  Josh BrowerandGitHub
|
47dc911b79
|
Merge pull request #12964 from Security-Onion-Solutions/2.4/agstrelka
remove old yara airgap code
|
2024-05-08 08:45:16 -04:00 |
|
|
DefensiveDepth
|
6d2ecce9b7
|
remove old yara airgap code
|
2024-05-08 08:43:37 -04:00 |
|
|
Josh BrowerandGitHub
|
b997e44715
|
Merge pull request #12939 from Security-Onion-Solutions/2.4/detections-airgap
Initial airgap support for detections
|
2024-05-06 15:46:29 -04:00 |
|
|
DefensiveDepth
|
be1758aea7
|
Fix license and folder
|
2024-05-06 12:22:44 -04:00 |
|
|
DefensiveDepth
|
26c6a98b45
|
Initial airgap support for detections
|
2024-05-06 08:43:01 -04:00 |
|
|
Josh BrowerandGitHub
|
6d5ff59657
|
Merge pull request #12929 from Security-Onion-Solutions/2.4/verifyexclude
Exclude new sigma rules
|
2024-05-03 15:38:25 -04:00 |
|
|
DefensiveDepth
|
7f12d4c815
|
Exclude new sigma rules
|
2024-05-03 15:22:53 -04:00 |
|
|
Josh BrowerandGitHub
|
13ccb58f84
|
Merge pull request #12876 from Security-Onion-Solutions/2.4/sigmafix
Sigma pivot fix and cleanup
|
2024-04-29 09:12:09 -04:00 |
|
|
DefensiveDepth
|
f2c3c928fc
|
Sigma pivot fix and cleanup
|
2024-04-29 08:49:05 -04:00 |
|
|
Josh BrowerandGitHub
|
d88c1a5e0a
|
Merge pull request #12861 from Security-Onion-Solutions/2.4/detectionlogs
Add runtime status logs
|
2024-04-24 20:07:32 -04:00 |
|
|
DefensiveDepth
|
3c3ed8b5c5
|
Add runtime status logs
|
2024-04-24 16:33:47 -04:00 |
|
|
Josh BrowerandGitHub
|
fc1c41e5a4
|
Merge pull request #12841 from Security-Onion-Solutions/2.4/logfix
Temp exclude yara runtime status log
|
2024-04-23 07:36:02 -04:00 |
|
|
DefensiveDepth
|
58ddd55123
|
Exclude yara runtime log
|
2024-04-23 07:28:07 -04:00 |
|
|
Josh BrowerandGitHub
|
64c43b1a55
|
Merge pull request #12805 from Security-Onion-Solutions/2.4/detectiondefaults
Strelka fixes and more
|
2024-04-19 16:53:07 -04:00 |
|
|
DefensiveDepth
|
a237ef5d96
|
Update default queries
|
2024-04-19 16:33:35 -04:00 |
|
|
DefensiveDepth
|
6c6647629c
|
Refactor yara for compilation
|
2024-04-18 11:32:17 -04:00 |
|
|
DefensiveDepth
|
ff28476191
|
Fix compile_yara path
|
2024-04-16 13:10:17 -04:00 |
|
|
DefensiveDepth
|
8cc4d2668e
|
Move compile_yara
|
2024-04-16 12:52:14 -04:00 |
|
|
DefensiveDepth
|
dbfb178556
|
Add test
|
2024-04-16 12:22:53 -04:00 |
|
|
Josh BrowerandGitHub
|
5e8b16569f
|
Merge pull request #12793 from Security-Onion-Solutions/2.4/detectiondefaults
Add docs for ruleset change
|
2024-04-12 13:54:06 -04:00 |
|
|
DefensiveDepth
|
f5e42e73af
|
Add docs for ruleset change
|
2024-04-12 13:30:20 -04:00 |
|
|
Josh BrowerandGitHub
|
5b81a73e58
|
Merge pull request #12791 from Security-Onion-Solutions/2.4/detectiondefaults
Fix fingerprint paths
|
2024-04-12 09:01:38 -04:00 |
|
|
DefensiveDepth
|
49ccd86c39
|
Fix fingerprint paths
|
2024-04-12 08:35:44 -04:00 |
|
|
Josh BrowerandGitHub
|
ae09869417
|
Merge pull request #12780 from Security-Onion-Solutions/2.4/detectiondefaults
Enable Detections Adv by default
|
2024-04-11 09:32:34 -04:00 |
|
|
