m0duspwnens
|
48ca2cdff1
|
fix pillars we check
|
2020-10-06 18:10:41 -04:00 |
|
m0duspwnens
|
73ce948d42
|
add zeekcaptureloss to data to influxdb. rename broloss to zeekloss - https://github.com/Security-Onion-Solutions/securityonion/issues/1403
|
2020-10-06 18:05:41 -04:00 |
|
m0duspwnens
|
035d215398
|
fix yum db if corrupted - https://github.com/Security-Onion-Solutions/securityonion/issues/163
|
2020-10-06 14:28:01 -04:00 |
|
m0duspwnens
|
3d71766b64
|
Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into issue/1460
|
2020-10-06 13:58:02 -04:00 |
|
m0duspwnens
|
34dfc809c7
|
handle thread count for suricata and default max-pending-packets to 5000 - https://github.com/Security-Onion-Solutions/securityonion/issues/1460
|
2020-10-06 13:57:50 -04:00 |
|
Wes Lambert
|
a6a69c57d1
|
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 17:18:42 +00:00 |
|
Wes Lambert
|
787f1d8732
|
Add so-elasticsearch-templates-list
|
2020-10-06 17:15:27 +00:00 |
|
Wes Lambert
|
4a5d50cf80
|
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 17:01:58 +00:00 |
|
m0duspwnens
|
5eada1cdd5
|
handle install locations of files copied
|
2020-10-06 11:39:34 -04:00 |
|
m0duspwnens
|
a5f4c96db0
|
qol user interaction improvements to analyst install
|
2020-10-06 11:19:43 -04:00 |
|
m0duspwnens
|
4eea0a464c
|
include remaining log functions from so-functions
|
2020-10-06 10:57:43 -04:00 |
|
m0duspwnens
|
7840002d18
|
update log file in title func
|
2020-10-06 10:51:31 -04:00 |
|
m0duspwnens
|
85168e9318
|
add title function
|
2020-10-06 10:49:38 -04:00 |
|
m0duspwnens
|
2420cd5db1
|
add some system characteristics to log like normal install does
|
2020-10-06 10:46:11 -04:00 |
|
Doug Burks
|
a686704d37
|
remove rule.uuid now that underlying issue has been resolved
|
2020-10-06 09:39:57 -04:00 |
|
Wes Lambert
|
019bec992d
|
Add Strelka YARA matches as alerts
|
2020-10-06 12:19:44 +00:00 |
|
m0duspwnens
|
acabcd27a7
|
change for network miner 2.6 - https://github.com/Security-Onion-Solutions/securityonion/issues/1290
|
2020-10-05 18:17:24 -04:00 |
|
Josh Patterson
|
24ff34ee81
|
Merge pull request #1457 from Security-Onion-Solutions/issue/1371
Issue/1371
|
2020-10-05 15:51:35 -04:00 |
|
Josh Brower
|
2e012432b4
|
Merge pull request #1455 from Security-Onion-Solutions/feature/training-req
Write out nested json
|
2020-10-05 15:34:43 -04:00 |
|
Josh Brower
|
de9ace62d4
|
Write out nested json
|
2020-10-05 15:34:02 -04:00 |
|
m0duspwnens
|
748dc5ba91
|
logstash changes per https://github.com/Security-Onion-Solutions/securityonion/issues/1444
|
2020-10-05 14:10:05 -04:00 |
|
Josh Patterson
|
f7daa391c7
|
Merge pull request #1453 from Security-Onion-Solutions/issue/1441
enable suricata threshold-file and point to proper file
|
2020-10-05 12:56:39 -04:00 |
|
Doug Burks
|
a45aa43f41
|
Add trailing comma to "thehive" stanza
|
2020-10-05 12:35:33 -04:00 |
|
m0duspwnens
|
