  weslambertandGitHub
|
d96d696c35
|
Merge pull request #12735 from Security-Onion-Solutions/feature/cef
Add cef
|
2024-04-03 10:49:44 -04:00 |
|
|
Wes
|
105eadf111
|
Add cef
|
2024-04-03 14:40:41 +00:00 |
|
|
weslambertandGitHub
|
57553bc1e5
|
Merge pull request #12652 from Security-Onion-Solutions/feature/pfsense_suricata
FEATURE: pfSense Suricata logs
|
2024-03-25 10:10:13 -04:00 |
|
|
weslambertandGitHub
|
df058b3f4a
|
Merge branch '2.4/dev' into feature/pfsense_suricata
|
2024-03-25 10:08:03 -04:00 |
|
|
Wes
|
5e21da443f
|
Minor verbiage updates
|
2024-03-25 13:58:32 +00:00 |
|
|
weslambertandGitHub
|
e124791d5d
|
Merge pull request #12650 from Security-Onion-Solutions/fix/soc_template
FIX: http.response.status_code
|
2024-03-25 09:29:19 -04:00 |
|
|
weslambertandGitHub
|
4e1543b6a8
|
Get only code
|
2024-03-22 09:56:21 -04:00 |
|
|
Wes
|
5934829e0d
|
Include pfsense config
|
2024-03-21 20:08:33 +00:00 |
|
|
Wes
|
486a633dfe
|
Add pfsense Suricata config
|
2024-03-21 20:07:59 +00:00 |
|
|
weslambertandGitHub
|
77ac342786
|
Merge pull request #12632 from Security-Onion-Solutions/fix/remove_temp_yara
Remove temp YARA
|
2024-03-21 10:11:32 -04:00 |
|
|
weslambertandGitHub
|
8429a364dc
|
Remove Strelka rules watch
|
2024-03-21 10:09:36 -04:00 |
|
|
weslambertandGitHub
|
1568f57096
|
Remove Strelka config
|
2024-03-21 10:07:27 -04:00 |
|
|
weslambertandGitHub
|
f431e9ae08
|
Remove Strelka config
|
2024-03-21 10:06:25 -04:00 |
|
|
Wes
|
c6df805556
|
Add SOC template
|
2024-03-18 14:53:36 +00:00 |
|
|
weslambertandGitHub
|
34d5954e16
|
Fix indent
|
2024-03-11 09:12:05 -04:00 |
|
|
Wes
|
e8ae609012
|
Add Strelka rules watch back
|
2024-03-08 16:27:17 +00:00 |
|
|
Wes
|
fc66a54902
|
Add Strelka download and update scripts back
|
2024-03-08 16:26:14 +00:00 |
|
|
Wes
|
4e32935991
|
Add Strelka config back
|
2024-03-08 16:24:37 +00:00 |
|
|
weslambertandGitHub
|
1633527695
|
Merge pull request #12519 from Security-Onion-Solutions/fix/error_message_system_syslog
Add error.message mapping for system.syslog
|
2024-03-07 10:47:33 -05:00 |
|
|
Wes
|
005930f7fd
|
Add error.message mapping for system.syslog
|
2024-03-07 15:41:23 +00:00 |
|
|
weslambertandGitHub
|
185a160df0
|
Merge pull request #12500 from Security-Onion-Solutions/feature/additional_integrations_5
Additional Integrations #5
|
2024-03-05 16:12:05 -05:00 |
|
|
weslambertandGitHub
|
b9ebe6c40b
|
Update VERSION
|
2024-03-05 12:58:34 -05:00 |
|
|
weslambertandGitHub
|
bed42208b1
|
Add journald integration
|
2024-03-05 09:49:55 -05:00 |
|
|
weslambertandGitHub
|
2a7e5b096f
|
Change version for foxtrot
|
2024-03-05 09:48:59 -05:00 |
|
|
weslambertandGitHub
|
d8e8933ea0
|
Add AWS Security Hub template
|
2024-03-05 09:25:41 -05:00 |
|
|
weslambertandGitHub
|
d85ac39e28
|
Add AWS Inspector template
|