DefensiveDepth
|
1c5f02ade2
|
Update annotations
|
2024-04-11 09:21:08 -04:00 |
|
|
DefensiveDepth
|
ed97aa4e78
|
Enable Detections Adv by default
|
2024-04-11 08:21:20 -04:00 |
|
|
Josh BrowerandGitHub
|
b9474b9352
|
Merge pull request #12766 from Security-Onion-Solutions/2.4/sigma-pipeline
Ship Defender logs + more
|
2024-04-08 16:35:24 -04:00 |
|
|
DefensiveDepth
|
376efab40c
|
Ship Defender logs
|
2024-04-08 14:01:38 -04:00 |
|
|
Josh BrowerandGitHub
|
8e38c3763e
|
Merge pull request #12756 from Security-Onion-Solutions/2.4/detections-defaults
Use list not string
|
2024-04-04 17:00:38 -04:00 |
|
|
DefensiveDepth
|
ca807bd6bd
|
Use list not string
|
2024-04-04 16:58:39 -04:00 |
|
|
Josh BrowerandGitHub
|
f72cbd5f23
|
Merge pull request #12755 from Security-Onion-Solutions/2.4/detections-defaults
2.4/detections defaults
|
2024-04-04 11:33:59 -04:00 |
|
|
Josh BrowerandGitHub
|
1d7e47f589
|
Merge pull request #12682 from Security-Onion-Solutions/2.4/soup-playbook
2.4/soup playbook
|
2024-04-04 11:28:09 -04:00 |
|
|
DefensiveDepth
|
49d5fa95a2
|
Detections tweaks
|
2024-04-04 11:26:44 -04:00 |
|
|
DefensiveDepth
|
c2f7f7e3a5
|
Remove dup line
|
2024-04-04 08:52:30 -04:00 |
|
|
DefensiveDepth
|
07cb0c7d46
|
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/soup-playbook
|
2024-04-04 08:51:09 -04:00 |
|
|
Josh BrowerandGitHub
|
1017838cfc
|
Merge pull request #12748 from Security-Onion-Solutions/2.4/exclude-elastalert
Exclude Elastalert EQL errors
|
2024-04-04 06:57:22 -04:00 |
|
|
DefensiveDepth
|
1d221a574b
|
Exclude Elastalert EQL errors
|
2024-04-04 06:48:25 -04:00 |
|
|
DefensiveDepth
|
f66cca96ce
|
YARA casing
|
2024-04-03 16:17:29 -04:00 |
|
|
Josh BrowerandGitHub
|
fbdcc53fe0
|
Merge pull request #12732 from Security-Onion-Solutions/2.4/detections-defaults
Feature - auto-enabled Sigma rules
|
2024-04-03 09:01:09 -04:00 |
|
|
DefensiveDepth
|
a8f25150f6
|
Feature - auto-enabled Sigma rules
|
2024-04-03 08:21:50 -04:00 |
|
|
Josh BrowerandGitHub
|
1001aa665d
|
Merge pull request #12720 from Security-Onion-Solutions/2.4/detections-defaults
Add default columns
|
2024-04-02 09:21:06 -04:00 |
|
|
DefensiveDepth
|
7f488422b0
|
Add default columns
|
2024-04-02 09:13:27 -04:00 |
|
|
DefensiveDepth
|
32b8649c77
|
Add more error checking
|
2024-03-28 14:31:02 -04:00 |
|
|
DefensiveDepth
|
9c5ba92589
|
Check if container is running first
|
2024-03-28 13:23:40 -04:00 |
|
|
DefensiveDepth
|
d2c9e0ea4a
|
Cleanup
|
2024-03-28 13:04:48 -04:00 |
|
|
DefensiveDepth
|
ce0c9f846d
|
Remove containers from so-status
|
2024-03-27 16:13:52 -04:00 |
|
|
DefensiveDepth
|
ba262ee01a
|
Check to see if Playbook is enabled
|
2024-03-27 15:43:25 -04:00 |
|
|
DefensiveDepth
|
b571eeb8e6
|
Initial cut of .70 soup changes
|
2024-03-27 14:58:16 -04:00 |
|
|
Josh BrowerandGitHub
|
63a58efba4
|
Merge pull request #12656 from Security-Onion-Solutions/2.4/detections-fixes
Add bindings for sigma repos
|
2024-03-26 09:33:38 -04:00 |
|
|
DefensiveDepth
|
bbcd3116f7
|
Fixes
|
