  weslambertandGitHub
|
657e251f51
|
Merge pull request #1528 from Security-Onion-Solutions/fix/kibana_ack
Update Kibana mappings for event ack/eslacation
|
2020-10-15 14:48:00 -04:00 |
|
|
Wes Lambert
|
d863f26f9d
|
Update Kibana mappings for event ack/eslacation
|
2020-10-15 18:46:37 +00:00 |
|
|
weslambertandGitHub
|
36b9450a39
|
Merge pull request #1526 from Security-Onion-Solutions/fix/kibana_things
Intel mapping enforcement and winlog.verion
|
2020-10-15 08:43:34 -04:00 |
|
|
Wes Lambert
|
af9daa4d71
|
Intel mapping enforcement and winlog.verion
|
2020-10-15 12:42:33 +00:00 |
|
|
weslambertandGitHub
|
c81ee9621d
|
Merge pull request #1525 from Security-Onion-Solutions/fix/kibana_discover_default
Fix default discover query
|
2020-10-14 17:44:55 -04:00 |
|
|
Wes Lambert
|
e7401b3e0c
|
Fix default discover query
|
2020-10-14 21:43:19 +00:00 |
|
|
weslambertandGitHub
|
f2125242f9
|
Merge pull request #1523 from Security-Onion-Solutions/fix/strelka_file_mime_type
Rename file.flavors.mime to file.mime_type
|
2020-10-14 14:58:15 -04:00 |
|
|
Wes Lambert
|
54c4ee796f
|
Rename file.flavors.mime to file.mime_type
|
2020-10-14 18:56:44 +00:00 |
|
|
weslambertandGitHub
|
8d4fd6c18d
|
Merge pull request #1522 from Security-Onion-Solutions/fix/pipeline_commmon_remove_ignore_missing
Fix common pipeline field removal so won't fail for missing fields
|
2020-10-14 09:56:34 -04:00 |
|
|
Wes Lambert
|
3c820365ab
|
Fix common pipeline field removal so won't fail for missing fields
|
2020-10-14 13:55:24 +00:00 |
|
|
weslambertandGitHub
|
4fff105986
|
Merge pull request #1514 from Security-Onion-Solutions/fix/replay_verbiage
Replay verbiage -- let users know when preparing to replay
|
2020-10-13 14:14:41 -04:00 |
|
|
Wes Lambert
|
3f8f0da468
|
Replay verbiage -- let users know when preparing to replay
|
2020-10-13 18:13:36 +00:00 |
|
|
weslambertandGitHub
|
a17a2ad3de
|
Merge pull request #1507 from Security-Onion-Solutions/fix/zeek_smb_ts_common
Ensure Zeek logs without ts field have an @timestamp field associated
|
2020-10-12 13:21:15 -04:00 |
|
|
Wes Lambert
|
14559b081d
|
Ensure Zeek logs without ts field have an @timestamp field associated
|
2020-10-12 17:19:23 +00:00 |
|
|
weslambertandGitHub
|
748ff0dbeb
|
Merge pull request #1506 from Security-Onion-Solutions/fix/index_dates
Fix/index dates
|
2020-10-12 11:45:08 -04:00 |
|
|
Wes Lambert
|
4fc4913d1e
|
Don't predefine index date for Filebeat ES outputs
|
2020-10-12 15:44:00 +00:00 |
|
|
Wes Lambert
|
884cc2d054
|
Don't predefine index date for Logstash outputs
|
2020-10-12 15:41:47 +00:00 |
|
|
weslambertandGitHub
|
12c3c351d8
|
Merge pull request #1498 from Security-Onion-Solutions/feature/filterlog
Feature/filterlog
|
2020-10-09 20:05:21 -04:00 |
|
|
Wes Lambert
|
28a1f7f88a
|
Remove pfsense tag
|
2020-10-10 00:03:51 +00:00 |
|
|
Wes Lambert
|
b55ffa44f8
|
Fix module,dataset rename
|
2020-10-10 00:01:37 +00:00 |
|
|
Wes Lambert
|
69a04dedd3
|
Filterlog config changes
|
2020-10-09 23:56:52 +00:00 |
|
|
weslambertandGitHub
|
993aabedf2
|
Merge pull request #1491 from Security-Onion-Solutions/fix/so-elasticsearch-pipeline-stats-dots
Ensure pipelines with dots in names can be referenced
|
2020-10-08 15:41:44 -04:00 |
|
|
weslambertandGitHub
|
06706d29f2
|
Ensure pipelines with dots in names can be referenced
|
2020-10-08 15:41:17 -04:00 |
|
|
weslambertandGitHub
|
f41987024f
|
Merge pull request #1490 from Security-Onion-Solutions/feature/so-elastic-pipeline-stats
Add pipeline stats script
|
2020-10-08 15:12:55 -04:00 |
|
|
Wes Lambert
