CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-13 20:41:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,682 Commits 39 Branches 127 Tags
1b6f681ae1b45cda2e0da170e95372d705dd8820
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Ertel 747f387936 Replace salt's http.wait_for_successful_query with so-common's wait_for_web_response due to issues with salt 2021-03-12 10:42:18 -05:00
Jason Ertel 8cddfeb47d Provide pillar for each client param 2021-03-12 07:42:10 -05:00
Jason Ertel 462f76e2bb Remove client params block in favor in individual settings that will go into the pillar 2021-03-12 06:38:53 -05:00
Jason Ertel b5cf9ae820 Merge branch 'dev' into kilo 2021-03-11 18:01:17 -05:00
Jason Ertel 80987dfd1d Support overrides of client params 2021-03-11 18:01:04 -05:00
Jason Ertel 286351f424 Merge branch 'dev' into kilo 2021-03-11 15:32:38 -05:00
Jason Ertel 908720592a Upgrade saved objects to 7.11.2 2021-03-11 15:32:22 -05:00
Jason Ertel 79dd0d1809 Fix indentation 2021-03-11 11:13:14 -05:00
Jason Ertel eefa6bb949 feature: Show job owner/submitter. Resolves #2775 2021-03-10 14:44:21 -05:00
Jason Ertel 3eb4a37c76 Expose zeek and suri pins for automation 2021-03-10 09:26:46 -05:00
Jason Ertel 180bba782e Expose zeek and suri pins for automation 2021-03-10 09:26:11 -05:00
Jason Ertel 46af6a5c84 Ensure MTU is defined for advanced sensor automation 2021-03-10 08:14:25 -05:00
Jason Ertel a496b03de7 Add missing MTU var for automation of advanced sensor 2021-03-09 20:52:34 -05:00
Jason Ertel 84c152e233 fix: Sensors can temporarily show offline while processing large PCAP jobs. Resolves #3279. 2021-03-08 12:05:44 -05:00
Jason Ertel 94610307b3 Merge branch 'dev' into kilo 2021-03-08 07:56:48 -05:00
Jason Ertel 61a7efeeab fix: syntax error in reserved ports configuration; ensure ports are reserved prior to setup 2021-03-05 10:54:01 -05:00
Jason Ertel 4014dbbc3d Revert "Move version to 2.3.31" 
This reverts commit cf21200a36.
 2021-03-02 10:14:45 -05:00
Jason Ertel cf21200a36 Move version to 2.3.31 2021-03-02 09:11:49 -05:00
Jason Ertel 53a45e1c97 Merge branch 'dev' into foxtrot 2021-03-01 15:54:41 -05:00
Jason Ertel b37d5ae15f Enable advanced setup for some search/sensor installs 2021-03-01 15:54:29 -05:00
Jason Ertel 85e059a766 Update VERSION file to 2.3.40 2021-03-01 12:16:46 -05:00
Jason Ertel 1ae46b82ec Update changes for 2.3.30 2021-03-01 09:58:39 -05:00
Jason Ertel 7451aa990b Improve formatting of changes list 2021-02-27 08:14:44 -05:00
Jason Ertel 9631327c71 Add changes.json for 2.3.30 2021-02-26 18:11:13 -05:00
Jason Ertel cc15e9a0b1 Merge branch 'dev' into foxtrot 2021-02-26 14:26:48 -05:00
Jason Ertel 4a03862fc4 Add suricata distributed automations 2021-02-26 14:26:28 -05:00
Jason Ertel 34dab9009c Ensure Zeek spool dir is owned by Zeek to allow Zeek to start correctly 2021-02-25 08:10:13 -05:00
Jason Ertel ef7cdf27bf Add automation files for Suricata metadata 2021-02-25 07:43:11 -05:00
Jason Ertel 050058a959 Add retry support for 'docker pull' command 2021-02-24 09:34:14 -05:00
Jason Ertel 43e0c3a60b Apply action on PR only now that PRs are mandatory 2021-02-22 12:35:17 -05:00
Jason Ertel 747d62dae5 Add acng to import installs for consistency 2021-02-22 09:44:24 -05:00
Jason Ertel 7222f1faa5 fix merge issue 2021-02-20 16:41:12 -05:00
Jason Ertel 9d3c82a589 Disable unused features for import installations 2021-02-19 20:14:55 -05:00
Jason Ertel 04b3a20e22 Merge branch 'dev' into delta 2021-02-19 20:12:07 -05:00
Jason Ertel 9302b9302b Clear salt fileserver cache to ensure the new local.rules file gets picked up on the filesync 2021-02-19 11:13:31 -05:00
