e075d07f5c
show last highstate date/time on grid metrics screen; expose maxUploadSize and staleMetricsMs settings on config screen
2023-12-29 11:38:42 -05:00
ab5de4c104
update soc defaults.yaml
2023-12-19 07:27:07 -05:00
4d8661d2e0
FIX: Update dashboard and hunt query for firewall logs #12021
2023-12-18 13:38:04 -05:00
6a1073b616
FIX: Update dashboard and hunt query for firewall logs #12021
2023-12-18 12:57:40 -05:00
8779fb8cbc
Update defaults.yaml
2023-12-14 13:30:52 -05:00
042e5ae9f0
https://github.com/Security-Onion-Solutions/securityonion/issues/12021
2023-12-14 12:46:28 -05:00
3dbf97944d
fix extra_hosts. https://github.com/Security-Onion-Solutions/securityonion/issues/12015
2023-12-14 10:26:29 -05:00
0334ef9677
Add eml observable type
2023-12-05 19:10:16 -05:00
c09e8f0d71
improve timing of responses
2023-11-16 15:58:48 -05:00
de99cda766
improve timing of responses
2023-11-16 15:51:17 -05:00
4666b993e5
Update defaults.yaml
2023-11-14 09:58:45 -05:00
bca1194a46
Sublime SOC Action
2023-11-01 14:01:55 +00:00
99662c999f
log operation and minion target
2023-10-20 13:41:24 -04:00
84c39b5de7
only add heavynodes to remoteHostUrls
2023-10-16 13:01:13 -04:00
35157f2e8b
add comment
2023-09-07 15:46:04 -04:00
60f1947eb4
prevent endgame_dict from being added to standard_actions if it is already present
2023-09-07 14:01:19 -04:00
ffaab4a1b4
only add endgame to action if it is populated
2023-09-06 14:19:53 -04:00
546c562ef0
expose standard relay timeout in config UI; up default to 45s to accommodate sluggish pillar.get calls
2023-09-01 10:31:02 -04:00
da56a421e5
Update motd.md
2023-08-31 09:17:33 -04:00
a615fc8e47
New Config Default: longRelayTimeoutMs
...
Salt is getting a second timeout for operations known to take a long time such as sending and importing files. There's also an entry in soc_soc.yaml so the value can be changed in SOC's config page.
2023-08-30 15:33:01 -06:00
bd61ee22be
Update defaults.map.jinja
2023-08-28 14:41:06 -04:00
563a495725
Add Playbook
2023-08-21 11:24:07 -04:00
9e18fe64cf
Remove OSSEC configuration
2023-08-21 11:20:47 -04:00
1fb3a59573
add missing annotations to avoid soc crash
2023-08-11 13:41:58 -04:00
a5e60363cf
add missing annotations to avoid soc crash
2023-08-11 13:38:16 -04:00
4426437ad3
Update motd.md
2023-08-10 15:04:31 -04:00
036b81707b
Update defaults.yaml
2023-08-08 16:10:54 -04:00
3d4fd08547
Update defaults.yaml
2023-08-08 15:28:06 -04:00
527a6ba454
Use asterisk when searching 'msg' since it is now a keyword
2023-07-31 23:52:38 -04:00
aa56085758
New Action "Add to Case"
2023-07-28 09:55:44 -06:00
c1190064ad
Merge pull request #10823 from Security-Onion-Solutions/2.4/dockerips
...
2.4/dockerips
2023-07-25 08:39:49 -04:00
4c9d172721
sorange to range
2023-07-21 16:21:18 -04:00
bb7a918a16
Added ReverseLookup Option
...
Defaults to false, has metadata to show up in the config section of soc.
2023-07-21 13:18:08 -06:00
1848a835f5
Remove keyword
2023-07-19 13:52:15 +00:00
5eca1acbeb
incorporate features pillar
2023-07-06 13:24:45 -04:00
951f04c265
remove use of pipe
2023-06-29 12:10:12 -04:00
fb27e7c479
Also add to dashboard
...
Duplicate new queryToggleFilter from hunt to dashboard.
2023-06-23 11:30:26 -06:00
261acee8a0
New Hunt queryToggleFilter
...
New filter to exclude soc logs from hunt results.
2023-06-23 11:30:26 -06:00
b21b545756
use cluster-unique password for import encryption
2023-06-23 09:37:41 -04:00
2b323ab661
Fix salt cmd.run commands for importing
...
Functional and easy to read.
2023-06-22 17:30:56 -06:00
f4cbe20ddf
Merge pull request #10641 from Security-Onion-Solutions/jertel/fix-import
...
fix quotations
2023-06-22 14:46:41 -04:00
0d92a1594a
fix quotations
2023-06-22 14:41:39 -04:00
6769386c86
Change upload path
2023-06-22 10:59:24 -06:00
b5e5bd57ad
Fix for Upload Import
...
Needed to mount /nsm/soc/uploads into soc container.
Made the upload route configurable.
Added gpg logging to salt-relay.
2023-06-21 15:41:16 -06:00
6ba9e057a9
Merge pull request #10600 from Security-Onion-Solutions/fix/dataset_tags
...
Change format of event dataset and assign dataset to tags
2023-06-21 09:22:40 -04:00
ad28ea275f
Better state management
...
When salt-cp runs it's course and finds it can't send a file, it outputs a report saying as much but the exit code will be zero. Now we remove the filename and node from the response and look for `True` to know if it succeeded. Also, respect the cleanup flag on success or failure.
Check the status of the decryption process before importing.
No longer decrypt locally, issue salt command for the remote client to do the decrypting.
2023-06-20 09:41:14 -06:00
41951659ec
Use importer's new --json flag.
...
Using the new --json flag is not only more reliable than using a regex, the way the import script was written even re-imports will provide a url. This means that in more cases we can provide the results to the users (even if nothing changed).
2023-06-20 09:41:14 -06:00
451a4784a1
send-file and import-file security
...
Encrypt the file with a passphrase before sending and decrypt the file with the same passphrase before importing.
2023-06-20 09:41:14 -06:00
1b7095fa81
Improved import-file url regex
...
sed doesn't remove ALL whitespace, only newlines. It's better to stop at the first whitespace than to stop at a particular, maybe-not-last query string parameter.
2023-06-20 09:41:14 -06:00
89d789fe0f
New folder for salt to maintain
...
This folder is where a manager will initially store uploaded PCAP/EVTX files before sending to sensors. Sensors will store uploads in this folder on their own system.
2023-06-20 09:41:14 -06:00
Jason Ertel
Doug Burks
m0duspwnens
weslambert
Jason Ertel
Corey Ogburn
Mike Reeves
bryant-treacle
Jason Ertel
Josh Brower