  weslambertandGitHub
|
5e4bbcd4ca
|
Merge pull request #1483 from Security-Onion-Solutions/fix/strelka_rule_null_safe
Add null safe check for rule
|
2020-10-08 09:15:29 -04:00 |
|
|
Wes Lambert
|
a2e2f23a8d
|
Add null safe check for rule
|
2020-10-08 13:14:39 +00:00 |
|
|
weslambertandGitHub
|
3ec9206b17
|
Merge pull request #1482 from Security-Onion-Solutions/fix/network_transport_kibana_viz
Fix network transport Kibana viz
|
2020-10-08 08:18:12 -04:00 |
|
|
Wes Lambert
|
adf0ef87c9
|
Fix network transport Kibana viz
|
2020-10-08 12:17:15 +00:00 |
|
|
weslambertandGitHub
|
7767d3897b
|
Merge pull request #1481 from Security-Onion-Solutions/fix/network_transport_lower
Lowercase network.transport
|
2020-10-08 08:00:22 -04:00 |
|
|
weslambertandGitHub
|
5ada85942b
|
Lowercase network.transport
|
2020-10-08 07:59:57 -04:00 |
|
|
weslambertandGitHub
|
7befff3baa
|
Merge pull request #1474 from Security-Onion-Solutions/fix/common_nids
Don't use regex for determining rule type
|
2020-10-07 12:16:55 -04:00 |
|
|
Wes Lambert
|
7543144afe
|
Don't use regex for determining rule type
|
2020-10-07 16:15:43 +00:00 |
|
|
weslambertandGitHub
|
7787f81bdd
|
Merge pull request #1473 from Security-Onion-Solutions/fix/logstash_output_wazuh
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:49:40 -04:00 |
|
|
weslambertandGitHub
|
8e829b47ae
|
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:48:56 -04:00 |
|
|
weslambertandGitHub
|
8015676e01
|
Merge pull request #1472 from Security-Onion-Solutions/fix/rename-signature_info
Change rule.signature_info to rule.reference and ensure common.nids e…
|
2020-10-07 11:21:18 -04:00 |
|
|
Wes Lambert
|
015a441e79
|
Change rule.signature_info to rule.reference and ensure common.nids exists
|
2020-10-07 15:20:26 +00:00 |
|
|
weslambertandGitHub
|
a1866e5229
|
Merge pull request #1471 from Security-Onion-Solutions/fix/ingest-updates
Fix/ingest updates
|
2020-10-07 11:15:55 -04:00 |
|
|
Wes Lambert
|
f0a1457ffd
|
Update common.nids
|
2020-10-07 15:14:08 +00:00 |
|
|
Wes Lambert
|
8c07c098f6
|
Pipeline cleanup
|
2020-10-06 20:14:15 +00:00 |
|
|
Wes Lambert
|
350cc41740
|
Let zeek.common handle common fields for zeek.tunnels
|
2020-10-06 20:12:23 +00:00 |
|
|
weslambertandGitHub
|
a16419b997
|
Merge pull request #1466 from Security-Onion-Solutions/fix/so-elasticsearch-templates-load
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 13:19:54 -04:00 |
|
|
Wes Lambert
|
a6a69c57d1
|
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 17:18:42 +00:00 |
|
|
weslambertandGitHub
|
6cdff854f3
|
Merge pull request #1465 from Security-Onion-Solutions/feature/so-elasticsearch-templates-list
Add so-elasticsearch-templates-list
|
2020-10-06 13:16:11 -04:00 |
|
|
Wes Lambert
|
787f1d8732
|
Add so-elasticsearch-templates-list
|
2020-10-06 17:15:27 +00:00 |
|
|
weslambertandGitHub
|
1a2921c2bc
|
Merge pull request #1463 from Security-Onion-Solutions/feature/so-elasticsearch-pipelines-list
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 13:04:24 -04:00 |
|
|
Wes Lambert
|
4a5d50cf80
|
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 17:01:58 +00:00 |
|
|
weslambertandGitHub
|
706c81daca
|
Merge pull request #1459 from Security-Onion-Solutions/feature/strelka_yara_alert
Add Strelka YARA matches as alerts
|
2020-10-06 08:23:16 -04:00 |
|
|
Wes Lambert
|
019bec992d
|
Add Strelka YARA matches as alerts
|
2020-10-06 12:19:44 +00:00 |
|
|
weslambertandGitHub
|
9f4cb42c4f
|
Merge pull request #1452 from Security-Onion-Solutions/fix/kibana_case_create
