CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 21:03:10 +02:00
Code Issues Packages Projects Releases Wiki Activity
13,494 Commits 40 Branches 127 Tags
1e04199ea631eb9ecbf00a70d88db3c9eef22a9f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 4dc477cc1d Merge pull request #11391 from Security-Onion-Solutions/fix/elasticsearch_strelka_image_version 
Make scan.pe.image_version type of 'float'
 2023-09-26 10:21:17 -04:00
Wes 0bba68769b Make scan.pe.image_version type of 'float' 2023-09-26 14:05:12 +00:00
weslambertandGitHub f9ace4791f Merge pull request #11384 from Security-Onion-Solutions/fix/analyzers_testing 
Add a note about testing analyzers outside of the Sensoroni Docker container
 2023-09-25 14:48:45 -04:00
weslambertandGitHub 7cb9b5f257 Add the blank line that was removed from the previous commit 2023-09-25 14:41:20 -04:00
weslambertandGitHub c95af6b992 Add a note about testing analyzers outside of the Sensoroni Docker container 2023-09-25 14:39:33 -04:00
weslambertandGitHub 2fc4d2923d Merge pull request #11289 from Security-Onion-Solutions/fix/elastic_agent_404 
/app/dashboards to /kibana/app/dashboards
 2023-09-25 09:11:50 -04:00
Wes eeeae08ec8 /app/ to /app/dashboards/ 2023-09-21 18:39:06 +00:00
weslambertandGitHub 377802410e Merge pull request #11352 from Security-Onion-Solutions/fix/import_evtx_exists 
Fix EVTX Imports
 2023-09-19 16:11:22 -04:00
Wes 2e0ea3f374 Set final pipeline 2023-09-19 13:33:12 +00:00
Wes 508260bd46 Use event.created for timestamp 2023-09-19 13:32:03 +00:00
Wes a1e963f834 Reverse timestamps where necessary 2023-09-19 13:28:20 +00:00
Wes 5bac1e4d15 Show correct dates and Kibana URL for already processed EVTX files 2023-09-18 21:31:15 +00:00
weslambertandGitHub fe1bae96ed Merge pull request #11297 from Security-Onion-Solutions/fix/soc_idh 
Change description to indicate that opencanary modules only apply to IDH nodes
 2023-09-15 11:16:06 -04:00
weslambertandGitHub eab6173a31 Merge pull request #11329 from Security-Onion-Solutions/fix/elastic_templates_clean 
Clean component template directory
 2023-09-15 11:00:17 -04:00
Wes 98499c3963 Clean component template directory 2023-09-15 13:51:46 +00:00
Wes 35ebbc974c Change description to indicate that opencanary modules only apply to IDH nodes 2023-09-11 13:52:16 +00:00
Wes f1d0db8171 /app to /kibana/app 2023-09-11 13:30:11 +00:00
weslambertandGitHub 70e1309c9f Merge pull request #11261 from Security-Onion-Solutions/fix/remove_default_templates 
Remove templates
 2023-09-06 10:57:09 -04:00
Wes cf19c8f8c2 Remove templates 2023-09-05 13:43:41 +00:00
weslambertandGitHub b8f69b5008 Merge pull request #11239 from Security-Onion-Solutions/fix/syslog_heavynode 
Add so-elastic-agent
 2023-09-01 12:20:44 -04:00
weslambertandGitHub 765a22e6f0 Add so-elastic-agent 2023-09-01 11:31:23 -04:00
weslambertandGitHub ce2a7135cb Merge pull request #11232 from Security-Onion-Solutions/fix/strelka_entropy 
Strelka entropy mapping
 2023-08-31 11:21:00 -04:00
Wes 0fed757b11 Add entropy mapping 2023-08-31 15:10:27 +00:00
Wes 1a3b3b21fb Change entropy value syntax 2023-08-31 15:09:19 +00:00
weslambertandGitHub ac38f32e32 Merge pull request #11218 from Security-Onion-Solutions/feature/soc_administration_analyzers 
Analyzer SOC Administration
 2023-08-30 16:54:02 -04:00
weslambertandGitHub 41300af944 Set global to false 2023-08-30 16:30:32 -04:00
weslambertandGitHub 21e91a7537 Fix api_version 2023-08-30 16:10:38 -04:00
weslambertandGitHub 4127e0fc53 Merge pull request #11219 from Security-Onion-Solutions/fix/elastic_fortigate 
Correct Fortigate Integration