2024-03-05 09:23:17 -05:00 |
|
|
weslambertandGitHub
|
1514f1291e
|
Add AWS GuardDuty template
|
2024-03-05 09:21:48 -05:00 |
|
|
weslambertandGitHub
|
b64d61065a
|
Add AWS Cloudfront template
|
2024-03-05 09:19:43 -05:00 |
|
|
weslambertandGitHub
|
d1e55d5ab7
|
Merge pull request #12450 from Security-Onion-Solutions/fix/suricata_max_age
Roll Suricata logs daily to prevent alerts from being deleted when not meeting size threshold
|
2024-02-27 17:28:07 -05:00 |
|
|
weslambertandGitHub
|
df3943b465
|
Daily rollover
|
2024-02-27 17:24:27 -05:00 |
|
|
weslambertandGitHub
|
acf7dbdabe
|
Merge pull request #12432 from Security-Onion-Solutions/fix/endpoint_diag_template
Update pattern for endpoint diagnostic template
|
2024-02-26 12:01:29 -05:00 |
|
|
weslambertandGitHub
|
1d099f97d2
|
Update pattern for endpoint diagnostic template
|
2024-02-26 11:27:56 -05:00 |
|
|
weslambertandGitHub
|
91c1e595ef
|
Merge pull request #12297 from Security-Onion-Solutions/feature/pipeline_config_ui
Manage custom Elasticsearch and Logstash pipelines in UI
|
2024-02-01 09:18:30 -05:00 |
|
|
Wes
|
1818e134ca
|
Change numbers for Logstash
|
2024-02-01 14:01:55 +00:00 |
|
|
Wes
|
182667bafb
|
Change numbers for Elasticsearch
|
2024-02-01 13:59:23 +00:00 |
|
|
Wes
|
136097f981
|
Custom Logstash pipeline annotations
|
2024-01-31 21:47:09 +00:00 |
|
|
Wes
|
bc502cc065
|
Custom Elasticserach pipeline annotations
|
2024-01-31 21:46:33 +00:00 |
|
|
Wes
|
4672a5b8eb
|
Custom pipeline configuration in UI
|
2024-01-31 20:18:17 +00:00 |
|
|
Wes
|
1853dc398b
|
Custom pipeline configuration
|
2024-01-31 20:17:33 +00:00 |
|
|
Wes
|
bc75be9402
|
Custom pipelines in UI
|
2024-01-31 20:16:48 +00:00 |
|
|
Wes
|
cd4bd6460a
|
Custom pipelines
|
2024-01-31 20:16:18 +00:00 |
|
|
weslambertandGitHub
|
dc5ea89255
|
Merge pull request #12260 from Security-Onion-Solutions/fix/endpoint_diagnostic
Add template for endpoint.diagnostic.collection
|
2024-01-26 16:13:30 -05:00 |
|
|
Wes
|
12ab6338db
|
Add diagnostic
|
2024-01-25 20:16:52 +00:00 |
|
|
weslambertandGitHub
|
cd54d4becb
|
Fix indent
|
2024-01-25 13:57:02 -05:00 |
|
|
weslambertandGitHub
|
5f1c76f6ec
|
endpoint.diagnostic.collection
|
2024-01-25 09:46:25 -05:00 |
|
|
weslambertandGitHub
|
d2d70d1c5b
|
Merge pull request #12250 from Security-Onion-Solutions/fix/scan_pe_flags
Fix PE Flags
|
2024-01-24 14:29:23 -05:00 |
|
|
Wes
|
8426aad56d
|
Text mapping for scan.pe.flags
|
2024-01-24 15:10:42 +00:00 |
|
|
Wes
|
d23d367058
|
Make scan.pe.flags a string
|
2024-01-24 15:08:38 +00:00 |
|
|
weslambertandGitHub
|
cbdaf2e9a1
|
Merge pull request #12242 from Security-Onion-Solutions/upgrade/strelka_0.24.01.18
Fix quote
|
2024-01-23 14:02:35 -05:00 |
|
|
weslambertandGitHub
|
4d7af21dd5
|
Fix quote
|
2024-01-23 13:55:37 -05:00 |
|
|
weslambertandGitHub
|
8348506acc
|
