2883 Commits

Author	SHA1	Message	Date
Wes Lambert	1efb39a71b	Add pipeline stats script	2020-10-08 19:11:41 +00:00
m0duspwnens	52e8265511	update is_airgap for soup	2020-10-08 14:16:19 -04:00
Mike Reeves	26317efe79	Update Soup	2020-10-08 14:05:52 -04:00
William Wernert	2ad3f9da11	[fix] Wazuh not saving .log files anymore, only check .json files	2020-10-08 12:41:51 -04:00
William Wernert	034750fe5b	Merge branch 'dev' into feature/rotate-logs ... # Conflicts: # setup/so-functions	2020-10-08 12:36:30 -04:00
William Wernert	e1d8f578c2	[feat] Add log dirs for playbook + influxdb	2020-10-08 12:35:14 -04:00
m0duspwnens	e7abbf19af	fix templates not applying to searchnode. so-searchnode role doesnt exists searchnodes are so-node role	2020-10-08 11:17:26 -04:00
Wes Lambert	a6d3dcf398	More fixes for rule field	2020-10-08 13:36:47 +00:00
Wes Lambert	a2e2f23a8d	Add null safe check for rule	2020-10-08 13:14:39 +00:00
Wes Lambert	adf0ef87c9	Fix network transport Kibana viz	2020-10-08 12:17:15 +00:00
weslambert	5ada85942b	Lowercase network.transport	2020-10-08 07:59:57 -04:00
Doug Burks	2489ca608a	Improve Hunt FTP queries #1479	2020-10-08 05:30:17 -04:00
m0duspwnens	be7167d99b	Merge remote-tracking branch 'remotes/origin/dev' into issue/1403	2020-10-07 17:45:22 -04:00
m0duspwnens	821ce19aad	new dashboard for sensors	2020-10-07 17:38:16 -04:00
m0duspwnens	1bdc45ef0e	new dashboard for sensors	2020-10-07 17:37:11 -04:00
m0duspwnens	4f8bb9c2f1	updates to standalone and eval dashboards	2020-10-07 16:48:29 -04:00
m0duspwnens	7dd839cfa2	add zeek capture loss graph and resize redis queue for standalone	2020-10-07 15:53:31 -04:00
Wes Lambert	7543144afe	Don't use regex for determining rule type	2020-10-07 16:15:43 +00:00
weslambert	8e829b47ae	Remove dataset name since pipeline no longer in use	2020-10-07 11:48:56 -04:00
m0duspwnens	8540a691dc	only send loss if timestamp on data has changed	2020-10-07 11:23:06 -04:00
Wes Lambert	015a441e79	Change rule.signature_info to rule.reference and ensure common.nids exists	2020-10-07 15:20:26 +00:00
m0duspwnens	1106b2bf96	only send loss if timestamp on data has changed	2020-10-07 11:15:10 -04:00
Wes Lambert	f0a1457ffd	Update common.nids	2020-10-07 15:14:08 +00:00
m0duspwnens	d09f0f841e	only send loss if timestamp on data has changed	2020-10-07 11:13:03 -04:00
m0duspwnens	6f2d47cc40	only send loss if timestamp on data has changed	2020-10-07 11:11:06 -04:00
m0duspwnens	2317e8b348	only send loss if timestamp on data has changed	2020-10-07 11:08:41 -04:00
m0duspwnens	f96d6ae4f4	only send loss if timestamp on data has changed	2020-10-07 11:06:54 -04:00
m0duspwnens	5e534571ff	set timestamp with capture loss	2020-10-07 10:20:51 -04:00
m0duspwnens	14dd80b410	handle whitespace	2020-10-06 18:46:32 -04:00
m0duspwnens	af2df2c7d1	just print the loss	2020-10-06 18:44:22 -04:00
m0duspwnens	f95712c502	update log file	2020-10-06 18:38:51 -04:00
m0duspwnens	48ca2cdff1	fix pillars we check	2020-10-06 18:10:41 -04:00
m0duspwnens	73ce948d42	add zeekcaptureloss to data to influxdb. rename broloss to zeekloss - https://github.com/Security-Onion-Solutions/securityonion/issues/1403	2020-10-06 18:05:41 -04:00
William Wernert	d84f85335e	[fix] Add jinja option, missing log dirs, compress option	2020-10-06 17:18:39 -04:00
Wes Lambert	8c07c098f6	Pipeline cleanup	2020-10-06 20:14:15 +00:00
Wes Lambert	350cc41740	Let zeek.common handle common fields for zeek.tunnels	2020-10-06 20:12:23 +00:00
William Wernert	27351fa520	[fix] Correct jinja syntax + indent all lines	2020-10-06 14:51:42 -04:00
m0duspwnens	035d215398	fix yum db if corrupted - https://github.com/Security-Onion-Solutions/securityonion/issues/163	2020-10-06 14:28:01 -04:00
m0duspwnens	3d71766b64	Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into issue/1460	2020-10-06 13:58:02 -04:00
m0duspwnens	34dfc809c7	handle thread count for suricata and default max-pending-packets to 5000 - https://github.com/Security-Onion-Solutions/securityonion/issues/1460	2020-10-06 13:57:50 -04:00
William Wernert	9737b01676	[feat] Move logrotate configuration settings to pillar	2020-10-06 13:22:44 -04:00
William Wernert	94f15c63ce	[fix] Correct indent in common init.sls	2020-10-06 13:21:37 -04:00
Wes Lambert	a6a69c57d1	Rename so-elasticsearch-templates to so-elasticsearch-templates-load	2020-10-06 17:18:42 +00:00
Wes Lambert	787f1d8732	Add so-elasticsearch-templates-list	2020-10-06 17:15:27 +00:00
Wes Lambert	4a5d50cf80	Add so-elasticsearch-pipelines-list and fix common script perms	2020-10-06 17:01:58 +00:00
m0duspwnens	5eada1cdd5	handle install locations of files copied	2020-10-06 11:39:34 -04:00
m0duspwnens	a5f4c96db0	qol user interaction improvements to analyst install	2020-10-06 11:19:43 -04:00
m0duspwnens	4eea0a464c	include remaining log functions from so-functions	2020-10-06 10:57:43 -04:00
m0duspwnens	7840002d18	update log file in title func	2020-10-06 10:51:31 -04:00
m0duspwnens	85168e9318	add title function	2020-10-06 10:49:38 -04:00