|
1efb39a71b
|
Add pipeline stats script
|
2020-10-08 19:11:41 +00:00 |
|
|
weslambertandGitHub
|
0f5f781024
|
Merge pull request #1484 from Security-Onion-Solutions/fix/strelka_rule_null_safe_2
More fixes for rule field
|
2020-10-08 09:37:44 -04:00 |
|
|
Wes Lambert
|
a6d3dcf398
|
More fixes for rule field
|
2020-10-08 13:36:47 +00:00 |
|
|
weslambertandGitHub
|
5e4bbcd4ca
|
Merge pull request #1483 from Security-Onion-Solutions/fix/strelka_rule_null_safe
Add null safe check for rule
|
2020-10-08 09:15:29 -04:00 |
|
|
Wes Lambert
|
a2e2f23a8d
|
Add null safe check for rule
|
2020-10-08 13:14:39 +00:00 |
|
|
weslambertandGitHub
|
3ec9206b17
|
Merge pull request #1482 from Security-Onion-Solutions/fix/network_transport_kibana_viz
Fix network transport Kibana viz
|
2020-10-08 08:18:12 -04:00 |
|
|
Wes Lambert
|
adf0ef87c9
|
Fix network transport Kibana viz
|
2020-10-08 12:17:15 +00:00 |
|
|
weslambertandGitHub
|
7767d3897b
|
Merge pull request #1481 from Security-Onion-Solutions/fix/network_transport_lower
Lowercase network.transport
|
2020-10-08 08:00:22 -04:00 |
|
|
weslambertandGitHub
|
5ada85942b
|
Lowercase network.transport
|
2020-10-08 07:59:57 -04:00 |
|
|
weslambertandGitHub
|
7befff3baa
|
Merge pull request #1474 from Security-Onion-Solutions/fix/common_nids
Don't use regex for determining rule type
|
2020-10-07 12:16:55 -04:00 |
|
|
Wes Lambert
|
7543144afe
|
Don't use regex for determining rule type
|
2020-10-07 16:15:43 +00:00 |
|
|
weslambertandGitHub
|
7787f81bdd
|
Merge pull request #1473 from Security-Onion-Solutions/fix/logstash_output_wazuh
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:49:40 -04:00 |
|
|
weslambertandGitHub
|
8e829b47ae
|
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:48:56 -04:00 |
|
|
weslambertandGitHub
|
8015676e01
|
Merge pull request #1472 from Security-Onion-Solutions/fix/rename-signature_info
Change rule.signature_info to rule.reference and ensure common.nids e…
|
2020-10-07 11:21:18 -04:00 |
|
|
Wes Lambert
|
015a441e79
|
Change rule.signature_info to rule.reference and ensure common.nids exists
|
2020-10-07 15:20:26 +00:00 |
|
|
weslambertandGitHub
|
a1866e5229
|
Merge pull request #1471 from Security-Onion-Solutions/fix/ingest-updates
Fix/ingest updates
|
2020-10-07 11:15:55 -04:00 |
|
|
Wes Lambert
|
f0a1457ffd
|
Update common.nids
|
2020-10-07 15:14:08 +00:00 |
|
|
Wes Lambert
|
8c07c098f6
|
Pipeline cleanup
|
2020-10-06 20:14:15 +00:00 |
|
|
Wes Lambert
|
350cc41740
|
Let zeek.common handle common fields for zeek.tunnels
|
2020-10-06 20:12:23 +00:00 |
|
|
weslambertandGitHub
|
a16419b997
|
Merge pull request #1466 from Security-Onion-Solutions/fix/so-elasticsearch-templates-load
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 13:19:54 -04:00 |
|
|
Wes Lambert
|
a6a69c57d1
|
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 17:18:42 +00:00 |
|
|
weslambertandGitHub
|
6cdff854f3
|
Merge pull request #1465 from Security-Onion-Solutions/feature/so-elasticsearch-templates-list
Add so-elasticsearch-templates-list
|
2020-10-06 13:16:11 -04:00 |
|
|
Wes Lambert
|
787f1d8732
|
Add so-elasticsearch-templates-list
|
2020-10-06 17:15:27 +00:00 |
|
|
weslambertandGitHub
|
1a2921c2bc
|
Merge pull request #1463 from Security-Onion-Solutions/feature/so-elasticsearch-pipelines-list
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 13:04:24 -04:00 |
|
|
Wes Lambert
|
4a5d50cf80
|
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 17:01:58 +00:00 |
|
|
weslambertandGitHub
|
706c81daca
|
