392 Commits

Author	SHA1	Message	Date
reyesj2	a81e4c3362	remove dash(-) from kafka.id ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-11 11:55:17 -04:00
reyesj2	08557ae287	kafka.id field should only be present when metadata for kafka exists ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-11 11:01:34 -04:00
reyesj2	3b0339a9b3	create kafka.id from kafka {partition}-{offset}-{timestamp} for tracking event ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-04 14:27:52 -04:00
Wes	2c635bce62	Set index for Suricata alerts	2024-05-30 17:02:31 +00:00
DefensiveDepth	8e7c487cb0	Fix strelka rule.uuid	2024-05-23 05:59:31 -04:00
weslambert	f4490fab58	Add rule.uuid for YARA matches	2024-05-21 17:05:39 -04:00
reyesj2	fadb6e2aa9	Re-add original timestamp format + ignore failures with this processor ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:57:48 -04:00
reyesj2	192d91565d	Update final pipeline timestamp format for event.module system events ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:34:29 -04:00
reyesj2	55cf90f477	merge 2.4/dev ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 14:44:59 -04:00
reyesj2	fd689a4607	Fix typo in ingest pipeline ... Test to fix duplicate events in SOC, by removing conflicting field event.created Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 11:18:04 -04:00
reyesj2	7124f04138	Update ingest pipelines to match updated mappings ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-10 16:13:06 -04:00
DefensiveDepth	376efab40c	Ship Defender logs	2024-04-08 14:01:38 -04:00
reyesj2	000d15a53c	Kismet integration: TODO Elasticsearch mappings ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-03-29 13:56:01 -04:00
weslambert	df058b3f4a	Merge branch '2.4/dev' into feature/pfsense_suricata	2024-03-25 10:08:03 -04:00
Wes	5e21da443f	Minor verbiage updates	2024-03-25 13:58:32 +00:00
weslambert	4e1543b6a8	Get only code	2024-03-22 09:56:21 -04:00
Wes	5934829e0d	Include pfsense config	2024-03-21 20:08:33 +00:00
Wes	486a633dfe	Add pfsense Suricata config	2024-03-21 20:07:59 +00:00
Wes	d23d367058	Make scan.pe.flags a string	2024-01-24 15:08:38 +00:00
Wes	80a3942245	Rename RITA pipelines	2024-01-22 20:15:48 +00:00
Mike Reeves	efe8cfda95	Update suricata.common	2024-01-19 13:39:28 -05:00
Mike Reeves	08486e279c	Update suricata.common	2024-01-19 13:36:43 -05:00
Wes	e70ce50912	Change description	2024-01-17 14:06:16 +00:00
Wes	f6590ac0bf	Remove Suricata IKEv2 pipeline	2024-01-16 18:10:00 +00:00
Wes	ea64ce92d3	Add Suricata IKE pipeline	2024-01-16 18:09:46 +00:00
Wes	8a92b023b2	Add interface name	2024-01-16 18:09:16 +00:00
Josh Brower	5513e74807	comma	2024-01-09 08:12:33 -05:00
Josh Brower	31ee365a91	Fixup FIM events	2024-01-09 08:11:05 -05:00
Doug Burks	6a1073b616	FIX: Update dashboard and hunt query for firewall logs #12021	2023-12-18 12:57:40 -05:00
Doug Burks	93fb10de86	Merge pull request #11897 from Security-Onion-Solutions/2.4/nids-rule-reference ... FIX: Update NIDS rule.reference in common.nids pipeline #11846	2023-11-29 12:19:12 -05:00
weslambert	9d63a47792	Certificate hash	2023-11-29 12:01:43 -05:00
weslambert	7001e90667	Client and server fingerprints	2023-11-29 12:00:46 -05:00
Doug Burks	0603e96c08	FIX: Update NIDS rule.reference in common.nids pipeline #11846	2023-11-29 09:46:11 -05:00
Wes	ae45d40eca	Add Sublime Platform ingest pipeline	2023-11-01 13:34:30 +00:00
weslambert	660020cc76	Parse pkt_src for Suricata logs	2023-10-23 15:45:41 -04:00
Wes	508260bd46	Use event.created for timestamp	2023-09-19 13:32:03 +00:00
Wes	1a3b3b21fb	Change entropy value syntax	2023-08-31 15:09:19 +00:00
Wes	7971d9749a	Assign pipeline to import	2023-08-17 14:08:48 +00:00
Josh Brower	dd1fa51eb5	Generate community_id for defend endpoint logs	2023-08-04 09:03:17 -04:00
weslambert	f102351052	Add event	2023-08-02 13:25:44 -04:00
weslambert	ac28f90af3	Remove override	2023-08-02 13:15:11 -04:00
Josh Brower	4f94d953c9	Merge remote-tracking branch 'origin/2.4/dev' into fix/elasticsearch_endpoint	2023-07-25 07:42:59 -04:00
Wes	5553be02ac	Change how tags are added	2023-07-24 21:31:28 +00:00
Josh Brower	741e6039c1	Cleanup for Sigma Rules	2023-07-24 09:25:58 -04:00
Wes	e3249c8e4c	Wrap values in quotes for proper conversion	2023-07-13 14:18:57 +00:00
weslambert	85bb5a327c	Fix long vs float for pe version	2023-07-13 09:38:09 -04:00
Wes	577bfac886	Update logic for YARA matches	2023-07-11 17:00:13 +00:00
weslambert	7e37cd0f05	Parse xff	2023-06-21 14:29:54 -04:00
Wes	3a34da354f	Use append instead of set	2023-06-15 16:35:43 +00:00
Wes	58a63e0765	Remove extra comma	2023-06-15 14:22:37 +00:00