d89df5f0dd
Merge pull request #15025 from Security-Onion-Solutions/2.4/fixes
...
Parsing fix
2025-09-12 13:44:03 -04:00
f0c1922600
Support endpoint logs with no host.ip field
2025-09-12 13:31:34 -04:00
ab2cdd18ed
Support endpoint logs with no host.ip field
2025-09-12 13:29:43 -04:00
a959f90d0b
Merge remote-tracking branch 'origin/2.4/dev' into reyesj2/pypy
2025-09-12 11:05:54 -05:00
a54cd004d6
Merge pull request #15013 from Security-Onion-Solutions/reyesj2/kfoutput
...
update kafka output policy
2025-09-12 07:34:54 -05:00
588a1b86d1
suricata metadata index rollover 1d -> 30d
2025-09-11 15:46:45 -05:00
46f0afa24b
Merge pull request #15019 from Security-Onion-Solutions/reyesj2/ea-alerter
...
lower filestream fingerprint length
2025-09-11 14:34:46 -05:00
a7651b2734
lower filestream fingerprint length
2025-09-11 14:30:49 -05:00
890f76e45c
avoid delay in log ingest after a forced kafka output policy update
2025-09-10 20:21:11 -05:00
e6eecc93c8
Merge pull request #15012 from Security-Onion-Solutions/reyesj2/ea-alerter
...
add configurable realert threshold per agent
2025-09-10 13:19:21 -05:00
8dc0f8d20e
fix elastic agent ssl unpack error
2025-09-10 12:49:30 -05:00
fbdc0c4705
add configurable realert threshold per agent
2025-09-10 10:56:09 -05:00
f5ec1d4b7c
don't show sensoroni config changes
2025-09-10 09:09:02 -04:00
0aa556e375
Merge pull request #15009 from Security-Onion-Solutions/reyesj2/ea-alerter
...
so-elastic-agent-monitor
2025-09-09 17:00:39 -05:00
d9e86c15bc
Merge pull request #15010 from Security-Onion-Solutions/vlb2
...
fix repo files to remove
2025-09-09 17:15:52 -04:00
4107fa006f
fix repo files to remove
2025-09-09 16:51:42 -04:00
29980ea958
offline threshold check
2025-09-09 15:39:55 -05:00
8f36d2ec00
update log file name
2025-09-09 15:38:50 -05:00
2535ae953d
Fix Index Patterns
...
so-assistant-chat and so-assistant-session both had templates with a trailing dash that prevented the pattern from applying to the name of the indices.
2025-09-09 14:00:01 -06:00
6655276410
force update to kafka-fleet-output-policy
2025-09-08 21:13:29 -05:00
9f7bcb0f7d
add --force flag to so-kafka-fleet-output-policy & default to using fleet secret storage for client key
2025-09-08 21:13:11 -05:00
aa43177d8c
Fix Setting Name
...
enabledInSoc => enabled
2025-09-08 09:13:25 -06:00
12959d114c
added threshold config fields for assistant
2025-09-08 09:13:25 -06:00
855b489c4b
datastream
2025-09-08 09:13:24 -06:00
673f9cb544
Responding to Feedback
2025-09-08 09:13:24 -06:00
0a3ff47008
Cleanup Annotations
...
Removed fields no longer need annotations.
2025-09-08 09:13:24 -06:00
834e34128d
Non-dev URL
2025-09-08 09:13:23 -06:00
73776f8d11
Cleaning up New ES Indexes
2025-09-08 09:13:23 -06:00
120e61e45c
ClientParams
...
Removed investigation prompt from module settings and moved to client settings, added enabledInSoc.
2025-09-08 09:13:23 -06:00
fc2d450de0
Update Settings
...
The apiKey will be built off of the license rather than a new setting. The model is hardcoded for now at the AI Gateway level. We're going to use the investigationPrompt as a trigger for the feature being visible in the UI but by default will be blank for now.
2025-09-08 09:13:22 -06:00
cea4eaf081
Updated Assistant Mapping
2025-09-08 09:13:22 -06:00
b1753f86f9
New Message Structure
2025-09-08 09:13:22 -06:00
6323fbf46b
Content Object
2025-09-08 09:13:21 -06:00
ba601c39b3
Rough Go at New Mappings/Settings
2025-09-08 09:13:21 -06:00
ec27517bdd
New Config Values
...
New config values with annotations and defaults.
Updated Nginx config to allow streaming requests to not be buffered on the way to the client.
2025-09-08 09:13:08 -06:00
f318a84c18
Update so-elastic-fleet-reset
2025-09-08 09:03:33 -04:00
6c196ea61a
Merge branch '2.4/dev' into vlb2
2025-09-05 17:11:10 -04:00
4afc986f48
firewall and logstash pipeline for managerhype
2025-09-05 13:14:47 -04:00
348f9dcaec
prevent multiple script instances using file lock
2025-09-05 10:01:24 -05:00
915b9e7bd7
use logrotate
2025-09-05 09:22:44 -05:00
dfec29d18e
custom kquery
2025-09-04 15:37:28 -05:00
a007fa6505
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-09-03 09:52:49 -04:00
1a32a0897c
Merge remote-tracking branch 'origin/2.4/dev' into reyesj2/ea-alerter
2025-09-02 17:11:21 -05:00
e26310d172
elastic agent offline alerter
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-09-02 17:00:03 -05:00
df0b484b45
More Descriptive Description
...
Include instructions for how to add local lookups and a help link.
2025-09-02 15:07:13 -06:00
2181cddf49
Move EnableReverseLookup
...
Move EnableReverseLookup and it's annotation from ClientParams to ServerConfig.
2025-09-02 14:09:55 -06:00
a2b6968cef
Merge pull request #14975 from Security-Onion-Solutions/reyesj2/es8186
...
ES 8.18.6 upgrade
2025-09-02 10:14:33 -05:00
285fbc2783
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-09-02 09:23:24 -04:00
19362fe5e5
Update so-combine-bond
2025-08-29 11:06:25 -04:00
a7a81e9825
always manage script, only run it if bond0 exists
2025-08-29 11:05:42 -04:00
Josh Brower
reyesj2
Josh Patterson
Corey Ogburn
Matthew Wright
Jason Ertel
Mike Reeves