Jason Ertel faa78c0e26 Salt doesn't like a name starting with a non alpha-numeric char. Switch back to long if/then format 2021-02-18 14:51:09 -05:00
Jason Ertel e912b2fd96 Move idstools to run after nginx runs 2021-02-18 12:50:00 -05:00
Jason Ertel 6f7bc650a0 Apply reserved ports if the existing file is 0 bytes 2021-02-18 11:20:13 -05:00
Jason Ertel e427f8178d Implement locking to so-firewall script 2021-02-04 16:06:11 -05:00
Jason Ertel a13b31fbcc Merge branch 'dev' into automation/ami 2021-02-04 16:05:39 -05:00
Jason Ertel 6b54a29ac7 Remove 'new user' references from so-user 2021-02-03 15:23:58 -05:00
Jason Ertel 91480abaa0 Adjust AMI test network 2021-02-02 17:41:41 -05:00
Jason Ertel f736d9f8dd Adjust automation files for distributed AMI 2021-02-01 15:27:53 -05:00
Jason Ertel 2926527ad0 Place sig keys in same dir as other sig files 2021-01-29 13:21:58 -05:00
Jason Ertel 73909c4dea Place sig keys in same dir as other sig files 2021-01-29 13:00:56 -05:00
Jason Ertel c055427e40 Add support for image key/sig retries 2021-01-29 11:18:06 -05:00
Jason Ertel 194f480017 Airgap fix for import nodes missing rules 2021-01-28 13:03:47 -05:00
Jason Ertel f12947362b Adjust test network IPs 2021-01-28 11:35:10 -05:00
Jason Ertel bfa6aabc4b Correct automation for airgap import to avoid infinite loop during setup 2021-01-28 10:38:03 -05:00
Jason Ertel 34c2116669 Adjust test network allocation 2021-01-27 16:02:36 -05:00
Jason Ertel df21b28d5c Update copyright year 2021-01-25 17:11:42 -05:00
Jason Ertel b0c74cf38c Add import automation files for other platforms 2021-01-25 16:46:52 -05:00
Jason Ertel ae233b5757 Update AMI automation files for distributed install 2021-01-25 15:53:25 -05:00
Jason Ertel 8ec0b95f02 Rename AMI automation files for consistency with other files 2021-01-25 15:53:25 -05:00
Jason Ertel 6f14f27ca0 Add automation files for distributed network variations 2021-01-23 11:04:07 -05:00
Jason Ertel 47d69bbc9e Move from quay.io to ghcr.io 2021-01-22 13:53:49 -05:00
Jason Ertel 537f7529f8 Increase Kibana wait from 3 minutes to 15 minutes due to the longer init time needed for Kibana to start (because of the recent ES changes) 2021-01-22 10:09:15 -05:00
Jason Ertel 58f922aac3 Skip image pull if so-tcpreplay image already exists and is current 2021-01-20 11:17:10 -05:00
Jason Ertel 71e0014115 Wrap parenthesis around correlation filter to allow additional filtering 2021-01-19 17:51:23 -05:00
Jason Ertel d91913e58e Redirect tcpreplay warnings to dev null when running so-test 2021-01-18 21:42:50 -05:00
Jason Ertel a795f0a487 Correct airgap IPs; Remove auto tcpreplay during post-setup phase 2021-01-16 12:01:49 -05:00
Jason Ertel 2006677a22 Add default customization file (Blank) 2021-01-15 20:08:27 -05:00
Jason Ertel 0af6afa216 Add method for making adjustments to the SOC UI 2021-01-15 16:26:06 -05:00
Jason Ertel 07b5f1d23e Rename functions to avoid naming conflict with setup vars 2021-01-15 08:55:30 -05:00
Jason Ertel 9d0dca05b1 Adjusted logic on so-tcpreplay to handle init for standalone/eval nodes 2021-01-13 22:29:58 -05:00
Jason Ertel 2ccf77eaef Rename network automation files 2021-01-13 17:29:48 -05:00
Jason Ertel 6d6779bba6 Added automation files for network eval/standalone installs; Reduced Zeek threads from 7 to 2 on all test nodes 2021-01-13 15:43:43 -05:00
Jason Ertel 0a1ab29d19 Add distributed airgap automation files 2021-01-13 14:28:54 -05:00
Jason Ertel ea1ab75072 Refactored so-common node type checks for improved readability; Updated so-tcpreplay to support distributed grids 2021-01-13 12:42:54 -05:00
Jason Ertel 9b060fb2d1 Adjust automation defaults for sensors and search nodes 2021-01-13 10:39:10 -05:00