Change alert to case
|
2020-10-05 11:46:14 -04:00 |
|
|
Wes Lambert
|
575da0f9d3
|
Change alert to case
|
2020-10-05 15:45:10 +00:00 |
|
|
weslambertandGitHub
|
f4fcc052ca
|
Merge pull request #1451 from Security-Onion-Solutions/fix/wazuh_rule_cat
Put back rule.category for Wazuh alerts
|
2020-10-05 11:35:20 -04:00 |
|
|
weslambertandGitHub
|
bc31e19e37
|
Put back rule.category for Wazuh alerts
|
2020-10-05 11:34:29 -04:00 |
|
|
weslambertandGitHub
|
6e2319f6da
|
Merge pull request #1449 from Security-Onion-Solutions/fix/wazuh_logging
Adjust Wazuh logging so we don't log alerts to a separate file and so…
|
2020-10-05 10:04:01 -04:00 |
|
|
weslambertandGitHub
|
968dce0aee
|
Adjust Wazuh logging so we don't log alerts to a separate file and so we don't write a separate log file for non-JSON for archives
|
2020-10-05 10:03:40 -04:00 |
|
|
weslambertandGitHub
|
6b292ea62b
|
Merge pull request #1448 from Security-Onion-Solutions/fix/so_elastic_clear
Fix/so elastic clear
|
2020-10-05 09:40:04 -04:00 |
|
|
Wes Lambert
|
da8957b4f4
|
Use Elasticsearch pillar vs manager IP for so-elastic-clear
|
2020-10-05 13:37:06 +00:00 |
|
|
Wes Lambert
|
1970d95d5f
|
Make Filebeat registry persistent to avoid re-reading old data
|
2020-10-05 13:30:04 +00:00 |
|
|
weslambertandGitHub
|
771d091d6e
|
Merge pull request #1446 from Security-Onion-Solutions/feature/wazuh_severity
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 08:52:20 -04:00 |
|
|
Wes Lambert
|
77d31cb289
|
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 12:50:29 +00:00 |
|
|
weslambertandGitHub
|
203e84d2cf
|
Update comma verbiage for HOME_NET in whiptail menu
|
2020-10-05 08:08:22 -04:00 |
|
|
weslambertandGitHub
|
2d2f4de337
|
Merge pull request #1437 from Security-Onion-Solutions/fix/kib_scripted_thehive
Update scripted field for TheHive case
|
2020-10-01 16:54:02 -04:00 |
|
|
Wes Lambert
|
8a81a5148b
|
Update scripted field for TheHive case
|
2020-10-01 20:52:57 +00:00 |
|
|
weslambertandGitHub
|
98bef8fb9d
|
Merge pull request #1436 from Security-Onion-Solutions/fix/kibana_soc_thehive_case
Add SOC url for api integration
|
2020-10-01 16:47:11 -04:00 |
|
|
Wes Lambert
|
eced18c3cc
|
Add SOC url for api integration
|
2020-10-01 20:29:28 +00:00 |
|
|
weslambertandGitHub
|
6818de9e64
|
Merge pull request #1431 from Security-Onion-Solutions/fix/elastlert_rules
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:36:11 -04:00 |
|
|
weslambertandGitHub
|
887937a75d
|
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:35:35 -04:00 |
|
|
weslambertandGitHub
|
5b16a65422
|
Merge pull request #1429 from Security-Onion-Solutions/fix/zeek_server_ip
Fix issue with null Zeek server IP
|
2020-09-30 13:54:50 -04:00 |
|
|
Wes Lambert
|
02d2e5e2c6
|
Fix isue with null Zeek server IP
|
2020-09-30 17:53:30 +00:00 |
|
|
weslambertandGitHub
|
defe832121
|
Merge pull request #1427 from Security-Onion-Solutions/fix/wazuh_filebeat
Fix Filebeat config for Wazuh
|
2020-09-30 10:59:01 -04:00 |
|
|
Wes Lambert
|
d8f70397f7
|
Fix Filebeat config for Wazuh
|
2020-09-30 14:57:56 +00:00 |
|
|
weslambertandGitHub
|
dac2ad5dbf
|
Merge pull request #1425 from Security-Onion-Solutions/feature/soctopus_pillar
Add initial implementation of SOCtopus pillar
|
2020-09-30 10:25:26 -04:00 |
|
|
Wes Lambert
|
c62acf5e4e
|
Add initial implmentation of SOCtopus pillar
|
2020-09-30 14:24:15 +00:00 |
|
|
weslambertandGitHub
|
401764437f
|
Merge pull request #1421 from Security-Onion-Solutions/fix/ip_type
