dc945dad00
Remove Claude Sonnet 4 model configuration
...
Removed configuration for Claude Sonnet 4 model.
2025-12-09 11:00:53 -05:00
271f545f4f
Fixup Airgap
2025-12-06 15:26:44 -05:00
4bb0a7c9d9
Merge remote-tracking branch 'origin/2.4/dev' into idstools-refactor
2025-11-25 13:52:21 -05:00
ced3af818c
Refactor for Airgap
2025-11-25 13:51:50 -05:00
148ef7ef21
add default ruleset
2025-11-18 11:57:30 -05:00
45b4b1d963
ingest zeek analyzer.log + update dpd dashboard with analyzer tag
2025-11-14 15:47:29 -06:00
045cf7866c
Merge pull request #15225 from Security-Onion-Solutions/jertel/wip
...
pcap annotations
2025-11-14 08:37:37 -05:00
dcc3206e51
Add Enabled Flag to Models
2025-11-13 15:32:28 -07:00
cec1890b6b
pcap annotations
2025-11-13 16:15:47 -05:00
b1b66045ea
Change in prompt wording
2025-11-13 12:08:47 -07:00
33b22bf2e4
Shorten Prompt
2025-11-13 11:09:09 -07:00
3a38886345
CompressContextPrompt
2025-11-13 11:09:08 -07:00
9a6ff75793
Merge remote-tracking branch 'origin/2.4/dev' into idstools-refactor
2025-11-12 08:51:51 -05:00
44594ba726
Update defaults.yaml
2025-11-10 14:24:27 -05:00
2f6fb717c1
Merge remote-tracking branch 'origin/2.4/dev' into idstools-refactor
2025-11-06 10:38:37 -05:00
f80b090c93
Update limits
2025-10-31 14:48:30 -06:00
806173f7e3
Available Models
...
Utilizes Jason's new Array of Objects UI.
2025-10-31 14:07:30 -06:00
0994cd515a
Merge pull request #15161 from Security-Onion-Solutions/jertel/wip
...
add exclusion toggle
2025-10-21 09:36:45 -04:00
bdcd1e099d
add exclusion toggle
2025-10-21 09:33:41 -04:00
c8aad2b03b
New Config Entries
2025-10-14 13:24:43 -06:00
5a2e704909
New field for assistant health check
...
The health check has a smaller, configurable timeout.
2025-09-30 15:33:20 -06:00
d81d9a0722
small tweak to investigation prompt
2025-09-25 14:45:06 -04:00
ded520c2c1
Merge remote-tracking branch 'origin/2.4/dev' into idstools-refactor
2025-09-17 10:42:43 -04:00
a77157391c
remove idstools
2025-09-17 10:42:05 -04:00
aa43177d8c
Fix Setting Name
...
enabledInSoc => enabled
2025-09-08 09:13:25 -06:00
12959d114c
added threshold config fields for assistant
2025-09-08 09:13:25 -06:00
834e34128d
Non-dev URL
2025-09-08 09:13:23 -06:00
120e61e45c
ClientParams
...
Removed investigation prompt from module settings and moved to client settings, added enabledInSoc.
2025-09-08 09:13:23 -06:00
fc2d450de0
Update Settings
...
The apiKey will be built off of the license rather than a new setting. The model is hardcoded for now at the AI Gateway level. We're going to use the investigationPrompt as a trigger for the feature being visible in the UI but by default will be blank for now.
2025-09-08 09:13:22 -06:00
ec27517bdd
New Config Values
...
New config values with annotations and defaults.
Updated Nginx config to allow streaming requests to not be buffered on the way to the client.
2025-09-08 09:13:08 -06:00
2181cddf49
Move EnableReverseLookup
...
Move EnableReverseLookup and it's annotation from ClientParams to ServerConfig.
2025-09-02 14:09:55 -06:00
9cb42911dc
Merge branch '2.4/dev' into jertel/wip
2025-08-18 09:54:58 -04:00
a3cc6f025e
reports
2025-08-18 09:54:40 -04:00
84b38daf62
name destination_geo & source_geo to destination.as and source.as better aligning with ECS and linking other log sources already using .as for ASN geo data.
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-07-25 16:17:22 -05:00
6bb6c24641
Simplify UniFi dashboards #14838
2025-07-16 07:20:39 -04:00
4f8bd16910
FEATURE: Add SOC Dashboards for CEF, iptables, and UniFi logs #14838
2025-07-14 15:37:10 -04:00
ab9d03bc2e
FEATURE: Add SOC Dashboards for UniFi logs #14838
2025-07-14 12:21:08 -04:00
10bf3e8fab
FEATURE: Add SOC default fields for CEF logs #14837
2025-07-14 12:07:02 -04:00
f8108e93d5
FEATURE: Add SOC default fields for iptables logs #14836
2025-07-14 12:04:46 -04:00
42552810fb
Add user.name to kratos query
2025-07-08 09:50:08 -04:00
33c23c30d3
Refactors playbook repo configuration
...
Replaces individual playbook repo fields with an array of repos to support multiple playbook sources. Refactor Jinja.
2025-06-30 11:43:02 -06:00
a3b5db5945
Add support for Airgap for Playbooks
2025-06-06 16:17:14 -04:00
fc9107f129
Updated Playbook Repo Config
...
The repo and folder have changed. We're splitting out playbooks into their own repo: github.com/security-onion-solutions/securityonion-resources-playbooks.
2025-06-03 13:33:30 -06:00
0277891392
Use Stable branch
2025-06-02 13:10:13 -04:00
11fb33fdeb
Add RulesetName to Rule Repos
...
Fill in `rulesetName` in the rules repos of the ElastAlert and Strelka engines. These will act as an example to anybody adding their repos to these lists. The field is not required, but helps avoid collisions when managing repos as the value is used for the folder name. When not present, the final folder of the repo url is used as the rulesetName and as the folder name on disk.
Note that rulesetNames including a `/` will create extra folders in the path but the rulesetName will contain the slash, i.e. `rulesetName="joesecurity/sigma-rules"` will create the nested structure of `reposFolder/joesecurity/sigma-rules" containing the contents of the repo. All rules imported from this repo will have the ruleset of `joesecurity/sigma-rules`.
2025-05-19 14:19:56 -06:00
78b7068638
Playbook Settings
...
Map a folder from the manager's soc config folder to soc's sensoroni folder for storing the playbook repo.
Added playbook module section with default values.
2025-05-14 13:19:49 -06:00
a8cb18bb2e
Update defaults.yaml to replace remaining instances of identity_id with user.name
2025-05-08 09:09:26 -04:00
d47a798645
Show user.name instead of id
2025-05-07 11:17:00 -04:00
1ecf2b29fc
update default actions for subgrid support
2025-05-06 13:56:16 -04:00
21a64b6c1d
Add Client Parameter
...
Add groupItemsPerPage so detections groupby tables have proper default value for page size.
2025-03-05 09:43:21 -07:00
Mike Reeves
DefensiveDepth
reyesj2
Jason Ertel
Corey Ogburn
Jason Ertel
Matthew Wright
Doug Burks