Merge pull request #1459 from Security-Onion-Solutions/feature/strelka_yara_alert
Add Strelka YARA matches as alerts
|
2020-10-06 08:23:16 -04:00 |
|
|
Wes Lambert
|
019bec992d
|
Add Strelka YARA matches as alerts
|
2020-10-06 12:19:44 +00:00 |
|
|
weslambertandGitHub
|
9f4cb42c4f
|
Merge pull request #1452 from Security-Onion-Solutions/fix/kibana_case_create
Change alert to case
|
2020-10-05 11:46:14 -04:00 |
|
|
Wes Lambert
|
575da0f9d3
|
Change alert to case
|
2020-10-05 15:45:10 +00:00 |
|
|
weslambertandGitHub
|
f4fcc052ca
|
Merge pull request #1451 from Security-Onion-Solutions/fix/wazuh_rule_cat
Put back rule.category for Wazuh alerts
|
2020-10-05 11:35:20 -04:00 |
|
|
weslambertandGitHub
|
bc31e19e37
|
Put back rule.category for Wazuh alerts
|
2020-10-05 11:34:29 -04:00 |
|
|
weslambertandGitHub
|
6e2319f6da
|
Merge pull request #1449 from Security-Onion-Solutions/fix/wazuh_logging
Adjust Wazuh logging so we don't log alerts to a separate file and so…
|
2020-10-05 10:04:01 -04:00 |
|
|
weslambertandGitHub
|
968dce0aee
|
Adjust Wazuh logging so we don't log alerts to a separate file and so we don't write a separate log file for non-JSON for archives
|
2020-10-05 10:03:40 -04:00 |
|
|
weslambertandGitHub
|
6b292ea62b
|
Merge pull request #1448 from Security-Onion-Solutions/fix/so_elastic_clear
Fix/so elastic clear
|
2020-10-05 09:40:04 -04:00 |
|
|
Wes Lambert
|
da8957b4f4
|
Use Elasticsearch pillar vs manager IP for so-elastic-clear
|
2020-10-05 13:37:06 +00:00 |
|
|
Wes Lambert
|
1970d95d5f
|
Make Filebeat registry persistent to avoid re-reading old data
|
2020-10-05 13:30:04 +00:00 |
|
|
weslambertandGitHub
|
771d091d6e
|
Merge pull request #1446 from Security-Onion-Solutions/feature/wazuh_severity
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 08:52:20 -04:00 |
|
|
Wes Lambert
|
77d31cb289
|
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 12:50:29 +00:00 |
|
|
weslambertandGitHub
|
203e84d2cf
|
Update comma verbiage for HOME_NET in whiptail menu
|
2020-10-05 08:08:22 -04:00 |
|
|
weslambertandGitHub
|
2d2f4de337
|
Merge pull request #1437 from Security-Onion-Solutions/fix/kib_scripted_thehive
Update scripted field for TheHive case
|
2020-10-01 16:54:02 -04:00 |
|
|
Wes Lambert
|
8a81a5148b
|
Update scripted field for TheHive case
|
2020-10-01 20:52:57 +00:00 |
|
|
weslambertandGitHub
|
98bef8fb9d
|
Merge pull request #1436 from Security-Onion-Solutions/fix/kibana_soc_thehive_case
Add SOC url for api integration
|
2020-10-01 16:47:11 -04:00 |
|
|
Wes Lambert
|
eced18c3cc
|
Add SOC url for api integration
|
2020-10-01 20:29:28 +00:00 |
|
|
weslambertandGitHub
|
6818de9e64
|
Merge pull request #1431 from Security-Onion-Solutions/fix/elastlert_rules
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:36:11 -04:00 |
|
|
weslambertandGitHub
|
887937a75d
|
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:35:35 -04:00 |
|
|
weslambertandGitHub
|
5b16a65422
|
Merge pull request #1429 from Security-Onion-Solutions/fix/zeek_server_ip
Fix issue with null Zeek server IP
|
2020-09-30 13:54:50 -04:00 |
|
|
Wes Lambert
|
02d2e5e2c6
|
Fix isue with null Zeek server IP
|
2020-09-30 17:53:30 +00:00 |
|
|
weslambertandGitHub
|
defe832121
|
Merge pull request #1427 from Security-Onion-Solutions/fix/wazuh_filebeat
Fix Filebeat config for Wazuh
|
2020-09-30 10:59:01 -04:00 |
|
|
Wes Lambert
|
d8f70397f7
|
Fix Filebeat config for Wazuh
|
2020-09-30 14:57:56 +00:00 |
|
|
weslambertandGitHub
|
dac2ad5dbf
|
Merge pull request #1425 from Security-Onion-Solutions/feature/soctopus_pillar
