Commit Graph

6650 Commits

Author SHA1 Message Date
Josh Brower
44c75122ed Update Sigmac mappings and config for IPs and ports 2021-03-16 09:05:35 -04:00
Josh Brower
5fe025318b Update Sigmac mappings and config for IPs and ports 2021-03-15 15:53:00 -04:00
Mike Reeves
c93aab7a85 Merge pull request #3448 from Security-Onion-Solutions/kilo
Allow for moving Strelka files to processed directory after scanning
2021-03-15 14:51:04 -04:00
Wes Lambert
f142b754dc Add Strelka files.processed directory so files will be moved from staging to processed 2021-03-15 15:43:31 +00:00
Wes Lambert
b6a785395d Add Strelka staging directory for state 2021-03-15 15:42:13 +00:00
Mike Reeves
d931e57fd8 Merge pull request #3428 from Security-Onion-Solutions/kilo 2021-03-12 17:03:48 -05:00
Doug Burks
cfdf9703ab Merge pull request #3427 from Security-Onion-Solutions/issue/3340
FEATURE: soup should output more guidance for distributed deployments at the end #3340
2021-03-12 15:27:26 -05:00
Doug Burks
da7adab566 FEATURE: soup should output more guidance for distributed deployments at the end #3340 2021-03-12 12:59:17 -05:00
Mike Reeves
4ac408ad38 Merge pull request #3423 from Security-Onion-Solutions/issue/3422
FIX: Improve Setup verbiage #3422
2021-03-12 11:04:25 -05:00
doug
edb88ac09a FIX: Improve Setup verbiage #3422 2021-03-12 10:54:44 -05:00
Jason Ertel
747f387936 Replace salt's http.wait_for_successful_query with so-common's wait_for_web_response due to issues with salt 2021-03-12 10:42:18 -05:00
Jason Ertel
8cddfeb47d Provide pillar for each client param 2021-03-12 07:42:10 -05:00
Doug Burks
555f9b5091 Merge pull request #3417 from Security-Onion-Solutions/issue/3413
FIX: SMTP shoud read SNMP on Kibana SNMP view #3413
2021-03-12 06:52:21 -05:00
doug
a5779a520c FIX: SMTP shoud read SNMP on Kibana SNMP view #3413 2021-03-12 06:48:57 -05:00
Jason Ertel
a7ea0808c3 Merge pull request #3399 from Security-Onion-Solutions/kilo
feature: Show job owner/submitter. Resolves #2775
2021-03-12 06:45:34 -05:00
Jason Ertel
462f76e2bb Remove client params block in favor in individual settings that will go into the pillar 2021-03-12 06:38:53 -05:00
Jason Ertel
b5cf9ae820 Merge branch 'dev' into kilo 2021-03-11 18:01:17 -05:00
Jason Ertel
80987dfd1d Support overrides of client params 2021-03-11 18:01:04 -05:00
Doug Burks
ab1c84afca Merge pull request #3409 from Security-Onion-Solutions/issue/3408
FIX: Populate http.status_message field #3408
2021-03-11 16:45:53 -05:00
doug
adbc7436b6 FIX: Populate http.status_message field #3408 2021-03-11 16:42:20 -05:00
Jason Ertel
286351f424 Merge branch 'dev' into kilo 2021-03-11 15:32:38 -05:00
Jason Ertel
908720592a Upgrade saved objects to 7.11.2 2021-03-11 15:32:22 -05:00
Jason Ertel
79dd0d1809 Fix indentation 2021-03-11 11:13:14 -05:00
Mike Reeves
cdd95986a8 Merge pull request #3398 from Security-Onion-Solutions/issue/3397
FIX: Improve Suricata DHCP logging and parsing #3397
2021-03-11 11:07:53 -05:00
doug
b4ad7e7359 FIX: Improve Suricata DHCP logging and parsing #3397 2021-03-11 11:01:51 -05:00
