CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-13 20:41:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,682 Commits 39 Branches 127 Tags
1b6f681ae1b45cda2e0da170e95372d705dd8820
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Doug BurksandGitHub 065f1c2927 Merge pull request #3473 from Security-Onion-Solutions/fix/shorten-elastic-license-url 
Shorten Elastic License URL to avoid line wrap
 2021-03-16 16:43:38 -04:00
Doug BurksandGitHub 388524ec4e Shorten Elastic License URL to avoid line wrap 2021-03-16 16:39:14 -04:00
Doug BurksandGitHub cfdf9703ab Merge pull request #3427 from Security-Onion-Solutions/issue/3340 
FEATURE: soup should output more guidance for distributed deployments at the end #3340
 2021-03-12 15:27:26 -05:00
Doug BurksandGitHub da7adab566 FEATURE: soup should output more guidance for distributed deployments at the end #3340 2021-03-12 12:59:17 -05:00
doug edb88ac09a FIX: Improve Setup verbiage #3422 2021-03-12 10:54:44 -05:00
Doug BurksandGitHub 555f9b5091 Merge pull request #3417 from Security-Onion-Solutions/issue/3413 
FIX: SMTP shoud read SNMP on Kibana SNMP view #3413
 2021-03-12 06:52:21 -05:00
doug a5779a520c FIX: SMTP shoud read SNMP on Kibana SNMP view #3413 2021-03-12 06:48:57 -05:00
Doug BurksandGitHub ab1c84afca Merge pull request #3409 from Security-Onion-Solutions/issue/3408 
FIX: Populate http.status_message field #3408
 2021-03-11 16:45:53 -05:00
doug adbc7436b6 FIX: Populate http.status_message field #3408 2021-03-11 16:42:20 -05:00
doug b4ad7e7359 FIX: Improve Suricata DHCP logging and parsing #3397 2021-03-11 11:01:51 -05:00
Doug BurksandGitHub adb25d63d2 Merge pull request #3396 from Security-Onion-Solutions/issue/3295 
FIX: Improve DHCP leases query in Hunt #3395
 2021-03-11 08:22:48 -05:00
Doug BurksandGitHub 85aaa71006 FIX: Improve DHCP leases query in Hunt #3395 2021-03-11 08:01:27 -05:00
doug d39b3280c8 FIX: Custom Kibana settings are not being applied properly on upgrades #3254 2021-03-03 14:04:32 -05:00
Doug BurksandGitHub 79fefd83ef Merge pull request #3134 from Security-Onion-Solutions/issue/3128 
Improve Hunt queries for ssh and tunnel #3128
 2021-02-25 07:11:20 -08:00
Doug BurksandGitHub c18c865764 Improve Hunt queries for ssh and tunnel #3128 2021-02-25 09:23:19 -05:00
Doug BurksandGitHub ef1e296415 Improve Hunt queries for ssh and tunnel #3128 2021-02-25 08:52:34 -05:00
Doug BurksandGitHub 84f138772f Merge pull request #3072 from Security-Onion-Solutions/kilo 
Additional fine tuning of Suricata metadata support
 2021-02-22 10:57:02 -08:00
doug 71c7ffae3e Improve support for Suricata metadata #2200 2021-02-22 13:49:29 -05:00
doug bcce205430 Improve support for Suricata metadata #2200 2021-02-22 13:00:14 -05:00
doug 3467f30603 Improve support for Suricata metadata #2200 2021-02-22 10:27:24 -05:00
Doug BurksandGitHub d4ee2b86e6 Merge pull request #3070 from Security-Onion-Solutions/dev 
Dev to Kilo
 2021-02-22 07:22:49 -08:00
Doug BurksandGitHub 85b9cac110 Merge pull request #3063 from Security-Onion-Solutions/dev 
Dev to kilo
 2021-02-21 03:40:05 -08:00
Doug BurksandGitHub 3ea1ec99d5 Merge pull request #3048 from Security-Onion-Solutions/kilo 
Update syslog ingest parser to accomodate pfSense filterlog changes #3033
 2021-02-19 11:02:56 -08:00
doug 88eb5b1d61 Update syslog ingest parser to accomodate pfSense filterlog changes #3033 2021-02-19 08:02:32 -05:00
Doug BurksandGitHub 5493b3ef91 Merge pull request #3032 from Security-Onion-Solutions/dev 
Update kilo to latest dev
 2021-02-19 04:53:23 -08:00
Doug BurksandGitHub 8016511414 Merge pull request #2981 from Security-Onion-Solutions/kilo 
Hunt: improve Wazuh queries #2383
 2021-02-16 10:38:53 -08:00
