fields are defined
 2022-02-24 14:47:11 -05:00
Wes Lambert 0f8a39002f Add .text subfield mappings for DTC where fields are defined 2022-02-24 19:39:52 +00:00
weslambertandGitHub 5e29c71381 Merge pull request #7315 from Security-Onion-Solutions/fix/split_zeek_dns 
Split Zeek DNS records into a separate index
 2022-02-24 13:21:52 -05:00
weslambertandGitHub 23fb62c0d6 Split Zeek DNS records into a separate index 2022-02-24 12:52:25 -05:00
weslambertandGitHub 313487a887 Merge pull request #7313 from Security-Onion-Solutions/fix/kibana_dashboard_load 
Add Kibana dashboard updates for 2.3.110
 2022-02-24 09:48:28 -05:00
weslambertandGitHub bc1794e437 Fix function name 2022-02-24 09:42:14 -05:00
weslambertandGitHub 45ccfc5ad4 Add back post to .100 and call for .110 2022-02-24 09:35:43 -05:00
weslambertandGitHub 582bf4c64c Remove dashboard updates for .100 so we don't run twice 2022-02-24 09:25:59 -05:00
weslambertandGitHub 7f08ecdcbe Add function reference for .110 post changes 2022-02-24 09:25:15 -05:00
weslambertandGitHub a22e470038 Add Kibana dashboard updates for 2.3.110 2022-02-24 09:20:44 -05:00