CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-08-12 02:37:01 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,591 Commits 30 Branches 128 Tags
539389c78e9cf30cc730ea9c229eb30b79f596b4
Commit Graph
18591 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jorge ReyesandGitHub 539389c78e Merge pull request #16148 from Security-Onion-Solutions/reyesj2-patch-495 
allow airgap installs to reuse previously extracted docker images
 2026-08-10 14:01:07 -05:00
Jorge ReyesandGitHub 65e81d3b3a Merge pull request #16146 from Security-Onion-Solutions/reyesj2-patch-1 
remove thehive scripted field from kibana saved objects
 2026-08-10 14:00:59 -05:00
Jason ErtelandGitHub 546462c77f Merge pull request #16149 from Security-Onion-Solutions/jertel/wip 
Use newer /api/joblookup endpoint
 2026-08-10 13:46:08 -04:00
Jason Ertel a7ddb7a975 Use newer /api/joblookup endpoint 2026-08-10 13:38:41 -04:00
reyesj2 23d92316c1 allow airgap installs to reuse previously extracted docker images 2026-08-09 16:37:21 -05:00
Jorge ReyesandGitHub e5346af068 Merge pull request #16147 from Security-Onion-Solutions/reyesj2-patch-3 
add some extra logging to so-minion log
 2026-08-07 12:55:56 -05:00
reyesj2 9762523849 add some extra logging to so-minion log 2026-08-07 11:52:51 -05:00
reyesj2 e8ab6433ab remove thehive scripted field from kibana saved objects 2026-08-06 14:03:27 -05:00
Jason ErtelandGitHub f1f672892e Merge pull request #16142 from Security-Onion-Solutions/jertel/wip 
fix template collation mismatches
 2026-08-05 16:45:41 -04:00
Jason Ertel a8053e2c9d exclude template0 2026-08-05 16:43:26 -04:00
Jason Ertel e998a21b4d fix template collation mismatches 2026-08-05 12:37:13 -04:00
Jason ErtelandGitHub d77760c268 Merge pull request #16133 from Security-Onion-Solutions/jertel/wip 
nginx configuration improvements
 2026-08-03 15:28:05 -04:00
Jason Ertel 4f7ad76d5b nginx configuration improvements 2026-08-03 15:19:18 -04:00
Mike ReevesandGitHub 41dba204c3 Merge pull request #16126 from Security-Onion-Solutions/TOoSmOotH-patch-1 
Bump version from 3.2.0 to 3.3.0
 2026-07-29 14:23:59 -04:00
Mike ReevesandGitHub 12bb16e89c Add version 3.3.0 to discussion template 2026-07-29 14:22:42 -04:00
Mike ReevesandGitHub 45f1a1b8b1 Bump version from 3.2.0 to 3.3.0 2026-07-29 14:21:50 -04:00
Mike ReevesandGitHub d3c6fdce7e Merge pull request #16124 from Security-Onion-Solutions/3.2.0 
3.2.0
 2026-07-29 13:53:18 -04:00
Mike Reeves c9642489d3 3.2.0 2026-07-29 13:48:13 -04:00
coreyogburnandGitHub 7b080797b4 Merge pull request #16122 from Security-Onion-Solutions/cogburn/gemma-mapping 
Investigator and Engineer Use Gemma
 2026-07-28 11:12:24 -06:00
Corey Ogburn d94c16eea1 Investigator and Engineer Use Gemma 2026-07-28 10:26:29 -06:00
coreyogburnandGitHub 3e3d409c42 Merge pull request #16121 from Security-Onion-Solutions/cogburn/update-agentmapping-defaults 
Change defaults
 2026-07-28 10:21:49 -06:00
Corey Ogburn a45ca12076 Change defaults 
We're no longer using DisplayName as the model identifier. Refactored to use id@adapter.