Doug Burks
adb25d63d2 Merge pull request #3396 from Security-Onion-Solutions/issue/3295
FIX: Improve DHCP leases query in Hunt #3395
2021-03-11 08:22:48 -05:00
Doug Burks
85aaa71006 FIX: Improve DHCP leases query in Hunt #3395 2021-03-11 08:01:27 -05:00
Jason Ertel
eefa6bb949 feature: Show job owner/submitter. Resolves #2775 2021-03-10 14:44:21 -05:00
Mike Reeves
6bbcc7a5e9 Merge pull request #3382 from Security-Onion-Solutions/kilo
Ensure MTU is defined for advanced sensor automation
2021-03-10 09:27:20 -05:00
Jason Ertel
3eb4a37c76 Expose zeek and suri pins for automation 2021-03-10 09:26:46 -05:00
Jason Ertel
180bba782e Expose zeek and suri pins for automation 2021-03-10 09:26:11 -05:00
Jason Ertel
b1531cc75e Merge pull request #3384 from Security-Onion-Solutions/Eval/Import-Fix
Update cert location for eval.import
2021-03-10 09:15:53 -05:00
Mike Reeves
18203513ab Update cert location for eval.import 2021-03-10 09:14:14 -05:00
Jason Ertel
46af6a5c84 Ensure MTU is defined for advanced sensor automation 2021-03-10 08:14:25 -05:00
Mike Reeves
2e74cb6abf Merge pull request #3377 from Security-Onion-Solutions/kilo 2021-03-09 21:40:43 -05:00
Jason Ertel
a496b03de7 Add missing MTU var for automation of advanced sensor 2021-03-09 20:52:34 -05:00
Jason Ertel
46288802d1 Merge pull request #3368 from Security-Onion-Solutions/TOoSmOotH-patch-1
Update 9101_output_osquery_livequery.conf.jinja
2021-03-09 13:16:17 -05:00
Mike Reeves
2e01330e1b Update 9101_output_osquery_livequery.conf.jinja 2021-03-09 13:15:04 -05:00
Mike Reeves
734d25b1ac Merge pull request #3361 from Security-Onion-Solutions/nomorefeatures
Make saved objects less hacky
2021-03-09 10:05:23 -05:00
Mike Reeves
49258a13a3 Make saved objects less hacky 2021-03-09 10:03:29 -05:00
Josh Brower
00da549430 Merge pull request #3358 from Security-Onion-Solutions/delta
FEATURE: Initial support for viewing Osquery Live Query results in Hunt
2021-03-09 09:18:57 -05:00
Jason Ertel
b1777ff10f Merge pull request #3357 from Security-Onion-Solutions/nomorefeatures
SSL with Elastic Security
2021-03-08 21:22:30 -05:00
Mike Reeves
3967e581cf Merge pull request #3356 from Security-Onion-Solutions/kilo
fix: Sensors can temporarily show offline while processing large PCAP…
2021-03-08 19:14:54 -05:00
Mike Reeves
1ecb079066 Fix Kibana Script for loading dashboards 2021-03-08 17:36:07 -05:00
Josh Brower
fe8788c09a Merge remote-tracking branch 'remotes/origin/dev' into delta 2021-03-08 12:56:47 -05:00
Jason Ertel
84c152e233 fix: Sensors can temporarily show offline while processing large PCAP jobs. Resolves #3279. 2021-03-08 12:05:44 -05:00
Mike Reeves
bf4ac2a312 Fix some merge conflicts 2021-03-08 11:43:24 -05:00
Josh Brower
19b3c7bb07 Merge pull request #3339 from Security-Onion-Solutions/feature/live_query-hunt
Feature/live query hunt
2021-03-08 08:31:25 -05:00
William Wernert
49db2a016a Merge pull request #3341 from Security-Onion-Solutions/kilo
Kilo
2021-03-08 08:17:29 -05:00
Jason Ertel
94610307b3 Merge branch 'dev' into kilo 2021-03-08 07:56:48 -05:00