Merge pull request #12240 from Security-Onion-Solutions/upgrade/strelka_0.24.01.18
UPGRADE: Strelka 0.24.01.18
|
2024-01-23 13:50:15 -05:00 |
|
|
weslambertandGitHub
|
1698d95efe
|
Use PLACEHOLDER for key values
|
2024-01-23 13:45:26 -05:00 |
|
|
weslambertandGitHub
|
b1052ddcce
|
Merge pull request #12241 from Security-Onion-Solutions/fix/leak_test
Exclude specific Strelka key values
|
2024-01-23 13:43:18 -05:00 |
|
|
weslambertandGitHub
|
0cb36bb0aa
|
Exclude StrelkaHexDump and PLACEHOLDER values
|
2024-01-23 13:39:59 -05:00 |
|
|
weslambertandGitHub
|
0ccdfcb07c
|
Exclude only offset_meta_key
|
2024-01-23 13:11:43 -05:00 |
|
|
weslambertandGitHub
|
63ba97306c
|
Exclude Strelka defaults
|
2024-01-23 13:05:58 -05:00 |
|
|
weslambertandGitHub
|
72319e33db
|
Avoid leak test triggering
|
2024-01-23 12:38:09 -05:00 |
|
|
weslambertandGitHub
|
34bb37e415
|
Merge pull request #12227 from Security-Onion-Solutions/feature/rita_logs
RITA Logs
|
2024-01-23 12:32:32 -05:00 |
|
|
Wes
|
3bcb0bc132
|
Update defaults
|
2024-01-23 17:18:54 +00:00 |
|
|
Wes
|
5542db0aac
|
Leave package version null
|
2024-01-22 21:07:46 +00:00 |
|
|
Wes
|
b08db3e05a
|
Add RITA policy
|
2024-01-22 20:16:43 +00:00 |
|
|
Wes
|
80a3942245
|
Rename RITA pipelines
|
2024-01-22 20:15:48 +00:00 |
|
|
weslambertandGitHub
|
de6151fbe2
|
Merge pull request #12221 from Security-Onion-Solutions/feature/additional_integrations_4
Additional integrations #4 - Part 1
|
2024-01-19 17:32:37 -05:00 |
|
|
Wes
|
7118cc8dee
|
Add additional integration SOC configuration
|
2024-01-19 22:04:07 +00:00 |
|
|
Wes
|
05aa8b013a
|
Add additional integration to templates
|
2024-01-19 22:02:39 +00:00 |
|
|
Wes
|
d0457cb61e
|
Add additional integrations to defaults
|
2024-01-19 22:00:38 +00:00 |
|
|
weslambertandGitHub
|
33d74098bd
|
Merge pull request #12201 from Security-Onion-Solutions/fix/suricata_ike
Add Suricata IKE pipeline
|
2024-01-17 16:50:19 -05:00 |
|
|
Wes
|
e70ce50912
|
Change description
|
2024-01-17 14:06:16 +00:00 |
|
|
Wes
|
f6590ac0bf
|
Remove Suricata IKEv2 pipeline
|
2024-01-16 18:10:00 +00:00 |
|
|
Wes
|
ea64ce92d3
|
Add Suricata IKE pipeline
|
2024-01-16 18:09:46 +00:00 |
|
|
Wes
|
8a92b023b2
|
Add interface name
|
2024-01-16 18:09:16 +00:00 |
|
|
weslambertandGitHub
|
790f5171a6
|
Merge pull request #12176 from Security-Onion-Solutions/fix/otx_pulses_template
FIX: OTX pulses template
|
2024-01-12 16:55:58 -05:00 |
|
|
weslambertandGitHub
|
252c51dafb
|
Change order of names
|
2024-01-12 16:45:18 -05:00 |
|
|
weslambertandGitHub
|
a07e6e1058
|
OTX pulses
|
2024-01-12 16:43:33 -05:00 |
|
|
weslambertandGitHub
|
3f9678056d
|
OTX pulses template
|
2024-01-12 16:42:32 -05:00 |
|
|
weslambertandGitHub
|
c895b6a274
|
Merge pull request #12173 from Security-Onion-Solutions/fix/endpoint_metrics_templates
