1074 Commits

Author	SHA1	Message	Date
Wes	a8c231ad8c	Add component templates	2024-05-31 17:47:01 +00:00
Wes	f396247838	Add index templates and lifecycle policies	2024-05-31 17:46:19 +00:00
Wes	2c635bce62	Set index for Suricata alerts	2024-05-30 17:02:31 +00:00
Wes	e831354401	Add Suricata alerts setting for configuration	2024-05-30 17:00:11 +00:00
Wes	55c5ea5c4c	Add template for Suricata alerts	2024-05-30 16:58:56 +00:00
DefensiveDepth	8e7c487cb0	Fix strelka rule.uuid	2024-05-23 05:59:31 -04:00
weslambert	f4490fab58	Add rule.uuid for YARA matches	2024-05-21 17:05:39 -04:00
weslambert	deb140e38e	Exclude detections from template name matching	2024-05-21 13:38:52 -04:00
m0duspwnens	cc6cb346e7	fix issue/13030	2024-05-16 16:31:45 -04:00
m0duspwnens	b54632080e	check if exists in override before popping	2024-05-16 16:04:17 -04:00
m0duspwnens	9796354b48	dont merge policy from global_overrides if not defined in default index_settings	2024-05-16 14:27:32 -04:00
weslambert	d606f259d1	Add detection alerts	2024-05-13 14:25:11 -04:00
weslambert	c8870eae65	Add detection alerts template	2024-05-13 14:23:47 -04:00
Doug Burks	26cb8d43e1	FIX: so-index-list typo #12988	2024-05-10 08:01:56 -04:00
Doug Burks	a1291e43c3	FIX: so-index-list typo #12988	2024-05-10 07:58:13 -04:00
m0duspwnens	5dc098f0fc	remove test file	2024-05-08 08:54:24 -04:00
m0duspwnens	dcc1f656ee	predownload logstash and elastic for new searchnode and heavynode	2024-05-07 10:13:51 -04:00
Wes	3285ae9366	Update mappings for detection fields	2024-05-01 20:11:56 +00:00
weslambert	fe2edeb2fb	30d to 60d	2024-05-01 11:01:59 -04:00
weslambert	6294f751ee	Cold min_age to 60d	2024-05-01 10:59:41 -04:00
Doug Burks	4d6124f982	FIX: Elasticsearch min_age regex #12885	2024-04-30 10:18:34 -04:00
reyesj2	fadb6e2aa9	Re-add original timestamp format + ignore failures with this processor ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:57:48 -04:00
reyesj2	192d91565d	Update final pipeline timestamp format for event.module system events ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:34:29 -04:00
weslambert	b424426298	Exclude suricata	2024-04-25 09:14:18 -04:00
Josh Patterson	03f9160fcc	Merge pull request #12860 from Security-Onion-Solutions/issue/12856 ... allow for enabled/disable of so-elasticsearch-indices-delete cronjob	2024-04-25 09:07:44 -04:00
m0duspwnens	d50de804a8	update annotation	2024-04-25 09:04:34 -04:00
weslambert	44afa55274	Fix comments about deletion	2024-04-24 17:41:37 -04:00
weslambert	ab832e4bb2	Include logstash-prefixed indices	2024-04-24 17:17:53 -04:00
m0duspwnens	c9d9979f22	allow for enabled/disable of so-elasticsearch-indices-delete cronjob	2024-04-24 16:18:45 -04:00
weslambert	59a02635ed	Change index sorting	2024-04-24 15:18:49 -04:00
weslambert	1b3a0a3de8	Remove hot max_age	2024-04-24 10:11:02 -04:00
weslambert	75b5e16696	Update description, type, and regex	2024-04-24 09:14:39 -04:00
weslambert	8a0a435700	Fix warm description	2024-04-24 08:35:19 -04:00
weslambert	691b02a15e	Fix warm description	2024-04-23 10:40:09 -04:00
Jorge Reyes	d402943403	Merge pull request #12773 from Security-Onion-Solutions/reyesj2/kismet ... Kismet integration for WiFi devices	2024-04-22 15:59:22 -04:00
Doug Burks	406dda6051	Update so-elasticsearch-cluster-space-used	2024-04-18 11:48:15 -04:00
Doug Burks	229a989914	Update so-elasticsearch-cluster-space-total	2024-04-18 11:47:01 -04:00
Mike Reeves	67a57e9df7	Update limited-analyst.json	2024-04-17 13:14:45 -04:00
reyesj2	55cf90f477	merge 2.4/dev ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 14:44:59 -04:00
reyesj2	68e016090b	Fix network.wireless.ssid not parsing ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 13:21:54 -04:00
reyesj2	fd689a4607	Fix typo in ingest pipeline ... Test to fix duplicate events in SOC, by removing conflicting field event.created Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 11:18:04 -04:00
reyesj2	7124f04138	Update ingest pipelines to match updated mappings ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-10 16:13:06 -04:00
reyesj2	4097e1d81a	Create mappings for Kismet integration ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-10 16:10:27 -04:00
Mike Reeves	2206553e03	Update analyst.json	2024-04-10 09:49:21 -04:00
DefensiveDepth	376efab40c	Ship Defender logs	2024-04-08 14:01:38 -04:00
Corey Ogburn	00cea6fb80	Detection Author as a Keyword instead of Text ... With Quick Actions added to Detections, as many fields should be usable as possible.	2024-04-05 11:22:47 -06:00
Wes	105eadf111	Add cef	2024-04-03 14:40:41 +00:00
reyesj2	000d15a53c	Kismet integration: TODO Elasticsearch mappings ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-03-29 13:56:01 -04:00
weslambert	df058b3f4a	Merge branch '2.4/dev' into feature/pfsense_suricata	2024-03-25 10:08:03 -04:00
Wes	5e21da443f	Minor verbiage updates	2024-03-25 13:58:32 +00:00