 2026-07-28 10:19:18 -06:00
Mike ReevesandGitHub 2e141a1ad7 Merge pull request #16119 from Security-Onion-Solutions/TOoSmOotH-patch-3 
Add Gemma configuration to defaults.yaml
 2026-07-27 12:18:47 -04:00
Mike ReevesandGitHub 4de8f0208f Add Gemma configuration to defaults.yaml 2026-07-27 12:15:21 -04:00
Josh BrowerandGitHub 4aabf7d638 Merge pull request #16118 from Security-Onion-Solutions/playbooks-airgap 
Support sigma playbooks for airgap
 2026-07-27 16:33:51 +02:00
Josh Brower 812310088e Support sigma playbooks for airgap 2026-07-27 10:30:50 -04:00
Josh PattersonandGitHub 4e17390cfa Merge pull request #16117 from Security-Onion-Solutions/saltthangs 
update vm state applid for pillar_push_map
 2026-07-27 10:25:00 -04:00
Josh Patterson 57d629683d update vm state applid for pillar_push_map 2026-07-27 10:14:10 -04:00
Jorge ReyesandGitHub 3666b5b0de Merge pull request #16116 from Security-Onion-Solutions/reyesj2-patch-0 
ignore all  TransformTask failures for so_kibana user
 2026-07-27 07:41:07 -05:00
reyesj2 7f64f143d7 ignore all TransformTask failures for so_kibana user 2026-07-26 19:25:51 -05:00
Mike ReevesandGitHub 162c66a705 Merge pull request #16115 from Security-Onion-Solutions/reyesj2-patch-0 
add sslverify=0 to minion repo config. Updates are pulled from the ma…
 2026-07-24 19:06:28 -04:00
reyesj2 14d11cc180 add sslverify=0 to minion repo config. Updates are pulled from the manager hosted repo 2026-07-24 16:59:42 -05:00
Josh BrowerandGitHub 112fcf7804 Merge pull request #16114 from Security-Onion-Solutions/fix/sigmapipelines 
Add already_running mapping
 2026-07-24 23:40:45 +02:00
Josh Brower 120b426a79 Add already_running mapping 2026-07-24 17:23:00 -04:00
Jorge ReyesandGitHub 72fd754a92 Merge pull request #16113 from Security-Onion-Solutions/reyesj2-pach-1 
run es-url-updae prior to upgrade
 2026-07-24 14:17:17 -05:00
reyesj2 d5fddafa6a run es-url-updae prior to upgrade 2026-07-24 13:33:48 -05:00
Jorge ReyesandGitHub 0c83d4e1fe Merge pull request #16112 from Security-Onion-Solutions/revert-16052-reyesj2-patch-2 
Revert "elastic fleet server persistence"
 2026-07-24 13:23:10 -05:00
Jorge ReyesandGitHub baca444a7e Revert "elastic fleet server persistence" 2026-07-24 13:18:48 -05:00
Josh PattersonandGitHub 4f5af93b38 Merge pull request #16111 from Security-Onion-Solutions/saltthangs 
Express the highstate schedule in minutes instead of hours
 2026-07-24 12:54:25 -04:00
Josh Patterson b109ca4e9b Express the highstate schedule in minutes instead of hours 
salt.schedule.highstate_interval_hours could not express a sub-hour
cadence, so an operator who disables salt.auto_apply had no way back to
the legacy 15-minute highstate. Rename the setting to
highstate_interval_minutes (default 120, behavior unchanged) and enforce
a 15-minute floor in SOC.

Non-manager splay is now a quarter of the interval clamped to [5, 30]
minutes, so a short interval no longer gets jitter larger than itself; at
the 120-minute default it stays 1800s. The so-salt-minion-check restart
threshold keeps its interval-plus-one-hour grace, now in minute math.
 2026-07-24 12:34:35 -04:00
Josh PattersonandGitHub e5969a12aa Merge pull request #16109 from Security-Onion-Solutions/fixESHEAP 
Add default esheap value so nodes highstate without the pillar value
 2026-07-24 09:04:58 -04:00
Jorge ReyesandGitHub 4d97b562eb Merge pull request #16106 from Security-Onion-Solutions/reyesj2-patch-9 
call highstate in soup with a retry if first fails vs bailing
 2026-07-23 15:50:11 -05:00
reyesj2 f2d81cea3f call highstate in soup with a retry if first fails vs bailing 2026-07-23 15:06:36 -05:00
Josh Patterson 6bd3c414bb Add default esheap value so nodes highstate without the pillar value 
Previously salt/vars/elasticsearch.map.jinja read the elasticsearch heap
size via a raw pillar access (INIT.PILLAR.elasticsearch.esheap). If the
esheap key was missing from a minion pillar, building GLOBALS raised
'dict object has no attribute esheap', cascading into every state that
imports GLOBALS (elasticsearch.enabled, logstash.config, telegraf.config,
etc.) and blocking highstate entirely.

Add an esheap default ('600m', matching the es_heapsize() floor) to
elasticsearch/defaults.yaml and fall back to it via dict .get() so a
missing pillar value degrades gracefully. The per-node pillar value still
wins when present.
 2026-07-23 15:16:26 -04:00
Josh BrowerandGitHub 16f958dac0 Merge pull request #16103 from Security-Onion-Solutions/defend-mapping 
Map av to both defender and defend
 2026-07-23 20:45:53 +02:00
Mike ReevesandGitHub a57ff5f89e Merge pull request #16104 from Security-Onion-Solutions/TOoSmOotH-patch-2 
Remove icsnpp-modbus from defaults.yaml
 2026-07-23 14:44:14 -04:00
Mike ReevesandGitHub e2513daddc Remove icsnpp-modbus from defaults.yaml 
Removed 'icsnpp-modbus' from the list of modules.
 2026-07-23 14:39:19 -04:00
Josh Brower 01a873b2d9 Map av to both defender and defend 2026-07-23 13:39:19 -04:00
Jorge ReyesandGitHub 19957d9530 Merge pull request #16099 from Security-Onion-Solutions/reyesj2-patch-7 
template updates
 2026-07-22 17:40:25 -05:00
reyesj2 e4c14a9294 add gc.log to log4j2 delete policy 2026-07-22 16:12:24 -05:00