CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-09-17 13:19:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,730 Commits 35 Branches 130 Tags
3e5a934ff842987ccc76c5567590473eca61dedd
Commit Graph
18730 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Reeves 3e5a934ff8 Merge pull request #16238 from Security-Onion-Solutions/hotfix/3.3.0 
Hotfix/3.3.0
3.3.0-20260911 		2026-09-11 16:38:51 -04:00
Mike Reeves 9fc9be2cc9 Merge pull request #16237 from Security-Onion-Solutions/hf33 
3.3.0 hotfix
 2026-09-11 16:20:23 -04:00
Mike Reeves 7245843a3c 3.3.0 hotfix 2026-09-11 16:17:34 -04:00
Mike Reeves a1d17417ea 3.3.0 hotfix 2026-09-11 16:16:01 -04:00
Mike Reeves bee03d5bae 3.3.0 hotfix 2026-09-11 16:13:09 -04:00
Mike Reeves 3f3f091a7f Merge pull request #16235 from Security-Onion-Solutions/soup-x86-64-v3-check 
Add x86-64-v3 CPU pre-flight check to soup
 2026-09-11 11:00:34 -04:00
Mike Reeves cb48909578 Add x86-64-v3 CPU pre-flight check to soup 
Upstream Elastic now ships binaries built for the x86-64-v3
micro-architecture level. This is not a Security Onion choice: nodes whose
CPUs predate x86-64-v3 can no longer run Elastic's own builds, so those
nodes break once they are upgraded.

Check for support before soup modifies anything, and require the operator
to type "override" to proceed when a node is unsupported or offline.

Runs after upgrade_check so a grid that is already current exits without
prompting. Targets only the roles that run a container built from the
so-elastic-agent image, using the role lists already maintained in
salt/reactor/pillar_push_map.yaml. Adds --skip-cpu-check to bypass the gate
for automation, and exit code 162 when the operator declines to override.
 2026-09-11 10:51:25 -04:00
Mike Reeves 3057775770 Merge pull request #16234 from Security-Onion-Solutions/TOoSmOotH-patch-3 
Update version number in HOTFIX file
 2026-09-11 09:04:04 -04:00
Mike Reeves e4e8b90b9c Update version number in HOTFIX file 2026-09-11 09:03:24 -04:00
Mike Reeves 223ace6ff3 Merge pull request #16233 from Security-Onion-Solutions/TOoSmOotH-patch-2 
Update HOTFIX version to 3.3.0-20260911
 2026-09-11 08:57:31 -04:00
Mike Reeves 66e7863336 Update HOTFIX version to 3.3.0-20260911 2026-09-11 08:56:00 -04:00
Corey Ogburn 8f253d17a6 Default Memory to Disabled 
Gives users a chance to reconfigure embed model before messages they send to the OnionAI get sent to SOAI by default.
 2026-09-10 15:18:35 -06:00
Mike Reeves 8f14e96215 Merge pull request #16215 from Security-Onion-Solutions/3/dev 
3.3.0
3.3.0-20260908 		2026-09-08 15:00:13 -04:00
Mike Reeves 86ae51b2b5 Merge pull request #16214 from Security-Onion-Solutions/3.3.0 
3.3.0
 2026-09-08 14:54:21 -04:00
Mike Reeves 2cde9abec2 3.3.0 2026-09-08 14:52:40 -04:00
Mike Reeves 57ce2cea0d Merge pull request #16213 from Security-Onion-Solutions/3.3.0 
3.3.0
 2026-09-08 14:51:38 -04:00
Mike Reeves ff7555d93b 3.3.0 2026-09-08 14:49:39 -04:00
Jorge Reyes 65b84026a8 Merge pull request #16212 from Security-Onion-Solutions/reyesj2-patch-5 
drop remapped sentinel_one_cloud_funnel.login index template
 2026-09-08 08:49:09 -05:00
reyesj2 721b1d6207 drop remapped sentinel_one_cloud_funnel.login index template 2026-09-08 08:30:00 -05:00
Josh Brower a74046fc24 Merge pull request #16210 from Security-Onion-Solutions/soup-fixes 
Fix soup
 2026-09-04 17:53:50 -04:00
Josh Brower ea539f8679 Fix soup 2026-09-04 17:50:32 -04:00
coreyogburn 54bb0e2c12 Merge pull request #16209 from Security-Onion-Solutions/cogburn/memory-fixes 
Batch Size and Retries
 2026-09-04 12:52:19 -06:00
Corey Ogburn 67b4d82f62 Improved Description of MemoryExtractBatchSize 2026-09-04 12:49:29 -06:00
Corey Ogburn 30574fdbb9 Batch Size and Retries 
2 new config fields. Batch size is used to limit how many message turns we put in the transcript when we ask the memory agent to extract facts. The retries helps limit how many times we ask the memory agent to process a problematic session.
 2026-09-04 12:18:29 -06:00
Josh Brower 64771e9e1d Merge pull request #16207 from Security-Onion-Solutions/soup-es-tshoot 
Run estshoot if cluster is not green
 2026-09-03 12:09:14 -04:00
Josh Brower 01ca33b90a Run estshoot if cluster is not green 2026-09-03 11:48:16 -04:00
coreyogburn 599d19215b Merge pull request #16206 from Security-Onion-Solutions/cogburn/tool_turn_config 
Define ToolTurn Defaults
 2026-09-02 11:49:54 -06:00
Corey Ogburn ee671e7ec9 Define ToolTurn Defaults 
When auto approving tools, we might approve a tool_request before it's been saved to ES. These vars describe some leniency in retrying when the message can't be found before giving up.
 2026-09-02 11:42:29 -06:00
coreyogburn 42d429a11e Merge pull request #16205 from Security-Onion-Solutions/cogburn/fix-regex 
Fix Regex
 2026-09-02 09:14:02 -06:00
Corey Ogburn 332a5d11bc Fix Regex 
Double quoted stings in yaml allow for escape sequences like `\n` and `\t` but when used around a regex, salt will hang up on `\d` not being a valid escape sequence. Switching to single quotes so escapes aren't processed.
 2026-09-02 09:08:46 -06:00
coreyogburn 42a62c90a5 Merge pull request #16203 from Security-Onion-Solutions/cogburn/memory-metrics 
Cogburn/memory metrics
 2026-09-01 09:52:39 -06:00
Corey Ogburn fb7e065590 Remove YYYY-MM-DD 
No more instances of YYYY-MM-DD
 2026-09-01 09:32:26 -06:00
Corey Ogburn bce6b0c1fe Allow Timestamp in dontScanBefore 
Now storing UTC timestamp in the dontScanBefore field.
 2026-08-31 16:11:29 -06:00
Corey Ogburn b9ba7df80c DontScanBefore 
New field that'll stop the memory scanner from scanning before an indicated date. Leaving it empty lets the scanner scan everything.

