777 Commits

Author	SHA1	Message	Date
Mike Reeves	2cb6f0f1e6	Add curator settings	2023-03-27 12:30:39 -04:00
Mike Reeves	e38b0313c7	Merge pull request #9994 from Security-Onion-Solutions/hotones ... Switch up elastic roles	2023-03-23 16:59:49 -04:00
Josh Brower	bad905f54c	SOC Logs & Hunt Query	2023-03-23 16:22:59 -04:00
Mike Reeves	90159f4bcd	Switch up elastic roles	2023-03-23 15:09:40 -04:00
weslambert	0a9a064648	Remove node attrs configuration since node roles will be used	2023-03-23 13:45:51 -04:00
Wes	84360aa9bf	Set replicas for Osquery manager indices to 0	2023-03-22 21:47:49 +00:00
Wes	3fba27a0d4	Ensure component template files are in the correct directory	2023-03-22 20:45:33 +00:00
Wes	28f5dcd43b	Add managed generic Elastic Agent log component templates	2023-03-22 19:57:46 +00:00
Wes	eaaa028999	Update Elastic Agent template settings	2023-03-22 19:52:13 +00:00
Mike Reeves	d2bc5e4af2	Update config.map.jinja	2023-03-22 15:45:51 -04:00
weslambert	6d87620c6a	Explicitly set 'event.dataset' as 'file'	2023-03-22 11:04:18 -04:00
Mike Reeves	5fc297b8c1	Change Elastic Logic	2023-03-21 16:52:08 -04:00
Jason Ertel	ca363053e6	Merge pull request #9975 from Security-Onion-Solutions/kilo ... catch errors and exit with proper exit code	2023-03-21 10:51:36 -04:00
Jason Ertel	efd5f7b8a2	catch errors and exit with proper exit code	2023-03-21 10:44:21 -04:00
Mike Reeves	41554e8311	Merge pull request #9969 from Security-Onion-Solutions/guifixes ... Add several annotations	2023-03-21 08:51:53 -04:00
Mike Reeves	444988f287	Adjust annotations	2023-03-21 08:48:02 -04:00
Josh Brower	df036206a8	Fix Kratos parsing	2023-03-20 16:53:25 -04:00
Mike Reeves	22c3a4d398	Adjust elasticsearch annotations	2023-03-20 16:08:26 -04:00
Josh Brower	f7be4ba31c	Remove host field from NIDS logs	2023-03-13 14:07:17 -04:00
Wes	e105e56fac	Move data stream configuration outside of ILM policy definition	2023-03-13 13:27:02 +00:00
weslambert	16d9478196	Add index lifecycle management policy definitions for default Elastic Agent data streams	2023-03-10 16:54:47 -05:00
Doug Burks	19ab2a5a46	rename suricata vlan field to network.vlan.id	2023-03-05 05:57:52 -05:00
Doug Burks	9940a36722	update Elasticsearch ingest for Zeek conn vlan field	2023-03-03 15:22:43 -05:00
weslambert	134caa7f58	Various adjustments to descriptions	2023-02-28 16:31:16 -05:00
weslambert	acda03ce40	Add annotation settings for Elasticsearch's ILM feature, and remove various index keys	2023-02-10 14:57:11 -05:00
Wes	1255c60317	Move policy load script into Elasticsearch state script directory	2023-02-10 18:59:45 +00:00
Wes	994eabae1b	Manage policy loading in Elasticsearch state	2023-02-10 18:57:19 +00:00
Wes	c9118699a9	Add index management lifecycle policy defintion and reference in index template	2023-02-10 15:10:30 +00:00
m0duspwnens	a37f0fd0c0	rename sosbridge to sobridge	2023-02-03 10:07:07 -05:00
m0duspwnens	8cbafb52d8	Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/firewall	2023-01-31 13:32:51 -05:00
m0duspwnens	e09a86dc30	2.4 searchnode es config	2023-01-31 10:54:40 -05:00
Doug Burks	a44d83d69b	Improve Suricata DHCP parsing and dashboard	2023-01-31 08:33:38 -05:00
weslambert	0436f885b8	Set values for '@timestamp' and 'event.ingested'	2023-01-31 08:04:49 -05:00
weslambert	2772b03dca	Change event.dataset value from 'tunnels' to 'tunnel'	2023-01-27 11:03:49 -05:00
weslambert	716ec7f936	Change event.dataset value from 'files' to 'file'	2023-01-27 11:02:44 -05:00
Wes	f1db1bc273	Ensure Kratos events are sent to a data stream instead of an index	2023-01-26 16:12:06 +00:00
weslambert	c9f458e1e2	Set event.dataset for all Kratos logs to 'access' for now	2023-01-25 08:19:50 -05:00
Wes	4b9c92c53d	Set RITA event.dataset value explicitly	2023-01-24 18:00:34 +00:00
Wes	f19cf75311	Change how event.dataset is determined for Suricata events	2023-01-24 14:45:00 +00:00
Wes	51692ac66c	Update index pattern in various template definitions to match new data stream naming convention	2023-01-23 21:52:44 +00:00
Wes	40c6b380df	Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.	2023-01-23 21:44:46 +00:00
weslambert	7d3f6121eb	Remove default "logs-*" template settings for now	2023-01-19 10:29:10 -05:00
weslambert	7a499c9051	Modify default 'logs-*' template priority	2023-01-18 17:24:07 -05:00
weslambert	73a4dae28e	Make sure Elastic Agent data streams do not use replicas	2023-01-13 16:10:44 -05:00
Josh Patterson	3efca0010a	Merge pull request #9573 from Security-Onion-Solutions/2.4/firewall ... 2.4/firewall	2023-01-13 12:41:58 -05:00
m0duspwnens	6033e9a0de	use port_bindings from docker defaults in docker states	2023-01-13 10:15:10 -05:00
weslambert	7cba5626b7	Merge pull request #9570 from Security-Onion-Solutions/fix/elasticsearch_templates_elastic_agent ... Change priority for Elastic Agent Elasticsearch index templates	2023-01-12 16:48:12 -05:00
weslambert	654d869e3e	Change priority from 500 to 200 for Elastic Agent index templates to avoid collisions with other templates	2023-01-12 16:46:08 -05:00
weslambert	fb8d8ea972	Update Elasticsearch index template for Kratos	2023-01-12 15:31:41 -05:00
weslambert	9416552338	Don't set the Kratos index explicitly	2023-01-12 15:25:35 -05:00