Corey Ogburn
ddf662bdb4
Mark Repos as Community
...
Indicate that detection rules pulled from configured repos should be marked as Community rules.
2024-04-29 16:22:30 -06:00
reyesj2
fadb6e2aa9
Re-add original timestamp format + ignore failures with this processor
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 16:57:48 -04:00
reyesj2
192d91565d
Update final pipeline timestamp format for event.module system events
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 16:34:29 -04:00
reyesj2
a6e8b25969
Add Kafka connectivity between manager - > receiver nodes.
...
Add connectivity to Kafka between other node types that may need to publish to Kafka.
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 15:48:57 -04:00
reyesj2
529bc01d69
Add missing configuration for nodes running Kafka broker role only
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 14:53:52 -04:00
reyesj2
11055b1d32
Rename kafkapass -> kafka_pass
...
Run so-kafka-clusterid within nodes.sls state so switchover is consistent
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 14:09:09 -04:00
reyesj2
fd9a91420d
Use SOC UI to configure list of KRaft (Kafka) controllers for cluster
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 11:37:24 -04:00
reyesj2
529c8d7cf2
Remove salt reactor for Kafka
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 11:35:46 -04:00
reyesj2
086ebe1a7c
Split kafka defaults between broker / controller
...
Setup config.map.jinja to update broker / controller / combined node types
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 09:08:14 -04:00
reyesj2
29c964cca1
Set kafka.nodes state to run first to populate kafka.nodes pillar
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-29 09:04:52 -04:00
DefensiveDepth
f2c3c928fc
Sigma pivot fix and cleanup
2024-04-29 08:49:05 -04:00
m0duspwnens
2c7eb3c755
only apply ulimits to suricata container if user enable mmap-locked
2024-04-25 10:05:59 -04:00
weslambert
b424426298
Exclude suricata
2024-04-25 09:14:18 -04:00
Josh Patterson
03f9160fcc
Merge pull request #12860 from Security-Onion-Solutions/issue/12856
...
allow for enabled/disable of so-elasticsearch-indices-delete cronjob
2024-04-25 09:07:44 -04:00
m0duspwnens
d50de804a8
update annotation
2024-04-25 09:04:34 -04:00
weslambert
983ef362e9
Merge pull request #12858 from Security-Onion-Solutions/fix/index_sorting
...
Change index sorting to account for older so-prefixed indices
2024-04-25 08:54:22 -04:00
Josh Brower
d88c1a5e0a
Merge pull request #12861 from Security-Onion-Solutions/2.4/detectionlogs
...
Add runtime status logs
2024-04-24 20:07:32 -04:00
weslambert
44afa55274
Fix comments about deletion
2024-04-24 17:41:37 -04:00
weslambert
ab832e4bb2
Include logstash-prefixed indices
2024-04-24 17:17:53 -04:00
DefensiveDepth
3c3ed8b5c5
Add runtime status logs
2024-04-24 16:33:47 -04:00
m0duspwnens
c9d9979f22
allow for enabled/disable of so-elasticsearch-indices-delete cronjob
2024-04-24 16:18:45 -04:00
m0duspwnens
73b5bb1a75
add memlock to so-suricata container
2024-04-24 15:35:17 -04:00
weslambert
59a02635ed
Change index sorting
2024-04-24 15:18:49 -04:00
m0duspwnens
13a6520a8c
mmap-locked default no
2024-04-24 13:50:12 -04:00
m0duspwnens
4b7f826a2a
quote is so true becomes yes
2024-04-24 13:29:55 -04:00
m0duspwnens
0bd0c7b1ec
allow for mmap-locked to be configured
2024-04-24 13:26:25 -04:00
weslambert
1b3a0a3de8
Remove hot max_age
2024-04-24 10:11:02 -04:00
weslambert
75b5e16696
Update description, type, and regex
2024-04-24 09:14:39 -04:00
weslambert
8a0a435700
Fix warm description
2024-04-24 08:35:19 -04:00
reyesj2
36573d6005
Update kafka cert permissions
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-23 16:45:36 -04:00
reyesj2
aa0c589361
Update kafka managed node pillar template to include its process.role
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-23 13:51:12 -04:00
weslambert
691b02a15e
Fix warm description
2024-04-23 10:40:09 -04:00
DefensiveDepth
58ddd55123
Exclude yara runtime log
2024-04-23 07:28:07 -04:00
reyesj2
685b80e519
Merge remote-tracking branch 'remotes/origin/kaffytaffy' into reyesj2/kafka
2024-04-22 16:45:59 -04:00
reyesj2
5a401af1fd
Update kafka process_x_roles annotation
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-22 16:44:35 -04:00
reyesj2
25d63f7516
Setup kafka reactor for managing kafka controllers globally
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-22 16:42:59 -04:00
Jorge Reyes
d402943403
Merge pull request #12773 from Security-Onion-Solutions/reyesj2/kismet
...
Kismet integration for WiFi devices
2024-04-22 15:59:22 -04:00
Josh Brower
64c43b1a55
Merge pull request #12805 from Security-Onion-Solutions/2.4/detectiondefaults
...
Strelka fixes and more
2024-04-19 16:53:07 -04:00
DefensiveDepth
a237ef5d96
Update default queries
2024-04-19 16:33:35 -04:00
m0duspwnens
6c5e0579cf
logging changes. ensure salt master has pillarWatch engine
2024-04-19 09:32:32 -04:00
reyesj2
4ac04a1a46
add kafkapass soc annotation
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 16:46:36 -04:00
reyesj2
746128e37b
update so-kafka-clusterid
...
This is a temporary script used to setup kafka secret and clusterid needed for kafka to start. This scripts functionality will be replaced by soup/setup scripts
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 15:13:29 -04:00
reyesj2
fe81ffaf78
Variables no longer used. Replaced by map file
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 15:11:22 -04:00
m0duspwnens
1f6eb9cdc3
match keys better. go through files reverse first found is prio
2024-04-18 13:50:37 -04:00
reyesj2
5cc358de4e
Update map files to handle empty kafka:nodes pillar
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-18 11:58:25 -04:00
Doug Burks
406dda6051
Update so-elasticsearch-cluster-space-used
2024-04-18 11:48:15 -04:00
Doug Burks
229a989914
Update so-elasticsearch-cluster-space-total
2024-04-18 11:47:01 -04:00
DefensiveDepth
6c6647629c
Refactor yara for compilation
2024-04-18 11:32:17 -04:00
m0duspwnens
610dd2c08d
improve it
2024-04-18 11:11:14 -04:00
m0duspwnens
506bbd314d
more comments, better logging
2024-04-18 10:26:10 -04:00
