c2c5aea244
ensure bool sliders for each state:enabled annotation
2026-03-19 12:35:38 -04:00
74ad2990a7
Merge remote-tracking branch 'origin/3/dev' into delta
2026-03-18 13:05:02 -04:00
e19e83bebb
allow user defined ulimits
2026-03-18 10:38:15 -04:00
930985b770
update helpLink references for new documentation
2026-03-18 09:46:45 -04:00
2349750e13
DOCKER to DOCKERMERGED
2026-03-17 16:19:02 -04:00
00986dc2fd
Merge remote-tracking branch 'origin/delta' into customulimit
2026-03-17 16:04:09 -04:00
2d97dfc8a1
Add customizable ulimit settings for all Docker containers
...
Add ulimits as a configurable advanced setting for every container,
allowing customization through the web UI. Move hardcoded ulimits
from elasticsearch and zeek into defaults.yaml and fix elasticsearch
ulimits that were incorrectly nested under the environment key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-17 15:10:42 -04:00
4dc377c99f
DOCKER to DOCKERMERGED
2026-03-17 15:06:06 -04:00
94f454c311
cleanup file.absent
2026-03-16 15:57:15 -04:00
d381248e30
fix include
2026-01-20 16:27:37 -05:00
1234cbd04b
allow logstash.ssl on so-eval
2026-01-20 09:30:32 -05:00
00fbc1c259
add back individual signing policies
2026-01-12 09:25:15 -05:00
3bc552ef38
Merge remote-tracking branch 'origin/2.4/dev' into bravo
2026-01-08 17:15:48 -05:00
7977a020ac
elasticsearch 9.0.8
2025-12-16 16:03:47 -06:00
d518f75468
update deprecated config items
2025-12-11 20:07:06 -06:00
b9ff1704b0
the great ssl refactor
2025-12-11 17:30:06 -05:00
8773ebc3dc
logstash wrappers for troubleshooting
2025-10-14 13:34:33 -05:00
4afc986f48
firewall and logstash pipeline for managerhype
2025-09-05 13:14:47 -04:00
ed80c4e13b
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-04-23 15:42:04 -04:00
30c4acb828
group
2025-04-21 16:38:16 -05:00
4ec185a9c7
make logstash and kratos homedirs
2025-04-21 16:26:20 -05:00
f5a8e917a4
researching install failures
2025-04-21 14:32:33 -04:00
07ef3d632c
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-04-15 08:08:12 -04:00
c0f9c344bb
set logstash log rollover when log size exceeds 1G
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-04-14 08:13:27 -05:00
44a5b3b1e5
MANAGERHYPE setup is now complete!
2025-03-12 21:05:04 -04:00
dd17ee7665
fix defining custom logstash pipelines when kafka is enabled
2025-02-06 22:19:24 -06:00
4c5099d429
Initial support for local lookup
2024-10-29 10:27:54 -04:00
5fb660bc9a
remove kernel bool option, just use list
2024-10-17 09:29:03 -04:00
217bb388a0
Clarify enabled settings
2024-09-16 10:05:17 -04:00
8702d95434
only elasticsearch image uses es version
2024-09-09 16:38:38 -04:00
5a1d61a042
ref es version
2024-09-05 08:45:44 -04:00
cd9c9a25d3
reference elastic versions from defaults
2024-08-21 11:25:56 -04:00
7ea8d5efd0
Remove redis input pipeline from searchnodes when global pipeline is Kafka
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-07-12 14:44:10 -04:00
4182ff66a0
rearrange kafka pillar, declutters SOC ui
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-07-11 16:37:16 -04:00
d5faf535c3
Only interact with logstash configuration when Kafka pipeline is enabled otherwise leave it default
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-07-10 11:36:44 -04:00
8e1edd1d91
split Kafka ssl from ssl/init. Certs won't be generated until Kafka is enabled. Also runs some clean up for old Kafka certs
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-07-10 11:32:43 -04:00
d791b23838
Generate new Kafka truststore
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-07-10 11:29:09 -04:00
50f0c43212
merge dev
2024-06-26 12:33:32 -04:00
c332cd777c
remove import/heavynode artifact caused by kafka cert not existing but being bound in docker. (empty dir created)
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-06-24 08:50:37 -04:00
469ca44016
fix maps
2024-06-20 16:53:12 -04:00
81fcd68e9b
create and use redis:nodes and elasticsearch:nodes pillars
2024-06-20 16:42:11 -04:00
55f8303dc2
remove manager and search pipelines from heavynode
2024-06-17 10:06:43 -04:00
0b1175b46c
kafka logstash input plugin handle empty brokers list
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-06-14 23:03:36 -04:00
8080e05444
on fresh install kafka nodes pillar may not have populated. Avoiding this by only generating kafka input pipeline when kafka nodes pillar is not empty
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-06-14 14:17:26 -04:00
f372b0907b
Use kafka:password for kafka certs
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-06-12 15:41:10 -04:00
e8106befe9
Append '-securityonion' to all Security Onion related Kafka topics. Adjust logstash to ingest all topics ending in '-securityonion' to avoid having to manually list topic names
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-06-12 12:05:16 -04:00
b1beb617b3
Logstash should be disabled when Kafka is enabled except when a minion override exists OR node is a standalone
...
- Standalone subscribes to Kafka topics via logstash for ingest
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-05-22 13:38:09 -04:00
2ad87bf1fe
merge 2.4/dev
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-05-08 16:30:45 -04:00
eca2a4a9c8
Logstash consumer threads should match topic partition count
...
- Default is set to 3. If there are too many consumer threads it may lead to idle logstash worker threads and could require decreasing this value to saturate workers
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-05-08 16:17:09 -04:00
dcc1f656ee
predownload logstash and elastic for new searchnode and heavynode
2024-05-07 10:13:51 -04:00
Josh Patterson
Doug Burks
Mike Reeves
reyesj2
Jason Ertel
defensivedepth