Jason Ertel
31fdf15ce1
Merge branch '2.4/dev' into jertel/eaconfig
2024-05-20 18:59:35 -04:00
Jason Ertel
6b2219b7f2
elastalert settings
2024-05-20 18:52:37 -04:00
Corey Ogburn
6e97c39f58
Marked as Advanced
2024-05-20 14:52:05 -06:00
Corey Ogburn
026023fd0a
Annotate integrityCheckFrequencySeconds per det engine
2024-05-20 14:35:11 -06:00
Corey Ogburn
fcc72a4f4e
Add Default IntegrityCheck Frequency Values
2024-05-20 11:23:25 -06:00
Corey Ogburn
0cc57fc240
Change Compilation Report Path
...
Move compilation report path to /opt/so/state and mount that foulder in SOC
2024-05-17 15:47:23 -06:00
Jason Ertel
1c4d36760a
add support for custom alerters
2024-05-17 14:49:39 -04:00
DefensiveDepth
b4aec9a9d0
alphabetical order
2024-05-15 16:29:21 -04:00
Mike Reeves
8803ad4018
Update enabled.sls
2024-05-15 14:05:48 -04:00
Mike Reeves
7345d2c5a6
Update enabled.sls
2024-05-15 11:16:20 -04:00
Doug Burks
67645a662d
FEATURE: Add NetFlow dashboard #13009
2024-05-14 10:14:16 -04:00
Doug Burks
5b45c80a62
FEATURE: Add NetFlow dashboard #13009
2024-05-14 10:01:18 -04:00
DefensiveDepth
e430de88d3
Change rule updates to 24h
2024-05-13 13:15:06 -04:00
DefensiveDepth
c4c38f58cb
Update descriptions
2024-05-13 13:13:57 -04:00
Jason Ertel
45fd07cdf8
Merge pull request #12987 from Security-Onion-Solutions/jertel/testcy
...
Add quick action to find related alerts for a detection
2024-05-09 18:08:08 -04:00
Jason Ertel
fecd674fdb
Add quick action to find related alerts for a detection
2024-05-09 17:55:41 -04:00
Mike Reeves
ad9fdf064b
Update config.sls
2024-05-08 15:24:29 -04:00
Corey Ogburn
1da88b70ac
Specify Error Retry Wait and Error Limit for All Detection Engines
...
If a sync errors out, the engine will wait `communityRulesImportErrorSeconds` seconds instead of the usual `communityRulesImportFrequencySeconds` seconds wait.
If `failAfterConsecutiveErrorCount` errors happen in a row when syncing detections to ElasticSearch then the sync is considered a failure and will give up and try again later. This assumes ElasticSearch is the source of the errors and backs of in hopes it'll be able to fix itself.
2024-05-07 10:34:50 -06:00
Jason Ertel
b4817fa062
Merge pull request #12956 from Security-Onion-Solutions/jertel/testcy
...
test regexes for detections
2024-05-07 08:45:38 -07:00
Jason Ertel
4ebe070cd8
test regexes for detections
2024-05-06 19:03:12 -04:00
Josh Brower
b997e44715
Merge pull request #12939 from Security-Onion-Solutions/2.4/detections-airgap
...
Initial airgap support for detections
2024-05-06 15:46:29 -04:00
m0duspwnens
2431d7b028
Merge branch '2.4/detections-airgap' of https://github.com/Security-Onion-Solutions/securityonion into 2.4/detections-airgap
2024-05-06 15:27:27 -04:00
m0duspwnens
554a203541
update airgapEnabled in map file
2024-05-06 12:59:45 -04:00
DefensiveDepth
be1758aea7
Fix license and folder
2024-05-06 12:22:44 -04:00
m0duspwnens
38f74d2e9e
change quotes
2024-05-06 11:38:30 -04:00
m0duspwnens
5b966b83a9
change rulesRepos for airgap or not
2024-05-06 09:26:52 -04:00
Doug Burks
3f73b14a6a
FEATURE: Add event.dataset to all Events table layouts #12641
2024-05-06 09:20:47 -04:00
Doug Burks
f689cfcd0a
FEATURE: Add Events table columns for stun logs #12940
2024-05-06 08:52:43 -04:00
DefensiveDepth
26c6a98b45
Initial airgap support for detections
2024-05-06 08:43:01 -04:00
Doug Burks
7b905f5a94
FEATURE: Add Events table columns for tunnel logs #12937
2024-05-06 08:22:08 -04:00
Doug Burks
0822a46e94
FIX: Improve File dashboard #12914
2024-05-02 10:42:34 -04:00
Doug Burks
1be3e6204d
FIX: Improve File dashboard #12914
2024-05-02 10:38:56 -04:00
Josh Patterson
72b2503b49
Merge pull request #12906 from Security-Onion-Solutions/det_easr
...
Apply autoEnabledSigmaRules based on role if defined and default if not
2024-05-01 13:05:36 -04:00
m0duspwnens
47ba4c0f57
add new annotation for soc autoEnabledSigmaRules
2024-05-01 12:55:29 -04:00
Mike Reeves
10c8e4203c
Update config.sls
2024-05-01 12:54:21 -04:00
m0duspwnens
7122709bbf
set Sigma rules based on role if defined and default if not
2024-05-01 12:25:34 -04:00
Mike Reeves
f7223f132a
Update config.sls
2024-05-01 12:00:39 -04:00
Mike Reeves
8cd75902f2
Update config.sls
2024-05-01 11:47:51 -04:00
Corey Ogburn
ddf662bdb4
Mark Repos as Community
...
Indicate that detection rules pulled from configured repos should be marked as Community rules.
2024-04-29 16:22:30 -06:00
DefensiveDepth
f2c3c928fc
Sigma pivot fix and cleanup
2024-04-29 08:49:05 -04:00
DefensiveDepth
3c3ed8b5c5
Add runtime status logs
2024-04-24 16:33:47 -04:00
Jorge Reyes
d402943403
Merge pull request #12773 from Security-Onion-Solutions/reyesj2/kismet
...
Kismet integration for WiFi devices
2024-04-22 15:59:22 -04:00
DefensiveDepth
a237ef5d96
Update default queries
2024-04-19 16:33:35 -04:00
DefensiveDepth
ff28476191
Fix compile_yara path
2024-04-16 13:10:17 -04:00
DefensiveDepth
8cc4d2668e
Move compile_yara
2024-04-16 12:52:14 -04:00
DefensiveDepth
dbfb178556
Add test
2024-04-16 12:22:53 -04:00
DefensiveDepth
f5e42e73af
Add docs for ruleset change
2024-04-12 13:30:20 -04:00
DefensiveDepth
49ccd86c39
Fix fingerprint paths
2024-04-12 08:35:44 -04:00
reyesj2
55cf90f477
merge 2.4/dev
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:44:59 -04:00
reyesj2
c269fb90ac
Added a Kismet Wifi devices dashboard for an overview of kismet data
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:41:54 -04:00