Add endpoint metrics templates
|
2024-01-12 11:26:09 -05:00 |
|
|
Wes
|
418f41c7e4
|
Add SOC configuration for metrics
|
2024-01-12 15:03:18 +00:00 |
|
|
weslambertandGitHub
|
05679e79fc
|
Merge pull request #12171 from Security-Onion-Solutions/2.4/dev
Merge 2.4 dev
|
2024-01-12 08:50:15 -05:00 |
|
|
Wes
|
5eae349938
|
Add endpoint metrics templates
|
2024-01-12 13:47:35 +00:00 |
|
|
weslambertandGitHub
|
71c5e34e03
|
Merge pull request #12164 from Security-Onion-Solutions/fix/optional_integration_pillar_merge
Make sure optional integration pillar values are merged with defaults
|
2024-01-11 16:14:46 -05:00 |
|
|
weslambertandGitHub
|
880300d644
|
Move ELASTICFLEETMERGED import under allowed states
|
2024-01-11 14:58:21 -05:00 |
|
|
weslambertandGitHub
|
f5b59cacec
|
Move ELASTICFLEETMERGED import
|
2024-01-11 14:56:01 -05:00 |
|
|
weslambertandGitHub
|
ea5097f1b4
|
Add back curly brace
|
2024-01-11 14:51:01 -05:00 |
|
|
weslambertandGitHub
|
cc66daba1a
|
Make sure optional integration pillar values are merged with defaults
|
2024-01-11 14:49:39 -05:00 |
|
|
weslambertandGitHub
|
7bdc306ad4
|
Merge pull request #12160 from Security-Onion-Solutions/feature/additional_integrations_3
Additional Supported Integrations #3
|
2024-01-11 12:26:14 -05:00 |
|
|
weslambertandGitHub
|
5e1e685ce0
|
Exclude Cisco failed_attempts pipeline
|
2024-01-11 10:52:30 -05:00 |
|
|
Wes
|
c89d674a92
|
Add settings for integrations
|
2024-01-11 14:18:06 +00:00 |
|
|
Wes
|
9b1ddcacb4
|
Add additional templates for integrations
|
2024-01-11 14:00:09 +00:00 |
|
|
Wes
|
5703023008
|
Add additional packages
|
2024-01-11 13:59:38 +00:00 |
|
|
weslambertandGitHub
|
cfb5c1c9d2
|
Merge pull request #12063 from Security-Onion-Solutions/fix/curator_log_check
Ignore Curator logs
|
2023-12-20 17:47:17 -05:00 |
|
|
weslambertandGitHub
|
244968ce23
|
Remove unnecessary blank lines
|
2023-12-20 17:30:15 -05:00 |
|
|
weslambertandGitHub
|
65f89b22b2
|
Ignore Curator logs
|
2023-12-20 17:28:55 -05:00 |
|
|
weslambertandGitHub
|
7684aadb87
|
Merge pull request #12062 from Security-Onion-Solutions/fix/curator_remove
Curator Remove Changes
|
2023-12-20 15:16:47 -05:00 |
|
|
Wes
|
188744357f
|
Remove post since function doesn't exist
|
2023-12-20 19:14:14 +00:00 |
|
|
Wes
|
4baf4657f6
|
Curator cleanup
|
2023-12-20 19:10:22 +00:00 |
|
|
Wes
|
1006710226
|
Change Curator disable config
|
2023-12-20 18:26:27 +00:00 |
|
|
weslambertandGitHub
|
cd661027a6
|
Remove post for 2.4.40
|
2023-12-20 12:23:20 -05:00 |
|
|
weslambertandGitHub
|
ba2c51bee2
|
Merge pull request #12052 from Security-Onion-Solutions/fix/analyzer_images
Fix analyzer images
|
2023-12-19 14:30:19 -05:00 |
|
|
Wes
|
62708ac97d
|
Add new image
|
2023-12-19 18:58:17 +00:00 |
|
|
Wes
|
f8fdc6d14e
|
Remove old image
|
2023-12-19 18:57:54 +00:00 |
|