63884b73e1
|
enable suricata threshold-file and point to proper file - https://github.com/Security-Onion-Solutions/securityonion/issues/1441
|
2020-10-05 12:10:52 -04:00 |
|
Wes Lambert
|
575da0f9d3
|
Change alert to case
|
2020-10-05 15:45:10 +00:00 |
|
weslambert
|
bc31e19e37
|
Put back rule.category for Wazuh alerts
|
2020-10-05 11:34:29 -04:00 |
|
weslambert
|
968dce0aee
|
Adjust Wazuh logging so we don't log alerts to a separate file and so we don't write a separate log file for non-JSON for archives
|
2020-10-05 10:03:40 -04:00 |
|
Jason Ertel
|
1ebe970876
|
Disable escalate button if thehive is not enabled
|
2020-10-05 09:54:18 -04:00 |
|
weslambert
|
6b292ea62b
|
Merge pull request #1448 from Security-Onion-Solutions/fix/so_elastic_clear
Fix/so elastic clear
|
2020-10-05 09:40:04 -04:00 |
|
Wes Lambert
|
da8957b4f4
|
Use Elasticsearch pillar vs manager IP for so-elastic-clear
|
2020-10-05 13:37:06 +00:00 |
|
Wes Lambert
|
1970d95d5f
|
Make Filebeat registry persistent to avoid re-reading old data
|
2020-10-05 13:30:04 +00:00 |
|
Doug Burks
|
e7cba6ba1d
|
Change SOC Alerts eventFetchLimit from 5000 to 500 #1447
|
2020-10-05 09:29:01 -04:00 |
|
Doug Burks
|
948e0c4c61
|
Add rule.name to Hunt Wazuh Alerts query #1442
|
2020-10-05 09:26:13 -04:00 |
|
Jason Ertel
|
cf5b1245ea
|
Add configurable flags to enable/disable dismiss and escalate buttons
|
2020-10-05 09:16:17 -04:00 |
|
Wes Lambert
|
77d31cb289
|
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 12:50:29 +00:00 |
|
Josh Brower
|
8a78485906
|
Config Playbook SOC Alerts
|
2020-10-04 21:35:42 -04:00 |
|
Josh Brower
|
c80b6ce104
|
Add so-allow-view and playbook event.sev.label
|
2020-10-04 20:39:21 -04:00 |
|
m0duspwnens
|
467e5b34cc
|
analyst node changes
|
2020-10-02 16:40:25 -04:00 |
|
m0duspwnens
|
20307b703e
|
analyst node changes
|
2020-10-02 16:21:31 -04:00 |
|
m0duspwnens
|
6a0f04d24a
|
analyst node changes
|
2020-10-02 16:14:15 -04:00 |
|
m0duspwnens
|
5a5007c07d
|
analyst node changes
|
2020-10-02 15:50:49 -04:00 |
|
m0duspwnens
|
fde6f128ab
|
analyst node changes
|
2020-10-02 15:26:13 -04:00 |
|
m0duspwnens
|
1be3323265
|
analyst node changes
|
2020-10-02 15:25:42 -04:00 |
|
m0duspwnens
|
47762816a7
|
analyst node changes
|
2020-10-02 14:57:22 -04:00 |
|
m0duspwnens
|
40647ce54c
|
analyst node changes
|
2020-10-02 14:40:15 -04:00 |
|
William Wernert
|
2a100c0dcc
|
Add OLD_ prefix + only update rules if playbook enabled
|
2020-10-02 14:34:30 -04:00 |
|
William Wernert
|
d0c267ca90
|
Fix sed command to not delete lines after match
|
2020-10-02 14:31:16 -04:00 |
|
William Wernert
|
54da2b869c
|
Add OLD_ db init files for soup compatibility
|
2020-10-02 14:12:23 -04:00 |
|
William Wernert
|
db12b6f3c6
|
Remove salt call to automation_user_create
|
2020-10-02 13:17:57 -04:00 |
|
William Wernert
|
96d32fda51
|
Add old api key to pillar during soup
|
2020-10-02 13:16:58 -04:00 |
|