CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-20 16:03:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
11,026 Commits 18 Branches 120 Tags
4923fb1c3593670a476c311c81aa7f53c7b6f4d2
Commit Graph

414 Commits

Author SHA1 Message Date
m0duspwnens
d4c6834cd0 merge with 2.4/dev 2023-01-06 14:01:58 -05:00
m0duspwnens
cb1822a62d change ref to DOCKER.sosrange 2023-01-05 15:57:06 -05:00
Doug Burks
5754365c6d Improve default sysmon fields and add new network_connection fields 2023-01-04 07:42:24 -05:00
doug
4e5d1d587e update sysmon ingest parser and Sysmon File dashboard 2023-01-03 09:02:17 -05:00
Mike Reeves
058b4013aa Merge pull request #9470 from Security-Onion-Solutions/kilo 
Kilo
 2022-12-23 10:37:22 -05:00
m0duspwnens
24876eecd9 change refs from sosnet to sosbridge 2022-12-22 14:02:40 -05:00
Mike Reeves
3f0ded0638 Merge pull request #9464 from Security-Onion-Solutions/mkr24 
Add global annotation and influx support
 2022-12-22 13:57:56 -05:00
Mike Reeves
308228620a Specify Influxdb host 2022-12-22 13:05:33 -05:00
Jason Ertel
b6f37f8499 Correct indentation of client section 2022-12-22 10:26:51 -05:00
Jason Ertel
3fd210463e fix redis defaults to force string keys instead of numeric 2022-12-21 18:11:39 -05:00
Doug Burks
69415a0d8d Improve Strelka dashboard 2022-12-21 15:34:35 -05:00
Doug Burks
506556f0d2 Improve Firewall dashboard 2022-12-21 15:29:09 -05:00
Doug Burks
d7b2c88201 Improve Software dashboard 2022-12-21 15:24:58 -05:00
Doug Burks
4519c533a2 Improve Intel dashboard 2022-12-21 15:20:27 -05:00
m0duspwnens
accc293c8a 2.4 firewall changes 2022-12-21 15:03:45 -05:00
Doug Burks
3a367d69f4 Improve FTP dashboard 2022-12-21 14:37:17 -05:00
Doug Burks
a4f1f75306 Improve NIDS Alerts dashboard 2022-12-21 14:33:01 -05:00
Doug Burks
3d1ce4ef10 Improve SOC dashboards 2022-12-21 13:26:04 -05:00
Jason Ertel
fa7488effb change format of license key for compat with config alignment 2022-12-16 15:56:02 -05:00
Jason Ertel
b37697e95d Switch license key to single line to avoid multiline/list conflicts 2022-12-16 12:50:22 -05:00
Jason Ertel
7853d972b6 Set default key to empty string to ensure new keys are type aligned correctly 2022-12-15 18:31:47 -05:00
Jason Ertel
f84ceca03e consolidate eventFields from hunt and dashbaords into a single setting 2022-12-15 14:22:23 -05:00
Doug Burks
e1d200e6ce Remove duplicate TDS dashboard from defaults.yaml 2022-12-11 14:39:08 -05:00
Doug Burks
72f71ba695 Fix TDS dashboard in defaults.yaml 2022-12-11 14:36:27 -05:00
Doug Burks
cb16bd36fb fix descriptions in defaults.yaml 2022-12-10 14:31:59 -05:00
Doug Burks
cf7d8076e9 remove old Wazuh Hunt queries in defaults.yaml 2022-12-10 14:21:58 -05:00
Doug Burks
cd664b2d39 remove old Modbus dashboard from defaults.yaml 2022-12-10 14:16:39 -05:00
Doug Burks
7f07a94a98 remove old DNP3 and Wazuh dashboards from defaults.yaml 2022-12-10 14:14:24 -05:00
Doug Burks
187ca4c453 Update soc defaults.yaml to include dnp3_control and dnp3_objects eventfields 2022-12-10 07:33:09 -05:00
Jason Ertel
ef3def156d Switch back to older style redirect due to incompatibility with Ubuntu 18 2022-12-07 14:03:31 -05:00
Jason Ertel
9f72cfa1fc roll back to grep instead of pgrep due to cron issue 2022-12-07 12:08:31 -05:00
Jason Ertel
e849783a86 Reduce cron noise; ensure filecheck is restarted if modified 2022-12-07 08:36:56 -05:00
weslambert
73304e049c Merge pull request #9304 from Security-Onion-Solutions/feature/ics_scada_additions 
Port STUN, TDS, WireGuard, and ICS/SCADA Changes from 2.3 to 2.4
 2022-12-06 13:14:47 -05:00
weslambert
a626acced0 Add new ICS/SCADA event fields to the dashboards section of the configuration and remove extra space in key names. 2022-12-06 13:11:55 -05:00
Wes
1b5c1fecd4 Revert SOC default 'alerts' event fields and specify additional event fields for ICS/SCADA events 2022-12-06 17:28:30 +00:00
Wes
b048eec3c0 Add STUN, TDS, WireGuard, and ICS/SCADA dashboard queries 2022-12-06 17:17:49 +00:00
Wes
f44eee134a Add default queries and ICS/SCADA queries 2022-12-06 16:52:20 +00:00
Jason Ertel
fd13c7ccc0 Additional metadata for soc 2022-12-05 09:03:22 -05:00
m0duspwnens
b95a83b016 Merge remote-tracking branch 'remotes/origin/2.4/dev' into dockerips 2022-11-22 14:17:19 -05:00
Jason Ertel
7f7e5474ed Add more logging for filecheck monitoring, and ensure scripts are accessible to salt-relay 2022-11-17 10:43:05 -05:00
Jason Ertel
0ffef75d7b Move background jobs to cron 2022-11-17 09:50:41 -05:00
Jason Ertel
7cd5d625d1 temporarily remove salt-pipe for debug purposes 2022-11-16 20:45:50 -05:00
Jason Ertel
4497037442 Use bg:True to send cmd to background 2022-11-16 20:03:54 -05:00
m0duspwnens
75825617da add soc to sosnet 2022-11-15 17:13:25 -05:00
Jason Ertel
55f22af758 Merge pull request #9017 from Security-Onion-Solutions/config 
Retry so-user commands if another process is currently using so-user
 2022-10-27 15:41:37 -04:00
Jason Ertel
35fab05bdd Retry so-user commands if another process is currently using so-user 2022-10-27 15:25:08 -04:00
Jason Ertel
d7b370e31b Merge pull request #9010 from Security-Onion-Solutions/config 
regex should match entire input against allowed logLevel values
 2022-10-27 13:17:51 -04:00
Jason Ertel
6347532dd8 regex should match entire input against allowed logLevel values 2022-10-26 18:48:20 -04:00
m0duspwnens
998870ac87 Merge remote-tracking branch 'remotes/origin/2.4/dev' into statesglobals 2022-10-17 15:58:44 -04:00
Doug Burks
f6151b3895 Remove destination_geo.organization_name from Sysmon Network sankey diagram 2022-10-13 09:03:10 -04:00