The regex for it allows YYYY-MM-DD and ensures months only allow the max number of days (no June the 43rd).
 2026-08-28 19:02:39 -06:00
Jorge Reyes 97fddc0719 Merge pull request #16201 from Security-Onion-Solutions/reyesj2-patch-1 
fix salt batching command
 2026-08-28 16:32:08 -05:00
Jorge Reyes a5deee1444 fix salt batching command 2026-08-28 16:27:29 -05:00
Jorge Reyes 3585ccca79 Merge pull request #16190 from Security-Onion-Solutions/reyesj2/es945 
UPGRADE: Elasticsearch 9.4.5
 2026-08-28 16:18:13 -05:00
reyesj2 dd035beec4 include fleet state 2026-08-28 13:45:55 -05:00
reyesj2 0dbb7803ef Merge branch 'reyesj2/reworksoup' into reyesj2/es945 2026-08-28 13:28:53 -05:00
reyesj2 30deb00277 use correct version variable 2026-08-28 13:27:44 -05:00
reyesj2 192363bc2f Merge branch 'reyesj2/reworksoup' into reyesj2/es945 2026-08-28 12:19:20 -05:00
reyesj2 3d8f86883a after an ES upgrade run a final elasticsearch state to create/regenerate any needed addon index templates 2026-08-28 12:16:08 -05:00
Josh Patterson 96bef89ba9 Merge pull request #16200 from Security-Onion-Solutions/rotatehype 
add log rotation for hypervisor logs
 2026-08-28 09:54:59 -04:00
Josh Patterson a244640539 Merge remote-tracking branch 'origin/3/dev' into rotatehype 
# Conflicts:
#	salt/logrotate/defaults.yaml
#	salt/logrotate/soc_logrotate.yaml
 2026-08-28 09:26:36 -04:00
reyesj2 fdb975fdef Merge branch 'reyesj2/reworksoup' into reyesj2/es945 2026-08-27 22:12:44 -05:00
reyesj2 f8401bef37 exclude elasticsearch indexing error during upgrade for temporarily outdated policies 2026-08-27 21:17:27 -05:00
Jason Ertel ca96a15091 Merge pull request #16199 from Security-Onion-Solutions/jertel/wip 
fix well-known paths
 2026-08-27 16:31:27 -04:00
Jason Ertel 1bac9a218e fix well-known paths 2026-08-27 16:28:00 -04:00
reyesj2 4786d359fb exclude telegraf error during elasticsearch upgrade / master election 2026-08-27 14:39:46 -05:00
reyesj2 d771fbc444 upgrade integration policies directly after integration package upgrade 2026-08-27 14:18:39 -05:00