doug fabe3c87f2 Hunt: improve Wazuh queries #2383 2021-02-16 11:56:14 -05:00
Doug BurksandGitHub d6fa54b606 Merge pull request #2975 from Security-Onion-Solutions/kilo 
Issues 2954 and 2361 - Kibana config
 2021-02-16 08:30:46 -08:00
doug 397d8d0964 Kibana 7.10.2 config changes #2954 2021-02-14 07:04:51 -05:00
doug 3248edea8b Update Kibana dashboard hyperlinks to new url format #2361 2021-02-12 17:25:42 -05:00
doug 31a0c2bc82 Update Kibana dashboard hyperlinks to new url format #2361 2021-02-12 15:37:25 -05:00
doug 797d2c4dba Kibana 7.10.2 config changes #2954 2021-02-12 15:35:06 -05:00
Doug BurksandGitHub fd4cb0b7a8 Kibana 7.10.2 config changes #2954 2021-02-12 14:05:29 -05:00
Doug BurksandGitHub c717773fc3 Kibana 7.10.2 config changes #2954 2021-02-12 14:04:00 -05:00
Doug BurksandGitHub 7a314b5935 Prevent Wazuh "last -n 20" logs from going to Alerts queue #2321 2020-12-12 11:35:29 -05:00
Doug BurksandGitHub 61ae187d03 revert previous commit #2321 2020-12-12 10:12:23 -05:00
Doug BurksandGitHub 85aac4ad75 Prevent Wazuh "last -n 20" logs from going to Alerts queue #2321 2020-12-12 09:22:08 -05:00
Doug BurksandGitHub c61199618a Update so-curator-closed-delete-delete 2020-10-24 07:15:43 -04:00
Doug BurksandGitHub a106913d1a Heavy node filebeat needs extra_hosts for the heavy node itself #1521 2020-10-14 09:51:59 -04:00
Doug BurksandGitHub f88403e83e use ssl on nodes that support it 2020-10-14 05:50:29 -04:00
Doug BurksandGitHub 190869a1f2 enable https on elasticsearch nodes that support it 2020-10-13 16:04:55 -04:00
Doug BurksandGitHub 0f68a53af4 Update so-curator-closed-delete-delete 2020-10-13 13:22:35 -04:00
Doug BurksandGitHub b004a9149e Update so-index-list 2020-10-13 12:40:45 -04:00
Doug BurksandGitHub e5ece6cd50 Update so-index-list 2020-10-13 12:34:49 -04:00
Doug BurksandGitHub a75e986836 Update so-elastic-clear 2020-10-13 12:18:27 -04:00
Doug BurksandGitHub ad50b5d640 elasticsearch _cat/indices output has changed between 6 and 7 2020-10-13 06:33:40 -04:00
Doug BurksandGitHub 21b1becd7e Update so-elasticsearch-pipelines-list 2020-10-12 16:34:30 -04:00
Doug BurksandGitHub 5458c57cc9 Update so-elasticsearch-pipeline-stats 2020-10-12 16:32:11 -04:00
Doug BurksandGitHub 68e34b781a Update so-elasticsearch-templates-load 2020-10-12 16:10:38 -04:00
Doug BurksandGitHub 4c43262610 Update so-elasticsearch-templates-list 2020-10-12 16:08:06 -04:00
Doug BurksandGitHub 553ce3e363 only include extra_hosts if nodestab exists 2020-10-12 10:13:05 -04:00
Doug BurksandGitHub 3cfee82b59 Update Hunt fields for firewall #1500 2020-10-10 08:18:00 -04:00
Doug BurksandGitHub 87574181d5 Add Community ID to pfsense filterlog #1501 2020-10-10 08:11:51 -04:00
Doug BurksandGitHub 5f15320b9d Update Hunt fields for firewall #1500 2020-10-10 07:54:48 -04:00
Doug BurksandGitHub 8d1ba1f4db fix pfsense firewall udp parsing 2020-10-10 07:38:47 -04:00
Doug BurksandGitHub 8cfabf101c Update Hunt query for firewall #1499 2020-10-10 07:17:49 -04:00
Doug BurksandGitHub 9aa4112de1 Remove extra comma 2020-10-10 06:10:10 -04:00
Doug BurksandGitHub 2489ca608a Improve Hunt FTP queries #1479 2020-10-08 05:30:17 -04:00
Doug BurksandGitHub a686704d37 remove rule.uuid now that underlying issue has been resolved 2020-10-06 09:39:57 -04:00
Doug BurksandGitHub a45aa43f41 Add trailing comma to "thehive" stanza 2020-10-05 12:35:33 -04:00
Doug BurksandGitHub e7cba6ba1d Change SOC Alerts eventFetchLimit from 5000 to 500 #1447 2020-10-05 09:29:01 -04:00
Doug BurksandGitHub 948e0c4c61 Add rule.name to Hunt Wazuh Alerts query #1442 2020-10-05 09:26:13 -04:00
Doug BurksandGitHub e836f96c65 move rule.uuid after rule.name 2020-10-01 12:09:52 -04:00
Doug BurksandGitHub 4851069a10 remove rule.gid from Alerts groupby since Wazuh and Playbook may not have that field 2020-10-01 11:51:40 -04:00
