2770 Commits

Author	SHA1	Message	Date
Mike Reeves	4991ea8de3	Jason made me rename json	2020-10-01 18:07:06 -04:00
Mike Reeves	36ccece724	commas gone crazy	2020-10-01 18:02:06 -04:00
Mike Reeves	a0432e97b0	Python print ftl	2020-10-01 17:57:56 -04:00
Mike Reeves	490278a4c3	Add alert events filed	2020-10-01 17:49:17 -04:00
Mike Reeves	bd5efbabd9	Fix Mode	2020-10-01 17:43:43 -04:00
Mike Reeves	8fa426f265	Cleanup sync	2020-10-01 17:41:55 -04:00
Mike Reeves	9d9d3aac53	Switch to JSON from yaml	2020-10-01 17:37:57 -04:00
Mike Reeves	744a8bca73	More json for soc	2020-10-01 17:30:23 -04:00
Mike Reeves	8a41636e7f	More json for soc	2020-10-01 17:28:45 -04:00
Mike Reeves	dc79dca7fe	More json for soc	2020-10-01 17:25:51 -04:00
Mike Reeves	1c55f738ec	More json for soc	2020-10-01 17:23:29 -04:00
Mike Reeves	92fa33159e	More json for soc	2020-10-01 17:12:08 -04:00
Mike Reeves	5730c85988	More json for soc	2020-10-01 17:04:15 -04:00
Mike Reeves	63be0734c9	More json for soc	2020-10-01 17:00:25 -04:00
Mike Reeves	5653828154	More json for soc	2020-10-01 16:57:04 -04:00
Mike Reeves	cc2f2de5b5	soc.json stuff	2020-10-01 15:23:07 -04:00
Mike Reeves	b423e8d22a	soc.json stuff	2020-10-01 15:20:13 -04:00
Mike Reeves	1a561f6b12	soc.json stuff	2020-10-01 15:18:34 -04:00
Doug Burks	e836f96c65	move rule.uuid after rule.name	2020-10-01 12:09:52 -04:00
Doug Burks	4851069a10	remove rule.gid from Alerts groupby since Wazuh and Playbook may not have that field	2020-10-01 11:51:40 -04:00
Doug Burks	bc19cce4c2	Acknowledging an alert may acknowledge more alerts than intended #1426	2020-10-01 10:00:54 -04:00
Doug Burks	26781de244	Add Strelka query to Hunt #1433	2020-10-01 06:59:36 -04:00
weslambert	887937a75d	Remove rule sync, since we don't have any rules to sync	2020-09-30 18:35:35 -04:00
Jason Ertel	1454201505	Disable thehivealerter	2020-09-30 15:26:29 -04:00
Jason Ertel	3af6e9e1fe	Remove mount point for SOCtopus generated playbook rules to avoid them activating and sending alerts to TheHive	2020-09-30 15:14:45 -04:00
Mike Reeves	8b5ff31351	Merge pull request #1430 from Security-Onion-Solutions/redis ... Add Redis pillar and fix idstools	2020-09-30 15:09:59 -04:00
Mike Reeves	7314e2dea8	Add Redis pillar and fix idstools	2020-09-30 15:08:44 -04:00
Jason Ertel	ff04bb507a	Remove default Elastalert rules to stop automated alerts from being sent to thehive	2020-09-30 15:06:54 -04:00
Wes Lambert	02d2e5e2c6	Fix isue with null Zeek server IP	2020-09-30 17:53:30 +00:00
Wes Lambert	d8f70397f7	Fix Filebeat config for Wazuh	2020-09-30 14:57:56 +00:00
Wes Lambert	c62acf5e4e	Add initial implmentation of SOCtopus pillar	2020-09-30 14:24:15 +00:00
Josh Patterson	10f4e09b70	Merge pull request #1424 from Security-Onion-Solutions/issue/1070 ... Issue/1070	2020-09-30 10:11:37 -04:00
William Wernert	00785c6ba5	Merge pull request #1418 from Security-Onion-Solutions/feature/replace-hardcoded-pass ... Feature/replace hardcoded pass	2020-09-30 08:56:35 -04:00
m0duspwnens	85969dc16d	add quotes and remove quotes	2020-09-29 16:29:05 -04:00
m0duspwnens	bf99bab6c0	add quotes and remove quotes	2020-09-29 16:26:45 -04:00
Wes Lambert	36019727b3	Ensure IPs are typed as IP and ports as integer	2020-09-29 18:20:15 +00:00
William Wernert	7d43d48aca	Remove bad line in playbook_db_init.sh	2020-09-29 11:13:09 -04:00
William Wernert	55058a11aa	Generate passwords for Grafana + Playbook default users	2020-09-29 11:12:09 -04:00
Doug Burks	60134829d5	Alerts - Drilldown should display rule.uuid #1416	2020-09-29 07:51:45 -04:00
Doug Burks	c7b43ac220	Update soc.json	2020-09-29 07:41:49 -04:00
Doug Burks	a7f24b62e6	Hunt - improve NIDS query and eventFields #1415	2020-09-29 07:34:44 -04:00
Josh Patterson	9ca13ebccd	Merge pull request #1414 from Security-Onion-Solutions/issue/1404 ... change so salt module to /usr/sbin/so-status	2020-09-28 18:31:26 -04:00
Mike Reeves	c828a2ea75	Merge pull request #1413 from Security-Onion-Solutions/experimental ... Airgap SOUP!	2020-09-28 17:47:38 -04:00
m0duspwnens	8741520263	change so salt module to /usr/sbin/so-status	2020-09-28 17:31:05 -04:00
Mike Reeves	6b8b0f1b26	Change add registry	2020-09-28 16:48:02 -04:00
Wes Lambert	869767d9d9	Add initial parsing for Wazuh WEL/Sysmon	2020-09-28 19:04:21 +00:00
Josh Patterson	0944cd1bcd	Merge pull request #1408 from Security-Onion-Solutions/issue/1093 ... Issue/1093	2020-09-28 14:45:18 -04:00
Doug Burks	6e9e4dc99c	Hunt third magnifying glass should group output by event.module and event.dataset #1407	2020-09-28 14:19:55 -04:00
Mike Reeves	2cdf76473c	Add Registry back from cleanup	2020-09-28 14:19:43 -04:00
m0duspwnens	053b19de11	Merge remote-tracking branch 'remotes/origin/dev' into issue/1093	2020-09-28 13:25:42 -04:00