2024-03-26 09:31:46 -04:00 |
|
|
Josh BrowerandGitHub
|
9c12aa261e
|
Merge pull request #12660 from Security-Onion-Solutions/kilo
Initial cut to remove Playbook and deps
|
2024-03-26 08:31:11 -04:00 |
|
|
DefensiveDepth
|
cc0f4847ba
|
Casing and validation
|
2024-03-26 08:10:57 -04:00 |
|
|
DefensiveDepth
|
7c4ea8a58e
|
Add Detections SOC Config
|
2024-03-26 07:39:39 -04:00 |
|
|
Josh BrowerandGitHub
|
f0cb30a649
|
Merge pull request #12659 from Security-Onion-Solutions/2.4/remove-playbook
Remove Playbook ref
|
2024-03-25 21:12:22 -04:00 |
|
|
DefensiveDepth
|
94ee761207
|
Remove Playbook ref
|
2024-03-25 21:11:47 -04:00 |
|
|
Josh BrowerandGitHub
|
0a5dc411d0
|
Merge pull request #12658 from Security-Onion-Solutions/2.4/remove-playbook
Initial cut to remove Playbook and deps
|
2024-03-25 19:45:51 -04:00 |
|
|
DefensiveDepth
|
d7ecad4333
|
Initial cut to remove Playbook and deps
|
2024-03-25 19:42:31 -04:00 |
|
|
DefensiveDepth
|
49fa800b2b
|
Add bindings for sigma repos
|
2024-03-25 14:45:50 -04:00 |
|
|
Josh BrowerandGitHub
|
b8d33ab983
|
Merge pull request #12639 from Security-Onion-Solutions/2.4/enable-detections
Enable Detections
|
2024-03-25 09:30:01 -04:00 |
|
|
DefensiveDepth
|
5ca9ec4b17
|
Enable Detections
|
2024-03-22 10:12:26 -04:00 |
|
|
Josh BrowerandGitHub
|
4b03d088c3
|
Merge pull request #12611 from Security-Onion-Solutions/2.4/enable-detections
Change Detections defaults
|
2024-03-21 08:04:03 -04:00 |
|
|
DefensiveDepth
|
4a33234c34
|
Default update to 24 hours
|
2024-03-21 07:26:19 -04:00 |
|
|
DefensiveDepth
|
d84af803a6
|
Enable Autoupdates
|
2024-03-20 08:48:31 -04:00 |
|
|
DefensiveDepth
|
020eb47026
|
Change Detections defaults
|
2024-03-19 13:53:37 -04:00 |
|
|
Josh BrowerandGitHub
|
dc3eace718
|
Merge pull request #12576 from Security-Onion-Solutions/2.4/regenpackages
Gen packages post-SOUP
|
2024-03-13 07:53:08 -04:00 |
|
|
DefensiveDepth
|
06013e2c6f
|
Gen packages post-SOUP
|
2024-03-13 07:23:43 -04:00 |
|
|
Josh BrowerandGitHub
|
197791f8ed
|
Merge pull request #12565 from Security-Onion-Solutions/2.4/detections-defaults
2.4/detections defaults
|
2024-03-12 06:17:30 -04:00 |
|
|
DefensiveDepth
|
0f41f07dc9
|
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/detections-defaults
|
2024-03-11 16:41:26 -04:00 |
|
|
Josh BrowerandGitHub
|
47ab1f5b95
|
Merge pull request #12563 from Security-Onion-Solutions/kilo
Add yara update back
|
2024-03-11 16:39:31 -04:00 |
|
|
DefensiveDepth
|
61a183b7fc
|
Add regex defaults
|
2024-03-11 15:55:39 -04:00 |
|
|
Josh Brower
|
4a9e8265ce
|
Merge remote-tracking branch 'origin/2.4/dev' into kilo
|
2024-03-08 14:48:04 -05:00 |
|
|
Josh BrowerandGitHub
|
9e671621db
|
Merge pull request #12510 from Security-Onion-Solutions/2.4/excludedetections
Add Exclusion toggle
|
2024-03-06 10:56:29 -05:00 |
|
|
Josh Brower
|
1b47537a3f
|
Add Exclusion toggle
|
2024-03-06 07:16:50 -05:00 |
|
|
Josh BrowerandGitHub
|
9fd1653914
|
Merge pull request #12487 from Security-Onion-Solutions/2.4/elastic-agent-fim
