CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-15 21:52:47 +01:00
Code Issues Packages Projects Releases Wiki Activity
9,759 Commits 28 Branches 119 Tags
2c66fa1883c70a3e36846ebb3a331b264a5b9136
Commit Graph

5826 Commits

Author SHA1 Message Date
weslambert
c83b63d0d8 Add .template extension to load template file 2022-03-08 20:53:16 -05:00
weslambert
8d9ddf5f1b Add .template extension to load template 2022-03-08 20:52:13 -05:00
weslambert
8115da358f Add .template extension to load template file 2022-03-08 20:51:50 -05:00
Doug Burks
b76c01ef53 Revert security_opt addition in telegraf init.sls 2022-03-08 18:27:15 -05:00
weslambert
65f998d6f7 Remove process.name.keyword for future-proofing 2022-03-08 12:44:51 -05:00
weslambert
406267a892 Add process.name.keyword 2022-03-08 12:42:34 -05:00
weslambert
d9c3160fbf Merge pull request #7465 from Security-Onion-Solutions/fix/kibana_saved_objects_load 
Kibana dashboard/saved objects loading improvements
 2022-03-08 12:22:55 -05:00
Wes Lambert
d392cb258c Switch Kibana state to kibana.so_savedobjects_defaults in top file 2022-03-08 16:59:48 +00:00
Wes Lambert
86e228b200 Add .template extension for future-proofing config files 2022-03-08 16:58:37 +00:00
Wes Lambert
a6fd1023b4 Fix criteria for successful execution 2022-03-08 16:57:26 +00:00
Wes Lambert
3f31f7fd41 Add .template extension to fix script behavior and not modify watched file 2022-03-08 16:43:43 +00:00
Jason Ertel
0cec5879bb Gracefully handle situations when another process is using the Kratos DB 2022-03-08 10:55:26 -05:00
Wes Lambert
28554164cd Remove drop file when securitySolution saved objects change 2022-03-08 14:39:23 +00:00
Wes Lambert
14dddd8649 Remove drop file when config saved objects change 2022-03-08 14:37:15 +00:00
Wes Lambert
c0f49f6fb0 Remove drop file when dashbaord saved objects change 2022-03-08 14:35:04 +00:00
Wes Lambert
d10d4acf9f Modify Kibana config load script to drop file if successfully executed 2022-03-08 14:33:15 +00:00
Doug Burks
104de2a3c9 Update init.sls to avoid telegraf apparmor issues 
See #2560
 2022-03-07 16:11:22 -05:00
Mike Reeves
fb59421f5b Merge pull request #7446 from Security-Onion-Solutions/fixpipelineload 
Only load pipelines on change
 2022-03-07 15:17:32 -05:00
Mike Reeves
4eb37fd5a9 Update init.sls 2022-03-07 15:09:36 -05:00
Wes Lambert
fa9be58b23 Specify index templates 2022-03-07 20:04:23 +00:00
Wes Lambert
647b316a96 Remove old ES index templates 
Signed-off-by: Wes Lambert <wlambertts@gmail.com>
 2022-03-07 20:02:45 +00:00
Mike Reeves
d33db6fb23 Only load pipelines on change 2022-03-07 14:25:46 -05:00
Wes Lambert
c549b20221 Add DTC client mappings 2022-03-07 18:36:26 +00:00
Mike Reeves
c67604590d Only load templates on change 2022-03-07 09:52:18 -05:00
Wes Lambert
33ba45472f Replace syslog facility and severity with label fields 2022-03-04 21:40:41 +00:00
weslambert
f71ccadb8a Change to label fields for Zeek syslog 2022-03-04 16:29:55 -05:00
weslambert
fc3273fa49 Change to label fields to comply with what's defined in Filebeat template 2022-03-04 16:29:01 -05:00
weslambert
254cf53c2f Increase clause count to 3500 2022-03-04 10:36:37 -05:00
Wes Lambert
ffae22beef Add DTC syslog mappings for .keyword and add refs to defaults.yml 2022-03-04 13:04:11 +00:00
Wes Lambert
1f71816ad7 Add keyword subfield for DTC winlog mappings 2022-03-03 14:54:30 +00:00
Wes Lambert
1c086e36da Add missing comma for file mappings 2022-03-03 13:49:54 +00:00
Wes Lambert
aa8d24b6cd Add DTC destination, source, and winlog mapping references to templates in defaults file 2022-03-03 13:42:20 +00:00
Wes Lambert
85979cbce8 Add file, process, and winlog mapping changes 2022-03-03 13:37:27 +00:00
Wes Lambert
8f97f09c9c Additional .keyword changes for host.hostname client.address, and event.action 2022-03-02 21:54:46 +00:00
Wes Lambert
3ee46e4c29 Add .keyword for destination/source geo.country_name 2022-03-02 21:50:03 +00:00
Wes Lambert
c5b16fdf3b Adjust field limit for now 2022-03-02 16:33:39 +00:00
Josh Brower
2ba72791aa Remove sigma regen cron 2022-03-02 10:31:15 -05:00
Wes Lambert
ab9b81ea39 Change match_only_text to text for mac in host mappings 2022-03-02 15:01:05 +00:00
Wes Lambert
ed620b93b7 Add custom analyzer definition to all SO/DTC mappings 2022-03-02 14:43:19 +00:00
Wes Lambert
27c8eaa630 Update all other mappings for .security where applicable 2022-03-02 14:39:23 +00:00
Wes Lambert
e925d435ff Update event, file, and host mappings to include .security 2022-03-02 14:33:52 +00:00
Wes Lambert
496b161253 Update ECS mappings to include .security 2022-03-02 14:27:36 +00:00
Wes Lambert
aae2fd1fbb Update DNS mappings to include .security 2022-03-02 14:27:15 +00:00
Wes Lambert
0b45cf7ae1 Update base mappings to include .security 2022-03-02 14:25:57 +00:00
Wes Lambert
d89af5f04f Update agent mappings to include .security 2022-03-02 14:25:14 +00:00
Wes Lambert
2d2ec45029 Modify base ECS mappings to include .security where possible, as well as custom analyzer definition 2022-03-02 14:19:36 +00:00
Wes Lambert
5489b8559d Revert "Switch from .security to match_only_text" 
This reverts commit f7862af934.
 2022-03-01 18:44:00 +00:00
Wes Lambert
2a9caccc7c Revert "Add additional .text subfield mappings" 
This reverts commit 61dadc6249.
 2022-03-01 18:43:24 +00:00
Wes Lambert
a290602a70 Revert syslog pipeline updates from Abe' PR for now 2022-03-01 15:31:07 +00:00
Wes Lambert
038dc49098 Temporarily increase field limit before trimming efforts 2022-03-01 15:06:28 +00:00