Doug BurksandGitHub bc19cce4c2 Acknowledging an alert may acknowledge more alerts than intended #1426 2020-10-01 10:00:54 -04:00
Doug BurksandGitHub 26781de244 Add Strelka query to Hunt #1433 2020-10-01 06:59:36 -04:00
Doug BurksandGitHub 0a995f4a7a Update README.md 2020-09-30 07:43:20 -04:00
Doug BurksandGitHub 60134829d5 Alerts - Drilldown should display rule.uuid #1416 2020-09-29 07:51:45 -04:00
Doug BurksandGitHub c7b43ac220 Update soc.json 2020-09-29 07:41:49 -04:00
Doug BurksandGitHub a7f24b62e6 Hunt - improve NIDS query and eventFields #1415 2020-09-29 07:34:44 -04:00
Doug BurksandGitHub 6e9e4dc99c Hunt third magnifying glass should group output by event.module and event.dataset #1407 2020-09-28 14:19:55 -04:00
Doug BurksandGitHub 0516a9ddd5 Alerts page "Hunt for this field" action should quote field and group output #1406 2020-09-28 12:35:08 -04:00
Doug BurksandGitHub 3904295137 Hunt - improve HTTP queries #1401 2020-09-27 08:04:28 -04:00
Doug BurksandGitHub aa7f927ffd Hunt - improve x509 queries #1400 2020-09-27 07:17:46 -04:00
Doug BurksandGitHub 11b200e9c0 Hunt - remove SMTP fields #1397 2020-09-25 14:17:14 -04:00
Doug BurksandGitHub 20a56d0831 Hunt - add network.community_id column to Events table for more data types #1396 2020-09-25 13:18:28 -04:00
Doug BurksandGitHub 62dbe425a6 Hunt - fix x509 eventFields #1387 2020-09-24 07:52:46 -04:00
Doug BurksandGitHub 2b8b8e2f40 Hunt - fix file eventFields #1386 2020-09-24 07:44:28 -04:00
Doug BurksandGitHub 60daacd6dc Hunt - fix DHCP eventFields #1385 2020-09-24 07:34:29 -04:00
Doug BurksandGitHub 57e45308af Fix pivot from TheHive to Kibana #1362 2020-09-17 08:05:55 -04:00
Doug BurksandGitHub c9c1245d1e change from 2.1 RC2 to 2.2 RC3 2020-09-17 08:01:10 -04:00
doug 840b54d73c make so-analyst executable 2020-09-16 13:11:49 -04:00
Doug BurksandGitHub 18dc7a915a Hunt: Fix Tunnel query #1335 2020-09-13 08:26:33 -04:00
Doug BurksandGitHub 311d67b934 Hunt: fix RFB groupby #1332 2020-09-12 06:14:58 -04:00
Doug BurksandGitHub 8c280221da Hunt: Fix Intel groupby #1131 2020-09-10 07:00:54 -04:00
Doug BurksandGitHub 24c325e9a1 Fix Elasticsearch parsing for Zeek Intel Indicator #1309 2020-09-10 06:41:19 -04:00
Doug BurksandGitHub 7161a662aa improve Wazuh support in Hunt 2020-09-10 06:03:33 -04:00
Doug BurksandGitHub d18c498574 Update so-features-enable 2020-09-09 17:32:42 -04:00
Doug BurksandGitHub 82b582540e Add period 2020-09-09 12:56:19 -04:00
Doug BurksandGitHub 90ba1be978 Improve formatting of NIDS selection screen 2020-09-09 12:55:14 -04:00
Doug BurksandGitHub eaf3281ab7 Remove Suricata version numbers from Setup screens #1300 
https://github.com/Security-Onion-Solutions/securityonion/issues/1300
 2020-09-09 10:43:41 -04:00
Doug BurksandGitHub f8ebed43d7 fix spacing 2020-09-07 04:45:26 -04:00
Doug BurksandGitHub f5916e26a2 read ca.crt from filesystem when possible 2020-09-07 04:42:11 -04:00
Doug BurksandGitHub f8e68c82e4 downgrade to Mono 4.2.1.102 and NetworkMiner 2.4 2020-09-04 10:12:28 -04:00
Doug BurksandGitHub c050003b5a Install file-roller for opening zip files 2020-09-04 07:14:01 -04:00
Doug BurksandGitHub a2265fac4f NetworkMiner has a compatibility issue with Mono 6 right now 2020-09-04 06:50:22 -04:00
Doug BurksandGitHub 1fc64d3eef so-analyst should install gedit 2020-09-03 16:46:14 -04:00
Doug BurksandGitHub 45c0a7ac77 Kernel messages can overwrite whiptail screen #812 
Kernel messages can overwrite whiptail screen #812
 2020-09-01 08:55:34 -04:00
Doug BurksandGitHub 9680270b20 Set default monospace font to Liberation 2020-08-30 16:42:44 -04:00
Doug BurksandGitHub 2f09156a02 quote filename when spawning NetworkMiner 2020-08-30 16:10:47 -04:00