693 Commits

Author	SHA1	Message	Date
Peter Di Giorgio	4b39ccec6d	Update zeek.bacnet_property	2022-11-03 15:30:20 -07:00
Peter Di Giorgio	b97c822800	Add zeek.bacnet_discovery and zeek.bacnet_property	2022-10-27 15:40:52 -07:00
Peter Di Giorgio	71e3b2d1fb	Create zeek.bacnet	2022-10-27 15:40:07 -07:00
Peter Di Giorgio	2b51d72585	Rename zeek.read_write_multiple_registers to zeek.modbus_read_write_multiple_registers	2022-10-25 17:20:01 -07:00
Peter Di Giorgio	7a60d0987c	Update zeek.conn to include client.oui	2022-10-21 13:02:01 -07:00
Peter Di Giorgio	9ac06057c1	Create zeek.read_write_multiple_registers	2022-10-21 13:00:12 -07:00
Peter Di Giorgio	e5c69c3236	Create zeek.modbus_mask_write_register	2022-10-21 12:58:36 -07:00
Peter Di Giorgio	39f050c6e4	Rename modbus_detailed to zeek.modbus_detailed	2022-10-21 12:56:59 -07:00
Peter Di Giorgio	4ee083759c	Rename dnp3_objects to zeek.dnp3_objects	2022-10-21 12:56:35 -07:00
Peter Di Giorgio	072bfd87b7	Create Ingest for Modbus Detailed	2022-10-21 12:53:30 -07:00
Peter Di Giorgio	b7aaaa80bb	Create Ingest for DNP3 Objects extension	2022-10-21 12:51:13 -07:00
bryant-treacle	82dff3e9da	Fix issues: 8591-8953	2022-08-30 13:48:53 +00:00
weslambert	8c694a7ca3	Disable ingest.geoip.downloader by default	2022-08-03 09:21:40 -04:00
weslambert	9ac640fa67	Remove airgap-specific logic for ingest.geoip.downloader	2022-08-03 09:21:03 -04:00
Wes Lambert	839cfcaefa	Update Elasticsearch defaults file and config.map.jinja to allow for local GeoIP database use when airgap is enabled	2022-08-02 14:32:17 +00:00
weslambert	2914007393	Add forward slash to fix issue with missing query path	2022-07-18 09:07:34 -04:00
Wes Lambert	b06c16f750	Add ingest node pipeline for Kratos	2022-07-08 15:53:00 +00:00
Mike Reeves	8b3d5e808e	Fix repo location	2022-06-30 13:30:56 -04:00
Mike Reeves	e86b7bff84	Fix repo location	2022-06-30 13:29:21 -04:00
weslambert	44595cb333	Merge pull request #8123 from Security-Onion-Solutions/foxtrot ... Merge foxtrot into dev	2022-06-14 15:44:13 -04:00
doug	025993407e	FIX: Add event.category field to pfsense firewall logs #8112	2022-06-13 08:03:44 -04:00
Josh Brower	8e368bdebe	Merge in upstream dev	2022-05-06 20:01:07 -04:00
weslambert	542db5b7f5	Update defaults.yaml	2022-04-21 17:24:24 -04:00
Josh Brower	2b39570b08	Fix matching logic	2022-04-18 10:37:38 -04:00
Josh Brower	886d69fb38	Compress + Clean ES & Logstash App Logs	2022-04-11 16:09:24 -04:00
weslambert	e6599cd10e	Update with changes from Abe's PR and other fixes	2022-03-25 13:57:44 -04:00
weslambert	c02d7fab50	Merge pull request #7636 from Security-Onion-Solutions/feature/rita ... Parsing of RITA Logs	2022-03-24 13:05:22 -04:00
Wes Lambert	fe1b72655b	Additional .keyword shims for process mappings	2022-03-24 16:45:06 +00:00
weslambert	1f2bca599f	Check cluster health before trying to load roles for ES	2022-03-23 11:00:26 -04:00
Wes Lambert	2487d468ab	Add RITA Elasticsearch ingest pipeline config	2022-03-22 17:38:22 +00:00
weslambert	7128b04636	Remove indices.query.bool.max_clause_count because it is dynamically allocated in Elastic 8	2022-03-17 21:20:41 -04:00
Wes Lambert	42d6c3a956	Replace Elastic connection check using ELASTICCURL with so-elasticsearch-query	2022-03-15 14:55:04 +00:00
Wes Lambert	5f56c7a261	Replace ELASTICCURL with so-elasticsearch-query	2022-03-15 14:32:00 +00:00
Wes Lambert	d12ff503c2	Chage role loading verbiage	2022-03-11 16:23:19 +00:00
Wes Lambert	dc258cf043	Load custom component templates in so-elasticsearch-templates-load	2022-03-11 16:22:55 +00:00
Wes Lambert	8e43a6e571	Don't generate index template if index_template definition is not present in pillar	2022-03-11 16:22:06 +00:00
m0duspwnens	e1e8a20e11	make sure values exist in data structure	2022-03-10 17:09:00 -05:00
weslambert	406267a892	Add process.name.keyword	2022-03-08 12:42:34 -05:00
Mike Reeves	4eb37fd5a9	Update init.sls	2022-03-07 15:09:36 -05:00
Mike Reeves	d33db6fb23	Only load pipelines on change	2022-03-07 14:25:46 -05:00
Wes Lambert	c549b20221	Add DTC client mappings	2022-03-07 18:36:26 +00:00
Mike Reeves	c67604590d	Only load templates on change	2022-03-07 09:52:18 -05:00
weslambert	fc3273fa49	Change to label fields to comply with what's defined in Filebeat template	2022-03-04 16:29:01 -05:00
weslambert	254cf53c2f	Increase clause count to 3500	2022-03-04 10:36:37 -05:00
Wes Lambert	ffae22beef	Add DTC syslog mappings for .keyword and add refs to defaults.yml	2022-03-04 13:04:11 +00:00
Wes Lambert	1f71816ad7	Add keyword subfield for DTC winlog mappings	2022-03-03 14:54:30 +00:00
Wes Lambert	1c086e36da	Add missing comma for file mappings	2022-03-03 13:49:54 +00:00
Wes Lambert	aa8d24b6cd	Add DTC destination, source, and winlog mapping references to templates in defaults file	2022-03-03 13:42:20 +00:00
Wes Lambert	85979cbce8	Add file, process, and winlog mapping changes	2022-03-03 13:37:27 +00:00
Wes Lambert	8f97f09c9c	Additional .keyword changes for host.hostname client.address, and event.action	2022-03-02 21:54:46 +00:00