Josh Patterson
|
4f8aaba6c6
|
Merge pull request #12918 from Security-Onion-Solutions/pw
run so-rule-update if ruleset or code changes for idstools
|
2024-05-02 16:33:24 -04:00 |
|
Josh Patterson
|
3b2d3573d8
|
Update pillarWatch.py
|
2024-05-02 16:06:04 -04:00 |
|
m0duspwnens
|
33d1170a91
|
add default pillar value for pillarWatch
|
2024-05-02 11:58:39 -04:00 |
|
Doug Burks
|
240ffc0862
|
Merge pull request #12915 from Security-Onion-Solutions/dougburks-patch-1
FIX: Improve File dashboard #12914
|
2024-05-02 10:44:58 -04:00 |
|
Doug Burks
|
0822a46e94
|
FIX: Improve File dashboard #12914
|
2024-05-02 10:42:34 -04:00 |
|
Doug Burks
|
1be3e6204d
|
FIX: Improve File dashboard #12914
|
2024-05-02 10:38:56 -04:00 |
|
weslambert
|
956ae7a7ae
|
Merge pull request #12909 from Security-Onion-Solutions/fix/detection_mappings
Update mappings for detection fields
|
2024-05-01 16:15:40 -04:00 |
|
Wes
|
3285ae9366
|
Update mappings for detection fields
|
2024-05-01 20:11:56 +00:00 |
|
Josh Patterson
|
72b2503b49
|
Merge pull request #12906 from Security-Onion-Solutions/det_easr
Apply autoEnabledSigmaRules based on role if defined and default if not
|
2024-05-01 13:05:36 -04:00 |
|
Mike Reeves
|
854799fabb
|
Merge pull request #12902 from Security-Onion-Solutions/TOoSmOotH-patch-2
Update config.sls
|
2024-05-01 12:56:04 -04:00 |
|
m0duspwnens
|
47ba4c0f57
|
add new annotation for soc autoEnabledSigmaRules
|
2024-05-01 12:55:29 -04:00 |
|
Mike Reeves
|
10c8e4203c
|
Update config.sls
|
2024-05-01 12:54:21 -04:00 |
|
Jason Ertel
|
05c69925c9
|
Merge pull request #12904 from Security-Onion-Solutions/jertel/wf
mark detections settings as read-only via the UI
|
2024-05-01 09:54:03 -07:00 |
|
Jason Ertel
|
252d9a5320
|
make rule settings advanced
|
2024-05-01 12:51:04 -04:00 |
|
m0duspwnens
|
7122709bbf
|
set Sigma rules based on role if defined and default if not
|
2024-05-01 12:25:34 -04:00 |
|
Mike Reeves
|
f7223f132a
|
Update config.sls
|
2024-05-01 12:00:39 -04:00 |
|
Mike Reeves
|
8cd75902f2
|
Update config.sls
|
2024-05-01 11:47:51 -04:00 |
|
Jason Ertel
|
c71af9127b
|
mark detections settings as read-only via the UI
|
2024-05-01 11:47:38 -04:00 |
|
weslambert
|
e6f45161c1
|
Merge pull request #12900 from Security-Onion-Solutions/fix/cold_min_age
Cold min_age to 60d
|
2024-05-01 11:24:48 -04:00 |
|
weslambert
|
fe2edeb2fb
|
30d to 60d
|
2024-05-01 11:01:59 -04:00 |
|
weslambert
|
6294f751ee
|
Cold min_age to 60d
|
2024-05-01 10:59:41 -04:00 |
|
Jason Ertel
|
ad1cda1746
|
Merge pull request #12893 from Security-Onion-Solutions/jertel/wf
update annotations for duplication
|
2024-05-01 06:32:13 -07:00 |
|
Jason Ertel
|
66563a4da0
|
zeek networks will only ever have one HOME_NETWORKS setting
|
2024-05-01 09:31:11 -04:00 |
|
Jason Ertel
|
d0e140cf7b
|
zeek networks will only ever have one HOME_NETWORKS setting
|
2024-05-01 09:30:52 -04:00 |
|
Jason Ertel
|
87c6d0a820
|
zeek networks will only ever have one HOME_NETWORKS setting
|
2024-05-01 09:29:36 -04:00 |
|
Doug Burks
|
9a25d3c30f
|
Merge pull request #12897 from Security-Onion-Solutions/dougburks-patch-1
FEATURE: Lower EVAL memory requirement to 8GB RAM #12896
|
2024-05-01 08:01:20 -04:00 |
|
Doug Burks
|
9a4a85e3ae
|
FEATURE: Lower EVAL memory requirement to 8GB RAM #12896
|
2024-05-01 07:54:38 -04:00 |
|
Jason Ertel
|
72db369fbb
