216 Commits

Author	SHA1	Message	Date
Mike Reeves	621e5c1cf8	Enable Filebeat Stats	2021-04-13 19:18:10 -04:00
Mike Reeves	18203513ab	Update cert location for eval.import	2021-03-10 09:14:14 -05:00
Mike Reeves	1ecb079066	Fix Kibana Script for loading dashboards	2021-03-08 17:36:07 -05:00
Mike Reeves	bf4ac2a312	Fix some merge conflicts	2021-03-08 11:43:24 -05:00
Mike Reeves	a0a8d12526	Enable SSL and Features	2021-03-04 10:08:28 -05:00
Mike Reeves	4f867e5375	Fix all scripts for ssl elastic	2021-03-03 10:02:23 -05:00
Mike Reeves	3219f4cd12	Remove Features Option	2021-03-02 11:04:50 -05:00
Jason Ertel	58e4205602	Revert "Make filebeat retry forever"	2021-02-03 21:46:29 -05:00
Mike Reeves	55a8f6aa7a	Make filebeat retry forever	2021-02-02 16:41:52 -05:00
Mike Reeves	4212afe0c9	Add features option back	2021-01-30 19:57:18 -05:00
Mike Reeves	4ef38f8d04	Add EPS and RAID status collection for telegraf	2021-01-25 19:14:46 -05:00
Mike Reeves	636687ac59	Merge pull request #2702 from Security-Onion-Solutions/essecurity ... SSL with Elastic Basic license. Remove features option.	2021-01-21 13:57:28 -05:00
Mike Reeves	9408d62c65	Remove features	2021-01-21 13:55:53 -05:00
Wes Lambert	19d22e1f8a	Allow for Filebeat queue/output adjustments via pillar	2021-01-21 15:34:54 +00:00
m0duspwnens	b693373d8d	change how we allow or disallow states to be run https://github.com/Security-Onion-Solutions/securityonion/issues/2679	2021-01-20 15:09:53 -05:00
weslambert	6b4af30fc1	Change clean_removed to true cleanup tracking of Zeek logs removed from current	2020-11-18 13:47:32 -05:00
m0duspwnens	1fca5e65df	redo how containers get added to so-status https://github.com/Security-Onion-Solutions/securityonion/issues/1681	2020-11-10 15:31:47 -05:00
William Wernert	6169758f4e	[fix] 0 -> root so file owner is set correctly	2020-11-03 16:47:59 -05:00
m0duspwnens	10e4248cfc	and node that gets filebeat state now can listen for syslog - https://github.com/Security-Onion-Solutions/securityonion/issues/1551	2020-10-19 16:10:20 -04:00
m0duspwnens	79854f111e	add 514 tcp listener to filebeat docker and add syslog listener to fb config for manager and manager search - https://github.com/Security-Onion-Solutions/securityonion/issues/1551	2020-10-19 10:27:40 -04:00
Doug Burks	a106913d1a	Heavy node filebeat needs extra_hosts for the heavy node itself #1521	2020-10-14 09:51:59 -04:00
Wes Lambert	4fc4913d1e	Don't predefine index date for Filebeat ES outputs	2020-10-12 15:44:00 +00:00
Wes Lambert	1970d95d5f	Make Filebeat registry persistent to avoid re-reading old data	2020-10-05 13:30:04 +00:00
Wes Lambert	d8f70397f7	Fix Filebeat config for Wazuh	2020-09-30 14:57:56 +00:00
Mike Reeves	0a0e00866c	Upgrade Fun	2020-09-14 14:50:22 -04:00
m0duspwnens	09cc8ae1fb	fail the state if it isnt in top	2020-09-09 16:48:50 -04:00
m0duspwnens	a229ae82ce	only allow state to run if it is in top for the node	2020-09-02 16:15:52 -04:00
Mike Reeves	f9e5ea8ba7	Fix SSL for filebeat	2020-08-19 21:12:41 -04:00
m0duspwnens	dbe14fcbdb	Merge remote-tracking branch 'remotes/origin/dev' into issue/1049	2020-08-12 16:46:03 -04:00
m0duspwnens	0f53b4d703	set esheapsize and filebeat config for import node	2020-08-12 10:39:31 -04:00
Mike Reeves	92cc176b6d	Fix features logic in all states that use it	2020-08-10 20:59:41 -04:00
Mike Reeves	24ed92c9dc	minio and change to global	2020-08-04 15:54:03 -04:00
Wes Lambert	958ee25f6d	Move Wazuh from /opt/so/ to /nsm/wazuh	2020-07-27 11:58:12 +00:00
m0duspwnens	e3efaee864	change reference from bro to zeek	2020-07-17 14:41:44 -04:00
Jason Ertel	9dc1151347	Imported logs are sent to so-import index on eval installations	2020-07-14 22:59:42 -04:00
Jason Ertel	8f66a27f07	Refactor image repository to a single variable	2020-07-13 18:26:43 -04:00
m0duspwnens	13af4cacb0	merge with dev and resolve conflicts	2020-07-10 16:27:10 -04:00
Mike Reeves	46d572fa8c	Fix Filebeat spacing	2020-07-10 15:51:12 -04:00
Mike Reeves	5eb33d5ac7	Logstash Import and Template Assignment	2020-07-10 13:53:55 -04:00
m0duspwnens	9c2dcd2318	fix reference to master grain	2020-07-09 17:06:44 -04:00
m0duspwnens	5ca3ecf4bd	fix reference to master grain	2020-07-09 15:42:39 -04:00
m0duspwnens	3cf31e2460	https://github.com/Security-Onion-Solutions/securityonion/issues/404	2020-07-09 11:27:06 -04:00
m0duspwnens	5f68542241	add pillar example for filebeat inputs/output	2020-07-08 09:52:25 -04:00
m0duspwnens	fff713db85	changes for https://github.com/Security-Onion-Solutions/securityonion/issues/825	2020-07-07 15:48:47 -04:00
Wes Lambert	2fdd5fd77b	Fix pillar reference for Strelka/FB	2020-07-07 13:46:57 +00:00
Jason Ertel	96e93b012d	Adjust imports for filebeat configuration to ensure import data is placed into ES	2020-07-01 17:18:01 -04:00
Jason Ertel	d6feafb12a	Correct indentation in filebeat.yaml	2020-07-01 15:39:23 -04:00
Jason Ertel	a3deb868ad	Improve filebeat config indentation	2020-06-30 14:57:34 -04:00
Jason Ertel	930f15eea5	Introduce so-import-pcap tool - WIP	2020-06-30 14:56:08 -04:00
Mike Reeves	79adf2012a	Fix log rotate on Suricata	2020-06-04 10:43:24 -04:00