230 Commits

Author	SHA1	Message	Date
Doug Burks	5f15320b9d	Update Hunt fields for firewall #1500	2020-10-10 07:54:48 -04:00
Doug Burks	8cfabf101c	Update Hunt query for firewall #1499	2020-10-10 07:17:49 -04:00
Doug Burks	2489ca608a	Improve Hunt FTP queries #1479	2020-10-08 05:30:17 -04:00
Doug Burks	a686704d37	remove rule.uuid now that underlying issue has been resolved	2020-10-06 09:39:57 -04:00
Doug Burks	a45aa43f41	Add trailing comma to "thehive" stanza	2020-10-05 12:35:33 -04:00
Jason Ertel	1ebe970876	Disable escalate button if thehive is not enabled	2020-10-05 09:54:18 -04:00
Doug Burks	e7cba6ba1d	Change SOC Alerts eventFetchLimit from 5000 to 500 #1447	2020-10-05 09:29:01 -04:00
Doug Burks	948e0c4c61	Add rule.name to Hunt Wazuh Alerts query #1442	2020-10-05 09:26:13 -04:00
Jason Ertel	cf5b1245ea	Add configurable flags to enable/disable dismiss and escalate buttons	2020-10-05 09:16:17 -04:00
Mike Reeves	c7fcdc8084	Merge pull request #1438 from Security-Onion-Solutions/socyaml ... Socyaml	2020-10-01 18:08:33 -04:00
Mike Reeves	4991ea8de3	Jason made me rename json	2020-10-01 18:07:06 -04:00
Mike Reeves	36ccece724	commas gone crazy	2020-10-01 18:02:06 -04:00
Mike Reeves	a0432e97b0	Python print ftl	2020-10-01 17:57:56 -04:00
Mike Reeves	490278a4c3	Add alert events filed	2020-10-01 17:49:17 -04:00
Mike Reeves	9d9d3aac53	Switch to JSON from yaml	2020-10-01 17:37:57 -04:00
Mike Reeves	744a8bca73	More json for soc	2020-10-01 17:30:23 -04:00
Mike Reeves	8a41636e7f	More json for soc	2020-10-01 17:28:45 -04:00
Mike Reeves	dc79dca7fe	More json for soc	2020-10-01 17:25:51 -04:00
Mike Reeves	1c55f738ec	More json for soc	2020-10-01 17:23:29 -04:00
Mike Reeves	92fa33159e	More json for soc	2020-10-01 17:12:08 -04:00
Mike Reeves	5730c85988	More json for soc	2020-10-01 17:04:15 -04:00
Mike Reeves	63be0734c9	More json for soc	2020-10-01 17:00:25 -04:00
Mike Reeves	5653828154	More json for soc	2020-10-01 16:57:04 -04:00
Jason Ertel	8e15ed56d6	'Escalated' filter toggle will auto-enable 'acknowledged' filter toggle	2020-10-01 16:23:47 -04:00
Mike Reeves	cc2f2de5b5	soc.json stuff	2020-10-01 15:23:07 -04:00
Mike Reeves	b423e8d22a	soc.json stuff	2020-10-01 15:20:13 -04:00
Mike Reeves	1a561f6b12	soc.json stuff	2020-10-01 15:18:34 -04:00
Doug Burks	e836f96c65	move rule.uuid after rule.name	2020-10-01 12:09:52 -04:00
Doug Burks	4851069a10	remove rule.gid from Alerts groupby since Wazuh and Playbook may not have that field	2020-10-01 11:51:40 -04:00
Doug Burks	bc19cce4c2	Acknowledging an alert may acknowledge more alerts than intended #1426	2020-10-01 10:00:54 -04:00
Doug Burks	26781de244	Add Strelka query to Hunt #1433	2020-10-01 06:59:36 -04:00
Jason Ertel	ff04bb507a	Remove default Elastalert rules to stop automated alerts from being sent to thehive	2020-09-30 15:06:54 -04:00
Doug Burks	60134829d5	Alerts - Drilldown should display rule.uuid #1416	2020-09-29 07:51:45 -04:00
Doug Burks	c7b43ac220	Update soc.json	2020-09-29 07:41:49 -04:00
Doug Burks	a7f24b62e6	Hunt - improve NIDS query and eventFields #1415	2020-09-29 07:34:44 -04:00
Doug Burks	6e9e4dc99c	Hunt third magnifying glass should group output by event.module and event.dataset #1407	2020-09-28 14:19:55 -04:00
Doug Burks	0516a9ddd5	Alerts page "Hunt for this field" action should quote field and group output #1406	2020-09-28 12:35:08 -04:00
Doug Burks	3904295137	Hunt - improve HTTP queries #1401	2020-09-27 08:04:28 -04:00
Doug Burks	aa7f927ffd	Hunt - improve x509 queries #1400	2020-09-27 07:17:46 -04:00
Jason Ertel	68f18da832	Add alert query toggle filters for ack'd and escalated alerts	2020-09-25 17:03:42 -04:00
Doug Burks	11b200e9c0	Hunt - remove SMTP fields #1397	2020-09-25 14:17:14 -04:00
Doug Burks	20a56d0831	Hunt - add network.community_id column to Events table for more data types #1396	2020-09-25 13:18:28 -04:00
Jason Ertel	c0be252f9f	SOC config adjustments for alerting	2020-09-24 16:37:27 -04:00
Doug Burks	62dbe425a6	Hunt - fix x509 eventFields #1387	2020-09-24 07:52:46 -04:00
Doug Burks	2b8b8e2f40	Hunt - fix file eventFields #1386	2020-09-24 07:44:28 -04:00
Doug Burks	60daacd6dc	Hunt - fix DHCP eventFields #1385	2020-09-24 07:34:29 -04:00
Jason Ertel	694635a38f	Add pivot to hunt as a new alerts quick action	2020-09-21 17:10:03 -04:00
Jason Ertel	8f4a6df53a	Add event.module to default alert query	2020-09-21 09:06:56 -04:00
Jason Ertel	fc51c2aef4	Group by community ID on second alert quick query	2020-09-19 08:39:01 -04:00
Jason Ertel	5b38acb64b	Add alerting configuration for soc container	2020-09-18 13:51:23 -04:00