 2023-08-30 15:54:39 -04:00
weslambertandGitHub d090852895 Correct fortigate template name 2023-08-30 15:40:40 -04:00
weslambertandGitHub 78915f900b Add fortigate package 2023-08-30 15:37:30 -04:00
Wes 8cc19b0748 Add analyzer configuration description 2023-08-30 19:16:38 +00:00
Wes fe690922de Add analyzer configuration to the defaults file 2023-08-30 19:16:05 +00:00
weslambertandGitHub bee83a320b Merge pull request #11212 from Security-Onion-Solutions/fix/elastic_heavynode_syslog 
Add syslog to heavynode
 2023-08-30 10:48:03 -04:00
Wes 60b0af5ab7 Allow external syslog 2023-08-30 13:05:30 +00:00
Wes 0e22acc255 Add tcp and udp integration 2023-08-30 13:04:32 +00:00
Wes 655eea2b00 Add port_bindings 2023-08-30 13:03:56 +00:00
Wes ce05f29dc4 Add port_bindings for port 514 2023-08-30 13:03:28 +00:00
weslambertandGitHub 7e12167b52 Merge pull request #11208 from Security-Onion-Solutions/fix/elasticsearch_syslog 
Make sure a data stream is created for syslog
 2023-08-30 08:37:39 -04:00
weslambertandGitHub 706a6e2d56 Make sure a data stream is created for syslog 2023-08-30 08:34:04 -04:00
weslambertandGitHub f4191fb7fa Merge pull request #11197 from Security-Onion-Solutions/feature/elastic_integration_apache 
Add Apache package and templates
 2023-08-29 11:27:08 -04:00
weslambertandGitHub d2063c7e11 Add auditd reference back 2023-08-29 11:14:49 -04:00
weslambertandGitHub c01a9006a6 Add Apache package 2023-08-29 11:01:22 -04:00
weslambertandGitHub f118e25e8c Add Apache references 2023-08-29 11:00:31 -04:00
weslambertandGitHub d40bbf6b09 Add Apache templates 2023-08-29 10:59:40 -04:00
weslambertandGitHub d4bffba736 Merge pull request #11153 from Security-Onion-Solutions/fix/elastic_fleet_integrations 
Add more Elastic Fleet integrations
 2023-08-23 16:22:14 -04:00
Wes d2d0d53eef Change order 2023-08-23 20:20:44 +00:00
Wes 31a49268cb Add o365 and okta 2023-08-23 20:20:06 +00:00
Wes 2f51349ff8 Add SOC configuration 2023-08-23 20:07:42 +00:00
Wes 3f2793088a Add templates 2023-08-23 19:02:50 +00:00
Wes 0f24c8e8bb Add packages 2023-08-23 19:02:32 +00:00
weslambertandGitHub 4a582804b0 Merge pull request #11139 from Security-Onion-Solutions/fix/soc_event_fields 
Update SOC event fields
 2023-08-22 10:46:38 -04:00
weslambertandGitHub 563a495725 Add Playbook 2023-08-21 11:24:07 -04:00
weslambertandGitHub 9e18fe64cf Remove OSSEC configuration 2023-08-21 11:20:47 -04:00
weslambertandGitHub 708a681ed9 Merge pull request #11123 from Security-Onion-Solutions/fix/elastic_fleet_zeek_console 
Exclude console log
 2023-08-21 10:31:32 -04:00
weslambertandGitHub fa31bd4bf7 Exclude console log 2023-08-21 09:20:49 -04:00
weslambertandGitHub 488c4d5000 Merge pull request #11079 from Security-Onion-Solutions/fix/import_evtx_pcap 
Assign pipeline to import
 2023-08-17 12:29:01 -04:00
Wes 7971d9749a Assign pipeline to import 2023-08-17 14:08:48 +00:00
weslambertandGitHub 5ebe33d45f Merge pull request #11068 from Security-Onion-Solutions/fix/elastic_fleet_package_force_2 
Fix so-elastic-fleet-package-load
 2023-08-17 08:20:24 -04:00
weslambertandGitHub 4887eb4957 Update so-elastic-fleet-package-load 2023-08-16 22:31:14 -04:00
weslambertandGitHub 0620919241 Merge pull request #11064 from Security-Onion-Solutions/fix/elasticfleet_package_force 
Force package installation
 2023-08-16 16:37:39 -04:00
Wes e84d624d23 Force package installation 2023-08-16 20:10:20 +00:00
weslambertandGitHub abf74e0ae4 Merge pull request #10940 from Security-Onion-Solutions/foxtrot 
Add time shift for so-import-evtx
 2023-08-03 16:56:40 -04:00
weslambertandGitHub ca6276b922 Update VERSION 2023-08-03 15:58:33 -04:00