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 14:21:25 -04:00 |
|
|
Wes Lambert
|
36019727b3
|
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 18:20:15 +00:00 |
|
|
weslambertandGitHub
|
3d6c956e02
|
Merge pull request #1409 from Security-Onion-Solutions/feature/wazuh_wel
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 15:07:15 -04:00 |
|
|
Wes Lambert
|
869767d9d9
|
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 19:04:21 +00:00 |
|
|
weslambertandGitHub
|
6bfef773f2
|
Merge pull request #1392 from Security-Onion-Solutions/bugfix/config_dev_nullify
dev nullify so-config-backup cron job
|
2020-09-24 21:00:18 -04:00 |
|
|
weslambertandGitHub
|
b3f9ee3b34
|
dev nullify so-config-backup cron job
|
2020-09-24 20:59:42 -04:00 |
|
|
weslambertandGitHub
|
a09002edae
|
Merge pull request #1384 from Security-Onion-Solutions/bugfix/config_backup
Add back missing # sign
|
2020-09-23 21:34:52 -04:00 |
|
|
weslambertandGitHub
|
5b93c40ce4
|
Add back missing # sign
|
2020-09-23 21:34:10 -04:00 |
|
|
weslambertandGitHub
|
4f228c1b7c
|
Merge pull request #1379 from Security-Onion-Solutions/feature/config_backup
Feature/config backup
|
2020-09-23 09:58:05 -04:00 |
|
|
Wes Lambert
|
71734ddc0a
|
Add cron job to common state for daily config backup
|
2020-09-23 13:55:32 +00:00 |
|
|
Wes Lambert
|
57732b360e
|
Add config backup script
|
2020-09-23 13:47:14 +00:00 |
|
|
Wes Lambert
|
4d42d04cc3
|
Fix backup pillar definition
|
2020-09-23 13:45:42 +00:00 |
|
|
Wes Lambert
|
d02c440934
|
Add backup params to global.sls
|
2020-09-22 21:05:57 +00:00 |
|
|
weslambertandGitHub
|
74e4adda11
|
Merge pull request #1357 from Security-Onion-Solutions/feature/dashboard_updates_2
Add All Logs for Connections dashboard
|
2020-09-16 11:56:38 -04:00 |
|
|
Wes Lambert
|
44ef935d65
|
Add All Logs for Connections dashboard
|
2020-09-16 15:55:28 +00:00 |
|
|
weslambertandGitHub
|
6325b30a21
|
Merge pull request #1356 from Security-Onion-Solutions/feature/dashboard_updates
Kibana dashboard updates
|
2020-09-16 11:19:27 -04:00 |
|
|
Wes Lambert
|
bd8d2fc271
|
Kibana dashboard updates
|
2020-09-16 15:17:26 +00:00 |
|
|
weslambertandGitHub
|
6806bd2461
|
Merge pull request #1348 from Security-Onion-Solutions/bugfix/es_template_load
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:15:56 -04:00 |
|
|
weslambertandGitHub
|
fbf037f460
|
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:14:06 -04:00 |
|
|
weslambertandGitHub
|
b6b52671e2
|
Merge pull request #1294 from Security-Onion-Solutions/fix/wazuh_agent_name
Fix typo
|
2020-09-05 08:17:09 -04:00 |
|
|
Wes Lambert
|
f9884606df
|
Fix typo
|
2020-09-05 12:15:55 +00:00 |
|
|
weslambertandGitHub
|
b10dd40376
|
Merge pull request #1287 from Security-Onion-Solutions/fix/suri_home_net
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:51 -04:00 |
|
|
weslambertandGitHub
|
8db8dcb71a
|
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:14 -04:00 |
|
|
weslambertandGitHub
|
870e042c4c
|
Merge pull request #1285 from Security-Onion-Solutions/fix/so_stop_start_restart
Require at least one arg for start/stop/restart scripts
|
2020-09-02 14:58:19 -04:00 |
|
|
Wes Lambert
|
770aaf415c
|
Require at least on arg for start/stop/restart scripts
|
2020-09-02 18:55:59 +00:00 |
|
|
weslambertandGitHub
|
d35cca7fc5
|
Merge pull request #1278 from Security-Onion-Solutions/fix/elastalert_extra_hosts
Add manager to hosts file
|
2020-09-02 07:44:49 -04:00 |
|
|
weslambertandGitHub
|
5d920885e0
|
