808 Commits

Author	SHA1	Message	Date
Jason Ertel	bf19c6e730	ca download; ignore shard errors on startup; clarify oidc id	2025-02-05 15:04:04 -05:00
Corey Ogburn	23ebe966e0	Added Large Values Warning ... maxBulkEscalateEvents now has a warning that large values may run into other limits.	2025-02-04 10:33:04 -07:00
Corey Ogburn	d0fa6eaf83	New Limit on Bulk Creating Related Events ... Used by the UI and API to hint at a user that not every event will be attached to a case. Supports values up to 10,000 (the default limit on the number of documents returned by a single ES search).	2025-02-03 14:20:33 -07:00
Jorge Reyes	107ca38268	fix http query for "includes" function	2025-01-14 08:24:07 -06:00
Jorge Reyes	35547b476f	update http query	2025-01-14 08:13:27 -06:00
Jorge Reyes	ad765200c3	Merge pull request #14105 from Security-Onion-Solutions/reyesj2/moarzeekparse ... Additional Zeek parsing & cloudflare_logpush integration	2025-01-13 11:37:21 -06:00
reyesj2	14c920a258	fix hidden ldap menu subtitle	2025-01-13 09:23:32 -06:00
Joshua Brower	dcdf31eee8	Fix folder perm	2025-01-10 16:15:17 -05:00
reyesj2	e60a1e4357	zeek ldap & ldap_search parsing ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-01-09 16:06:10 -06:00
Joshua Brower	a2caf7425d	Add config options	2025-01-07 13:22:14 -05:00
Joshua Brower	6fa11a38ef	Update defaults	2025-01-07 13:14:50 -05:00
Josh Brower	8408a53b82	Merge remote-tracking branch 'origin/2.4/dev' into 2.4/navigator	2025-01-02 16:13:34 -05:00
Doug Burks	927b618ec9	Update Zeek QUIC dashboard, add Hunt query, add quic.server.name as column in Events table	2025-01-02 06:57:56 -05:00
reyesj2	9f83853922	Zeek QUIC support ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-12-31 13:44:20 -06:00
defensivedepth	7237b8971e	Refactor pipeline for hash changes	2024-12-23 15:41:13 -05:00
defensivedepth	9475211417	Refactor Navigator for Detections	2024-12-09 16:31:51 -05:00
reyesj2	754d28e95d	add openvpn & ipsec support to Zeek	2024-12-05 09:52:55 -06:00
Josh Brower	04ffdf9b15	Merge pull request #13958 from Security-Onion-Solutions/2.4/autoenablesigma ... More flexibility for AutoEnable Sigma rules	2024-11-21 09:47:49 -05:00
defensivedepth	f61bf1bd67	Remove adv	2024-11-21 09:15:29 -05:00
defensivedepth	b1c4e32123	Remove duplicate option	2024-11-21 09:11:44 -05:00
defensivedepth	8958da83b3	Deprecate instead	2024-11-20 18:00:26 -05:00
defensivedepth	3fcf197bc1	Tweak structure	2024-11-19 11:54:15 -05:00
Corey Ogburn	d86c009f55	Add Annotations to Existing Detections Options ... The autoUpdateEnabled setting has been present for awhile and now have annotations.	2024-11-18 14:35:55 -07:00
defensivedepth	56d6857cd6	Addl customization for autoenable sigma	2024-11-18 09:03:17 -05:00
reyesj2	1113c3924f	zeek http2 ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-11-14 09:09:23 -06:00
Jason Ertel	5b74a55c3c	ensure roles file exists since no longer syncing clients to es	2024-11-11 17:21:42 -05:00
Jason Ertel	57a9992a3d	Merge branch '2.4/dev' into jertel/wip	2024-11-11 10:06:44 -05:00
defensivedepth	dcbb0e48d4	make sure its owned by socore	2024-11-08 14:34:29 -05:00
defensivedepth	8b70aa9f0e	Fix socore permissions	2024-11-08 09:19:41 -05:00
defensivedepth	f5bd8ab585	Rewrite docs	2024-11-07 15:33:47 -05:00
defensivedepth	28d468dd41	Merge remote-tracking branch 'origin/2.4/dev' into 2.4/templaterepos	2024-11-07 07:25:01 -05:00
Corey Ogburn	52a144c052	Added Help Link to Annotation for IgnoredSidRanges	2024-11-05 12:11:17 -07:00
Corey Ogburn	25d55feeef	More Detailed Description	2024-11-05 11:41:14 -07:00
Corey Ogburn	5e48ccafce	Update Default Value	2024-11-05 11:11:34 -07:00
Corey Ogburn	69dd35c30a	Add Option for Ignoring Ranges of SIDs in Suricata Integrity Check	2024-11-04 14:31:53 -07:00
Jason Ertel	c9f6b5206a	connect	2024-11-01 16:18:40 -04:00
Jason Ertel	825dbb36dd	connect	2024-11-01 15:37:59 -04:00
Jason Ertel	cd2e5bf2d0	rename role	2024-10-31 17:20:44 -04:00
Jason Ertel	a146153ee9	switch to json	2024-10-30 12:44:01 -04:00
defensivedepth	5406a263d5	Add local custom template	2024-10-29 19:42:06 -04:00
Jason Ertel	3f3ac21f50	connect	2024-10-29 12:28:24 -04:00
Jason Ertel	11820a16f0	connect	2024-10-29 12:04:38 -04:00
Jason Ertel	1243c7588b	connect	2024-10-28 19:42:01 -04:00
Jason Ertel	624c4855c8	connect	2024-10-28 19:25:20 -04:00
Jason Ertel	12a76a9d35	connect	2024-10-28 19:11:26 -04:00
Josh Brower	6a3e5415cf	Merge pull request #13832 from Security-Onion-Solutions/2.4/sigmapipelines ... Add process and file creation mappings	2024-10-28 18:30:21 -04:00
defensivedepth	f3ca5b1c42	Remove OS-specific mappings	2024-10-28 09:19:51 -04:00
Corey Ogburn	6ce52bf9ab	Specify Defaults for detectionEngineStatusQueries ... Specify the defaults as an example to the user.	2024-10-24 13:11:49 -06:00
Corey Ogburn	f67fcecc6e	Clean up StatusQueries String	2024-10-24 11:18:48 -06:00
Corey Ogburn	b7c392a244	Corrected a misspelling	2024-10-24 11:18:48 -06:00