Add initial implementation of SOCtopus pillar
|
2020-09-30 10:25:26 -04:00 |
|
|
Wes Lambert
|
c62acf5e4e
|
Add initial implmentation of SOCtopus pillar
|
2020-09-30 14:24:15 +00:00 |
|
|
weslambertandGitHub
|
401764437f
|
Merge pull request #1421 from Security-Onion-Solutions/fix/ip_type
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 14:21:25 -04:00 |
|
|
Wes Lambert
|
36019727b3
|
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 18:20:15 +00:00 |
|
|
weslambertandGitHub
|
3d6c956e02
|
Merge pull request #1409 from Security-Onion-Solutions/feature/wazuh_wel
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 15:07:15 -04:00 |
|
|
Wes Lambert
|
869767d9d9
|
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 19:04:21 +00:00 |
|
|
weslambertandGitHub
|
6bfef773f2
|
Merge pull request #1392 from Security-Onion-Solutions/bugfix/config_dev_nullify
dev nullify so-config-backup cron job
|
2020-09-24 21:00:18 -04:00 |
|
|
weslambertandGitHub
|
b3f9ee3b34
|
dev nullify so-config-backup cron job
|
2020-09-24 20:59:42 -04:00 |
|
|
weslambertandGitHub
|
a09002edae
|
Merge pull request #1384 from Security-Onion-Solutions/bugfix/config_backup
Add back missing # sign
|
2020-09-23 21:34:52 -04:00 |
|
|
weslambertandGitHub
|
5b93c40ce4
|
Add back missing # sign
|
2020-09-23 21:34:10 -04:00 |
|
|
weslambertandGitHub
|
4f228c1b7c
|
Merge pull request #1379 from Security-Onion-Solutions/feature/config_backup
Feature/config backup
|
2020-09-23 09:58:05 -04:00 |
|
|
Wes Lambert
|
71734ddc0a
|
Add cron job to common state for daily config backup
|
2020-09-23 13:55:32 +00:00 |
|
|
Wes Lambert
|
57732b360e
|
Add config backup script
|
2020-09-23 13:47:14 +00:00 |
|
|
Wes Lambert
|
4d42d04cc3
|
Fix backup pillar definition
|
2020-09-23 13:45:42 +00:00 |
|
|
Wes Lambert
|
d02c440934
|
Add backup params to global.sls
|
2020-09-22 21:05:57 +00:00 |
|
|
weslambertandGitHub
|
74e4adda11
|
Merge pull request #1357 from Security-Onion-Solutions/feature/dashboard_updates_2
Add All Logs for Connections dashboard
|
2020-09-16 11:56:38 -04:00 |
|
|
Wes Lambert
|
44ef935d65
|
Add All Logs for Connections dashboard
|
2020-09-16 15:55:28 +00:00 |
|
|
weslambertandGitHub
|
6325b30a21
|
Merge pull request #1356 from Security-Onion-Solutions/feature/dashboard_updates
Kibana dashboard updates
|
2020-09-16 11:19:27 -04:00 |
|
|
Wes Lambert
|
bd8d2fc271
|
Kibana dashboard updates
|
2020-09-16 15:17:26 +00:00 |
|
|
weslambertandGitHub
|
6806bd2461
|
Merge pull request #1348 from Security-Onion-Solutions/bugfix/es_template_load
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:15:56 -04:00 |
|
|
weslambertandGitHub
|
fbf037f460
|
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:14:06 -04:00 |
|
|
weslambertandGitHub
|
b6b52671e2
|
Merge pull request #1294 from Security-Onion-Solutions/fix/wazuh_agent_name
Fix typo
|
2020-09-05 08:17:09 -04:00 |
|
|
Wes Lambert
|
f9884606df
|
Fix typo
|
2020-09-05 12:15:55 +00:00 |
|
|
weslambertandGitHub
|
b10dd40376
|
Merge pull request #1287 from Security-Onion-Solutions/fix/suri_home_net
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:51 -04:00 |
|
|
weslambertandGitHub
|
8db8dcb71a
|
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:14 -04:00 |
|
|
weslambertandGitHub
|
870e042c4c
|
Merge pull request #1285 from Security-Onion-Solutions/fix/so_stop_start_restart
Require at least one arg for start/stop/restart scripts
|
2020-09-02 14:58:19 -04:00 |
|
|
Wes Lambert
|
770aaf415c
|
Require at least on arg for start/stop/restart scripts
|
2020-09-02 18:55:59 +00:00 |
|