Josh Brower
2247cafe5f
Change policy name
2023-06-24 17:13:28 -04:00
Josh Brower
85a8da6331
Change policy name
2023-06-24 16:58:36 -04:00
Josh Brower
336a40d646
Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/heavynode
2023-06-23 15:50:14 -04:00
Josh Brower
bb0cfc5253
Create & assign Heavy Node Fleet Policy
2023-06-23 15:49:03 -04:00
Corey Ogburn
fb27e7c479
Also add to dashboard
...
Duplicate new queryToggleFilter from hunt to dashboard.
2023-06-23 11:30:26 -06:00
Corey Ogburn
261acee8a0
New Hunt queryToggleFilter
...
New filter to exclude soc logs from hunt results.
2023-06-23 11:30:26 -06:00
Josh Brower
a9585b2a7f
Fix Elastic Agent for Heavy
2023-06-23 10:45:58 -04:00
Jason Ertel
b21b545756
use cluster-unique password for import encryption
2023-06-23 09:37:41 -04:00
Corey Ogburn
2b323ab661
Fix salt cmd.run commands for importing
...
Functional and easy to read.
2023-06-22 17:30:56 -06:00
Josh Brower
d0d7ab57ca
Add Elastic Agent container for Heavy Nodes
2023-06-22 16:02:17 -04:00
Jason Ertel
f4cbe20ddf
Merge pull request #10641 from Security-Onion-Solutions/jertel/fix-import
...
fix quotations
2023-06-22 14:46:41 -04:00
Jason Ertel
0d92a1594a
fix quotations
2023-06-22 14:41:39 -04:00
m0duspwnens
daaead618e
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/heavynode
2023-06-22 13:26:56 -04:00
m0duspwnens
19469205e1
include eval and import in so-elasticsearch-cluster-settings
2023-06-22 13:12:47 -04:00
m0duspwnens
6c4c815683
change so-elasticsearch-cluster settings to include heavynode, and only run on managers
2023-06-22 13:04:20 -04:00
Corey Ogburn
6769386c86
Change upload path
2023-06-22 10:59:24 -06:00
m0duspwnens
36272efda7
create ES_LOGSTASH_NODES which removes heavynodes
2023-06-22 09:46:42 -04:00
weslambert
6b97d07a89
Merge pull request #10629 from Security-Onion-Solutions/fix/elasticsearch_ingest_suricata_xff_ip
...
Parse xff
2023-06-22 08:45:58 -04:00
Corey Ogburn
b5e5bd57ad
Fix for Upload Import
...
Needed to mount /nsm/soc/uploads into soc container.
Made the upload route configurable.
Added gpg logging to salt-relay.
2023-06-21 15:41:16 -06:00
Josh Patterson
ad4fb52b81
Merge pull request #10631 from Security-Onion-Solutions/2.4/repos
...
2.4/repos
2023-06-21 16:06:30 -04:00
m0duspwnens
4e849ecc90
issues with exclude rocky-repos
2023-06-21 15:14:53 -04:00
weslambert
7e37cd0f05
Parse xff
2023-06-21 14:29:54 -04:00
m0duspwnens
1675b787bf
exclude rocky-repos and remove files
2023-06-21 13:27:34 -04:00
Josh Brower
6ddf887342
Refactor EVTX Import
2023-06-21 09:32:42 -04:00
Josh Brower
6ba9e057a9
Merge pull request #10600 from Security-Onion-Solutions/fix/dataset_tags
...
Change format of event dataset and assign dataset to tags
2023-06-21 09:22:40 -04:00
Mike Reeves
4497f6561f
Salt Defunct Workaround
...
This can be removed once they patch salt
2023-06-20 17:27:02 -04:00
Corey Ogburn
ad28ea275f
Better state management
...
When salt-cp runs it's course and finds it can't send a file, it outputs a report saying as much but the exit code will be zero. Now we remove the filename and node from the response and look for `True` to know if it succeeded. Also, respect the cleanup flag on success or failure.
Check the status of the decryption process before importing.
No longer decrypt locally, issue salt command for the remote client to do the decrypting.
2023-06-20 09:41:14 -06:00
Corey Ogburn
41951659ec
Use importer's new --json flag.
...
Using the new --json flag is not only more reliable than using a regex, the way the import script was written even re-imports will provide a url. This means that in more cases we can provide the results to the users (even if nothing changed).
2023-06-20 09:41:14 -06:00
Corey Ogburn
451a4784a1
send-file and import-file security
...
Encrypt the file with a passphrase before sending and decrypt the file with the same passphrase before importing.
2023-06-20 09:41:14 -06:00
Corey Ogburn
1b7095fa81
Improved import-file url regex
...
sed doesn't remove ALL whitespace, only newlines. It's better to stop at the first whitespace than to stop at a particular, maybe-not-last query string parameter.
2023-06-20 09:41:14 -06:00
Corey Ogburn
89d789fe0f
New folder for salt to maintain
...
This folder is where a manager will initially store uploaded PCAP/EVTX files before sending to sensors. Sensors will store uploads in this folder on their own system.
2023-06-20 09:41:14 -06:00
Corey Ogburn
49055e260f
salt-relay import-file reporting
...
On successful import, return dashboard URL
2023-06-20 09:41:14 -06:00
Corey Ogburn
a465039887
2 new capabilities: send-file and import-file
2023-06-20 09:41:14 -06:00
Doug Burks
0e09d73aa0
Resolve conflicts with dataset PR
2023-06-20 07:40:10 -04:00
Doug Burks
fc824359ed
Update default fields for kratos.audit
2023-06-20 07:30:56 -04:00
Doug Burks
7caa7cec6b
Fix SOC Auth queries in Dashboards and Hunt
...
Change `event.dataset:audit` to `event.dataset:kratos.audit`.
2023-06-20 07:13:33 -04:00
Jason Ertel
594900a8d4
Merge pull request #10609 from Security-Onion-Solutions/kilo
...
webauthn for SOC
2023-06-16 13:15:25 -04:00
m0duspwnens
d4acb1a33a
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/receiver
2023-06-15 15:32:49 -04:00
m0duspwnens
5de9e5baf4
allow sensor to logstash on receiver
2023-06-15 14:46:46 -04:00
Wes
3a34da354f
Use append instead of set
2023-06-15 16:35:43 +00:00
m0duspwnens
469390696e
2.4 receiver changes
2023-06-15 11:04:16 -04:00
Wes
58a63e0765
Remove extra comma
2023-06-15 14:22:37 +00:00
Doug Burks
b84d997f87
Update so_motd.jinja
2023-06-15 09:54:23 -04:00
Wes
b5bccc5e05
Use module in dataset name and add dataset tag
2023-06-15 13:06:57 +00:00
Jason Ertel
b4e5ac9796
Add note to advise against changing settings
2023-06-14 16:11:50 -04:00
m0duspwnens
2db95fe1b4
fw rules for receiver to managers
2023-06-14 15:24:14 -04:00
m0duspwnens
934b0f45a1
allow receiver to connect to salt manager
2023-06-14 15:08:07 -04:00
Jason Ertel
a88227d13f
Merge branch '2.4/dev' into kilo
2023-06-14 13:34:15 -04:00
Jason Ertel
21a7b76352
webauthn
2023-06-14 13:33:31 -04:00
weslambert
03082339ca
Merge pull request #10592 from Security-Onion-Solutions/fix/analyzer_dependencies
...
Update analyzer dependencies
2023-06-14 12:22:06 -04:00