Add manager to hosts file
|
2020-09-02 07:43:55 -04:00 |
|
|
weslambertandGitHub
|
011958a2f3
|
Merge pull request #1274 from Security-Onion-Solutions/fix/zeek_syslog
Ensure Zeek syslog log is enabled for Import node
|
2020-08-31 13:08:44 -04:00 |
|
|
Wes Lambert
|
ae3fe9e892
|
Ensure Zeek syslog log is enabled for Import node
|
2020-08-31 17:07:16 +00:00 |
|
|
weslambertandGitHub
|
96f25914db
|
Merge pull request #1273 from Security-Onion-Solutions/fix/zeek_syslog_default
Fix/zeek syslog default
|
2020-08-31 12:32:52 -04:00 |
|
|
Wes Lambert
|
5ed5e6603d
|
Fix space
|
2020-08-31 16:32:12 +00:00 |
|
|
Wes Lambert
|
26ffc44fd1
|
Only enable syslog log by default in Eval mode
|
2020-08-31 16:30:32 +00:00 |
|
|
weslambertandGitHub
|
6350c83e05
|
Merge pull request #1272 from Security-Onion-Solutions/feature/wazuh_mgmt_wrappers
Add Wazuh mgmt wrappers for manage_agents and upgrade
|
2020-08-31 10:55:25 -04:00 |
|
|
Wes Lambert
|
46e7e121e3
|
Add Wazuh mgmt wrappers for manage_agents and upgrade
|
2020-08-31 14:54:24 +00:00 |
|
|
weslambertandGitHub
|
5db70cbd59
|
Merge pull request #1271 from Security-Onion-Solutions/fix/remove_minio
Remove minio for now
|
2020-08-31 10:29:30 -04:00 |
|
|
Wes Lambert
|
6d14f2af96
|
Remove minio for now
|
2020-08-31 14:07:47 +00:00 |
|
|
weslambertandGitHub
|
42bd75a1cc
|
Merge pull request #1270 from Security-Onion-Solutions/fix/elastalert_startup
Wait for Elasticsearch indices to be queryable before starting Elasta…
|
2020-08-31 09:56:18 -04:00 |
|
|
Wes Lambert
|
9abbda8e04
|
Wait for Elasticsearch indices to be queryable before starting Elastalert container
|
2020-08-31 13:54:49 +00:00 |
|
|
weslambertandGitHub
|
509985ed07
|
Merge pull request #1254 from Security-Onion-Solutions/fix/sensor_clean
Cron updates
|
2020-08-26 11:03:03 -04:00 |
|
|
weslambertandGitHub
|
000c2abb33
|
Update timing for so-yara-update
|
2020-08-26 11:02:33 -04:00 |
|
|
weslambertandGitHub
|
ce49e050bc
|
Update timing for sensor clean cron
|
2020-08-25 12:14:43 -04:00 |
|
|
weslambertandGitHub
|
61cc5b9712
|
Merge pull request #1246 from Security-Onion-Solutions/fix/sensor_clean_log
Fix/sensor clean log
|
2020-08-25 11:36:10 -04:00 |
|
|
Wes Lambert
|
c03812f7ab
|
Add rotation for sensor_clean log
|
2020-08-25 15:34:30 +00:00 |
|
|
weslambertandGitHub
|
a8f727ad40
|
Don't write to log if not past CRIT_DISK_USAGE
|
2020-08-25 11:19:36 -04:00 |
|
|
weslambertandGitHub
|
12a9d26231
|
Merge pull request #1223 from Security-Onion-Solutions/fix/aws_fwd_defaults
Add defaults file for fwdnode
|
2020-08-20 10:17:21 -04:00 |
|
|
Wes Lambert
|
3f04e566f2
|
Add defaults file for fwdnode
|
2020-08-20 14:16:05 +00:00 |
|
|
weslambertandGitHub
|
d80156505c
|
Merge pull request #1217 from Security-Onion-Solutions/fix/aws_automation
Add defaults file for search node
|
2020-08-19 15:09:00 -04:00 |
|
|
Wes Lambert
|
ed1e346789
|
Add defaults file for search node
|
2020-08-19 19:07:24 +00:00 |
|
|
weslambertandGitHub
|
d25afe4aa5
|
Merge pull request #1216 from Security-Onion-Solutions/fix/logstash_hosts
Add manager IP to container hosts file
|
2020-08-19 14:39:04 -04:00 |
|
|
weslambertandGitHub
|
b5dd868d1b
|
Add manager IP to container hosts file
|
2020-08-19 14:34:28 -04:00 |
|
|
weslambertandGitHub
|
ca84ae43ef
|
Merge pull request #1208 from Security-Onion-Solutions/fix/remove_pillar_from_setup
Don't echo pillar to setup log
|
2020-08-18 15:44:20 -04:00 |
|
|
weslambertandGitHub
|
a4e986ea37
|
Don't echo pillar to setup log
|
2020-08-18 15:43:43 -04:00 |
|