|
Merge branch '2.4/dev' into jertel/wf
|
2024-04-30 15:16:41 -04:00 |
|
Jason Ertel
|
84db82852c
|
annotation updates for custom settings
|
2024-04-30 15:14:56 -04:00 |
|
coreyogburn
|
ea4750d8ad
|
Merge pull request #12882 from Security-Onion-Solutions/cogburn/community-repos
Mark Repos as Community
|
2024-04-30 09:12:25 -06:00 |
|
Doug Burks
|
e9944796c8
|
Merge pull request #12886 from Security-Onion-Solutions/dougburks-patch-1
FIX: Elasticsearch min_age regex #12885
|
2024-04-30 10:26:04 -04:00 |
|
Doug Burks
|
4d6124f982
|
FIX: Elasticsearch min_age regex #12885
|
2024-04-30 10:18:34 -04:00 |
|
Jorge Reyes
|
dd168e1cca
|
Merge pull request #12881 from Security-Onion-Solutions/2.4/finalpipefix
Update expected timestamp format in final pipeline for system events
|
2024-04-30 09:39:18 -04:00 |
|
Corey Ogburn
|
ddf662bdb4
|
Mark Repos as Community
Indicate that detection rules pulled from configured repos should be marked as Community rules.
|
2024-04-29 16:22:30 -06:00 |
|
reyesj2
|
fadb6e2aa9
|
Re-add original timestamp format + ignore failures with this processor
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-29 16:57:48 -04:00 |
|
reyesj2
|
192d91565d
|
Update final pipeline timestamp format for event.module system events
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-29 16:34:29 -04:00 |
|
Josh Patterson
|
82ef4c96c3
|
Merge pull request #12880 from Security-Onion-Solutions/issue/12878
set Suricata as default pcap engine for eval
|
2024-04-29 15:54:25 -04:00 |
|
m0duspwnens
|
a663bf63c6
|
set Suricata as default pcap engine for eval
|
2024-04-29 14:22:04 -04:00 |
|
Josh Brower
|
13ccb58f84
|
Merge pull request #12876 from Security-Onion-Solutions/2.4/sigmafix
Sigma pivot fix and cleanup
|
2024-04-29 09:12:09 -04:00 |
|
DefensiveDepth
|
f2c3c928fc
|
Sigma pivot fix and cleanup
|
2024-04-29 08:49:05 -04:00 |
|
Jason Ertel
|
3cbc29e767
|
Merge pull request #12875 from Security-Onion-Solutions/jertel/wf
restrict workflows to so
|
2024-04-29 05:16:07 -07:00 |
|
Jason Ertel
|
89cb8b79fd
|
restrict workflows to so
|
2024-04-29 08:07:19 -04:00 |
|
Mike Reeves
|
b5c5c7857b
|
Merge pull request #12846 from petiepooo/fix/check-srvc-status
check status before stopping service
|
2024-04-25 15:10:42 -04:00 |
|
Josh Patterson
|
ed05d51969
|
Merge pull request #12865 from Security-Onion-Solutions/issue/12637
only apply ulimits to suricata container if user enable mmap-locked
|
2024-04-25 10:08:05 -04:00 |
|
m0duspwnens
|
2c7eb3c755
|
only apply ulimits to suricata container if user enable mmap-locked
|
2024-04-25 10:05:59 -04:00 |
|
weslambert
|
cc17de2184
|
Merge pull request #12864 from Security-Onion-Solutions/fix/exclude_suricata
Exclude suricata from disk space-based index deletion
|
2024-04-25 09:23:38 -04:00 |
|
weslambert
|
b424426298
|
Exclude suricata
|
2024-04-25 09:14:18 -04:00 |
|
Josh Patterson
|
03f9160fcc
|
Merge pull request #12860 from Security-Onion-Solutions/issue/12856
allow for enabled/disable of so-elasticsearch-indices-delete cronjob
|
2024-04-25 09:07:44 -04:00 |
|
m0duspwnens
|
d50de804a8
|
update annotation
|
2024-04-25 09:04:34 -04:00 |
|
weslambert
|
983ef362e9
|
Merge pull request #12858 from Security-Onion-Solutions/fix/index_sorting
Change index sorting to account for older so-prefixed indices
|
2024-04-25 08:54:22 -04:00 |
|