Jason Ertel bb386f9935 Allow passwordless sudo during tests for all nodes, not just manager; Only run so-test on sensor nodes during test runs 2021-01-13 10:39:05 -05:00
Jason Ertel 8b49876e26 First pass at distribute ISO automation files 2021-01-11 12:04:57 -05:00
Jason Ertel bc8e200919 Continued retry implementation for salt-key acceptance; improve timestamp coverage in setup 2021-01-10 02:34:46 -05:00
Jason Ertel 63047b4b85 Add retry logic around salt key acceptance during setup 2021-01-10 00:57:43 -05:00
Jason Ertel 9eedb874fb Add eval and standalone airgap automations 2021-01-08 12:37:54 -05:00
Jason Ertel a6f88b2843 Correct eval AMI automation vars 2021-01-07 15:22:34 -05:00
Jason Ertel 567d80bb01 Update sed to disable sudo password prompt for automated testing 2021-01-07 11:33:59 -05:00
Jason Ertel 948f900673 Drop password requirement for sudo access during automated tests 2021-01-06 20:39:44 -05:00
Jason Ertel bbdb47703d Rename automation files to match environment names for consistency 2021-01-06 17:21:46 -05:00
Jason ErtelandWilliam Wernert 1cc8a78aa5 Only stop SOC if is_manager or is_import 2021-01-06 14:37:27 -05:00
Jason ErtelandWilliam Wernert 7dcd934269 so-fleet-setup doesn't need an interactive terminal to run, remove 'it' 2021-01-06 14:37:27 -05:00
Jason ErtelandWilliam Wernert bedbd39b82 tcpreplay doesn't need an interactive terminal to run, remove 'it' 2021-01-06 14:37:27 -05:00
Jason ErtelandWilliam Wernert 7d97e3590c Redirect tcpreplay init output to file 2021-01-06 14:37:27 -05:00
Jason ErtelandWilliam Wernert bdbc637852 Stop SOC prior to opening the firewall for analysts, this ensures no outside requests can be processed prior to the server rebooting 2021-01-06 14:37:27 -05:00
Jason ErtelandWilliam Wernert 10d04f760d Use manager internal IP for intra-service comms 2021-01-06 14:37:26 -05:00
Jason ErtelandWilliam Wernert ebb0e615b9 Fix script typo to correctly run the so-test 2021-01-06 14:37:26 -05:00
Jason ErtelandWilliam Wernert f20feabda2 Reboot to ensure thehive falls in line before kicking off the test 2021-01-06 14:37:26 -05:00
Jason ErtelandWilliam Wernert 9b40318bfe Ensure so-test is logged 2021-01-06 14:37:26 -05:00
Jason ErtelandWilliam Wernert fc44474519 Add eval automation 2021-01-06 14:37:26 -05:00
Jason ErtelandWilliam Wernert 229657f7d2 Use AMI's public IP for external access 2021-01-06 14:37:26 -05:00
Jason ErtelandWilliam Wernert fb28faa4e3 Monitor interface will not always be bond0 - pull correct value from pillar; Replay test data after automated test installations complete. 2021-01-06 14:37:26 -05:00
Jason Ertel 455da7ec5d Only stop SOC if is_manager or is_import 2020-12-31 15:09:22 -05:00
Jason Ertel 4b244645ba so-fleet-setup doesn't need an interactive terminal to run, remove 'it' 2020-12-31 10:52:59 -05:00
Jason Ertel 6b81419d38 tcpreplay doesn't need an interactive terminal to run, remove 'it' 2020-12-30 22:02:19 -05:00
Jason Ertel e167bfed20 Redirect tcpreplay init output to file 2020-12-30 18:48:56 -05:00
Jason Ertel df305c49a6 Stop SOC prior to opening the firewall for analysts, this ensures no outside requests can be processed prior to the server rebooting 2020-12-30 16:33:46 -05:00
Jason Ertel 13f0ddabfc Use manager internal IP for intra-service comms 2020-12-30 12:02:42 -05:00
Jason Ertel 19d14cf277 Fix script typo to correctly run the so-test 2020-12-30 10:31:04 -05:00
Jason Ertel a49ddfb887 Reboot to ensure thehive falls in line before kicking off the test 2020-12-29 20:42:50 -05:00
Jason Ertel 827a571db8 Ensure so-test is logged 2020-12-29 17:25:53 -05:00