weslambertandGitHub 3e4136e641 Update help text 2023-08-03 15:56:05 -04:00
weslambertandGitHub cf2233bbb6 Add help information for time shift 2023-08-03 08:54:54 -04:00
weslambertandGitHub 3847863b3d Add time shift 2023-08-03 08:51:23 -04:00
weslambertandGitHub 3368789b43 Update VERSION 2023-08-03 08:49:45 -04:00
weslambertandGitHub 72e1cbbfb6 Merge pull request #10920 from Security-Onion-Solutions/fix/pfsense 
Pfsense fix
 2023-08-02 13:27:33 -04:00
weslambertandGitHub f102351052 Add event 2023-08-02 13:25:44 -04:00
weslambertandGitHub ac28f90af3 Remove override 2023-08-02 13:15:11 -04:00
weslambertandGitHub 25b11c35fb Merge pull request #10915 from Security-Onion-Solutions/fix/ea_elastic_defend 
Set version for Elastic Defend and enable updates
 2023-08-02 10:32:30 -04:00
weslambertandGitHub ef0301d364 Merge pull request #10914 from Security-Onion-Solutions/feature/package_list 
Add package list
 2023-08-02 10:03:38 -04:00
Wes e694019027 Add package list 2023-08-02 13:50:14 +00:00
weslambertandGitHub 22ebb2faf6 Merge pull request #10907 from Security-Onion-Solutions/fix/ea_container_logs 
EA Container Logs
 2023-08-02 09:26:53 -04:00
Wes 0d5ed2e835 Set version for Elastic Defend and enable updates 2023-08-02 13:21:03 +00:00
Wes 0e047cffad Add to logrotate 2023-08-01 20:14:53 +00:00
Wes 44b086a028 Change path 2023-08-01 20:13:50 +00:00
Wes 4e2eb86b36 Move LOGS_PATH to environment vars 2023-08-01 20:11:51 +00:00
weslambertandGitHub 1cbf60825d Add log dir 2023-08-01 14:40:52 -04:00
weslambertandGitHub 2d13bf1a61 Present logs to the host 2023-08-01 14:40:12 -04:00
weslambertandGitHub e7bef745eb Merge pull request #10904 from Security-Onion-Solutions/fix/syslog 
Move syslog to the INPUT chain where needed
 2023-08-01 12:14:48 -04:00
weslambertandGitHub 4adaddf13f Move syslog to the INPUT chain where needed 2023-08-01 10:14:59 -04:00
weslambertandGitHub ba3660d0da Merge pull request #10894 from Security-Onion-Solutions/fix/soc_auth 
SOC Auth msg fix
 2023-08-01 08:35:41 -04:00
weslambertandGitHub 83265d9d6c Merge pull request #10893 from Security-Onion-Solutions/foxtrot 
Elastic 8.2.2
 2023-08-01 08:20:07 -04:00
weslambertandGitHub 527a6ba454 Use asterisk when searching 'msg' since it is now a keyword 2023-07-31 23:52:38 -04:00
weslambertandGitHub f84b0a3219 Update VERSION 2023-07-31 23:16:46 -04:00
weslambertandGitHub ae6997a6b7 Merge pull request #10892 from Security-Onion-Solutions/feature/elastic_8.8.2 
Elastic 8.8.2
 2023-07-31 22:24:21 -04:00
weslambertandGitHub 9d59e4250f Update VERSION 2023-07-31 22:23:54 -04:00
Wes 48d9c14563 Enable log package by default 2023-08-01 02:20:43 +00:00
Wes 29b64eadd4 Change log.log to log.logs 2023-08-01 02:20:22 +00:00
weslambertandGitHub 5dd5f9fc1c Elastic 8.8.2 2023-07-31 22:18:43 -04:00
weslambertandGitHub 44c926ba8d Elastic 8.8.2 2023-07-31 22:18:07 -04:00
weslambertandGitHub 6a55a8e5c0 Elastic 8.2.2 2023-07-31 22:17:22 -04:00
Wes 5553be02ac Change how tags are added 2023-07-24 21:31:28 +00:00
Wes 4efc951eaf Add tags 2023-07-24 20:57:39 +00:00
Wes d84dbf9535 Add fleet 2023-07-24 18:53:52 +00:00
Wes de7b7ff989 Add endpoint 2023-07-24 18:35:02 +00:00
weslambertandGitHub be254b15f2 Merge pull request #10804 from Security-Onion-Solutions/fix/fleet_logging 
Fleet logging
 2023-07-20 15:51:56 -04:00
weslambertandGitHub 83e1e3efdc Merge pull request #10788 from Security-Onion-Solutions/fix/elastic_mappings 
Fix user name mapping and remove security subfield
 2023-07-20 15:51:42 -04:00
Wes d07c46f27e Change playbook and sysmon 2023-07-20 16:08:50 +00:00