Fix FIM
|
2024-03-04 07:41:36 -05:00 |
|
|
Josh Brower
|
f28f269bb1
|
Fix FIM
|
2024-03-04 07:38:32 -05:00 |
|
|
Josh BrowerandGitHub
|
f3dce66f03
|
Merge pull request #12482 from Security-Onion-Solutions/2.4/sigma-pipeline
2.4/sigma pipeline
|
2024-03-01 15:29:13 -05:00 |
|
|
Josh Brower
|
d832158cc5
|
Drop Hashes field
|
2024-03-01 15:26:02 -05:00 |
|
|
Josh Brower
|
b017157d21
|
Add antivirus mapping
|
2024-03-01 14:04:56 -05:00 |
|
|
Josh BrowerandGitHub
|
aa3b917368
|
Merge pull request #12456 from Security-Onion-Solutions/feature/detections-airgap
Feature/detections airgap
|
2024-02-28 09:41:13 -05:00 |
|
|
Josh Brower
|
e2dd0f8cf1
|
Only update rule files if AG
|
2024-02-28 09:39:23 -05:00 |
|
|
Josh Brower
|
59af547838
|
Fix download location
|
2024-02-27 09:49:54 -05:00 |
|
|
Josh BrowerandGitHub
|
a817bae1e5
|
Merge pull request #12437 from Security-Onion-Solutions/feature/detections-airgap
Airgap Support - Detections module
|
2024-02-26 16:47:26 -05:00 |
|
|
Josh Brower
|
c6baa4be1b
|
Airgap Support - Detections module
|
2024-02-26 16:19:32 -05:00 |
|
|
Josh BrowerandGitHub
|
66b815d4b2
|
Merge pull request #12431 from Security-Onion-Solutions/feature/brower-detections
Add Detection AutoUpdate config
|
2024-02-26 08:43:33 -05:00 |
|
|
Josh Brower
|
a6bb7216f9
|
Add Detection AutoUpdate config
|
2024-02-26 08:18:42 -05:00 |
|
|
Josh BrowerandGitHub
|
77cb5748f6
|
Merge pull request #12430 from Security-Onion-Solutions/feature/sigma-pipeline
Feature/sigma pipeline
|
2024-02-26 08:00:00 -05:00 |
|
|
Josh Brower
|
d04aa06455
|
Fix source.ip
|
2024-02-22 14:01:02 -05:00 |
|
|
Josh Brower
|
c886e72793
|
Imphash mappings
|
2024-02-22 08:59:33 -05:00 |
|
|
Josh Brower
|
0a9022ba6a
|
Add hash mappings
|
2024-02-21 17:07:08 -05:00 |
|
|
Josh BrowerandGitHub
|
927ea0c9ec
|
Update VERSION
|
2024-02-21 15:56:12 -05:00 |
|
|
Josh Brower
|
1952f0f232
|
Merge remote-tracking branch 'origin/2.4/dev' into kilo
|
2024-02-21 13:11:49 -05:00 |
|
|
Josh Brower
|
ffb3cc87b7
|
Default ruleset; Descriptions
|
2024-02-16 11:55:10 -05:00 |
|
|
Josh Brower
|
e4dcb4a8dd
|
Merge remote-tracking branch 'origin/cogburn/detection_playbooks' into kilo
|
2024-02-15 17:50:37 -05:00 |
|
|
Josh Brower
|
686304f24a
|
Merge remote-tracking branch 'origin/2.4/dev' into kilo
|
2024-02-15 09:47:51 -05:00 |
|
|
Josh Brower
|
0c6c6ba2d5
|
Various UI tweaks
|
2024-02-13 13:38:43 -05:00 |
|
|
Josh Brower
|
ea80469c2d
|
Detection Default queries
|
2024-02-12 19:39:55 -05:00 |
|
|
Josh BrowerandGitHub
|
64726a2785
|
Merge pull request #12349 from Security-Onion-Solutions/2.4/conflictingfix
Fix conflicting id
|
2024-02-12 19:07:07 -05:00 |
|
|
Josh BrowerandGitHub
|
ccb14485a3
|
Fix conflicting id
|
2024-02-12 19:06:19 -05:00 |
|
|
Josh Brower
|
5102269440
|
Update defaults
|
2024-02-12 16:44:54 -05:00 |
|
|
Josh BrowerandGitHub
|
c04f5a3f0f
|
Merge pull request #12268 from Security-Onion-Solutions/feature/fleet-artifacts
Feature/fleet artifacts
|
2024-02-12 08:58:14 -05:00 |
|