638aca97c8
Merge pull request #15877 from Security-Onion-Solutions/reyesj2-patch-1
...
update redis index template
2026-05-13 13:44:04 -05:00
74a5c895e8
Merge pull request #15889 from Security-Onion-Solutions/reyesj2/zeek-ja4d
...
add zeek.ja4d ingest pipeline
2026-05-13 13:43:56 -05:00
d56bf01823
add zeek.ja4d ingest pipeline
2026-05-13 12:32:54 -05:00
d29267d9c2
Merge pull request #15888 from Security-Onion-Solutions/TOoSmOotH-patch-1
...
Change Telegraf output from BOTH to INFLUXDB
2026-05-13 12:47:55 -04:00
72327285b2
Change Telegraf output from BOTH to INFLUXDB
2026-05-13 11:58:21 -04:00
cc7a237457
Merge pull request #15887 from Security-Onion-Solutions/m0duspwnens-patch-1
...
remove stig from hypervisor and managerhype
2026-05-13 10:57:58 -04:00
b068ad2b35
remove stig from hypervisor and managerhype
2026-05-13 10:53:11 -04:00
b103f412b5
Merge pull request #15884 from Security-Onion-Solutions/reyesj2/strelkalnk
...
rename strelka ScanLNK - ScanLnk
2026-05-13 09:46:52 -05:00
ef79c63858
Merge branch '3/dev' of github.com:Security-Onion-Solutions/securityonion into reyesj2/strelkalnk
2026-05-12 15:20:09 -05:00
01fb1aa156
check pillars for ScanLNK and rename to ScanLnk
2026-05-12 15:19:44 -05:00
f19bdd7aae
Merge pull request #15883 from Security-Onion-Solutions/reyesj2/transformhealth
...
use temp files to prevent jq arg too long
2026-05-12 15:36:12 -04:00
f637dc62d1
use temp files to prevent jq arg too long
2026-05-12 13:29:32 -05:00
081f6fa1fb
Merge pull request #15878 from Security-Onion-Solutions/reyesj2/es-ingest-lag
...
add ingest latency metrics
2026-05-12 10:21:04 -05:00
d6d90d84cd
Merge pull request #15880 from Security-Onion-Solutions/feature/import-overrides
...
Initial commit
2026-05-12 17:00:44 +02:00
125610ed42
Additional test coverage
2026-05-12 10:11:22 -04:00
306b0af4d0
Initial commit
2026-05-12 09:55:06 -04:00
492ae80da7
add ingest latency metrics
2026-05-11 16:51:38 -05:00
4a2177c827
update redis index template
...
missing redis integration component templates
2026-05-11 16:15:56 -05:00
006ac31109
Merge pull request #15579 from marcopedrinazzi/3/dev
...
New Sigma rules pipeline mapping for M365 and Fortigate
2026-05-11 21:03:53 +02:00
49a643fff4
Merge pull request #15875 from Security-Onion-Solutions/3/sigma-fp-os
...
proc_creation per OS type
2026-05-08 15:13:14 +02:00
e1d830da76
proc_creation per OS type
2026-05-08 09:11:24 -04:00
e847c46129
Merge pull request #15872 from Security-Onion-Solutions/3/soc-logs
...
cleanup status code
2026-05-07 19:01:24 +02:00
499f7102bd
cleanup status code
2026-05-07 11:27:49 -04:00
4bc19f91ce
Merge pull request #15867 from Security-Onion-Solutions/fixhype
...
sanitize minion ids for hypervisor reactors / orchestration
2026-05-06 09:46:01 -04:00
4990d0ddea
Merge pull request #15866 from Security-Onion-Solutions/management-bond1
...
Management bond1
2026-05-05 17:17:58 -04:00
3e49322220
Allow preconfigured management bond in requirements
2026-05-05 15:35:12 -04:00
ecb92d43fc
Limit management bond setup to ISO installs
2026-05-05 15:30:09 -04:00
3b714db0bf
Show management bond option consistently
2026-05-05 15:22:40 -04:00
f17da4e68b
Add management bond setup option
2026-05-05 15:13:24 -04:00
04cfc22e3f
Merge pull request #15864 from Security-Onion-Solutions/reyesj2/patch-2
...
update grok type conversion to convert processor
2026-05-05 13:58:39 -05:00
dceed421ae
update grok type conversion to convert processor
2026-05-05 13:41:00 -05:00
652ac5d61f
fix regex
2026-05-05 14:26:04 -04:00
f888a2ba6b
Merge remote-tracking branch 'origin/3/dev' into fixhype
2026-05-05 10:28:49 -04:00
8a1ee02335
Merge pull request #15846 from Security-Onion-Solutions/feature/ensure-pyyaml
...
Ensure python3-pyyaml is installed before continuing setup
2026-05-05 10:24:25 -04:00
192f6cfe13
Merge remote-tracking branch 'origin/3/dev' into fixhype
2026-05-05 08:18:26 -04:00
5bca81d833
Merge pull request #15858 from Security-Onion-Solutions/security-fix
...
Fix unsafe PyYAML load in filecheck
2026-05-04 16:16:40 -04:00
1c6574c694
ensure minion ids
2026-05-04 14:03:14 -04:00
b701664e04
Fix unsafe PyYAML load in filecheck
2026-05-04 12:09:35 -04:00
bc64f1431d
Merge pull request #15857 from Security-Onion-Solutions/reyesj2/package-registry-health
...
fleet package registry health check
2026-05-04 11:05:23 -05:00
2203037ce7
fleet package registry health check
2026-05-04 10:52:37 -05:00
77a4ad877e
Merge pull request #15851 from Security-Onion-Solutions/reyesj2/integration-transforms
2026-05-01 14:11:12 -05:00
702b3585cc
excluding additional integration transform job failures
2026-05-01 12:57:59 -05:00
86966d2778
reauthorize unhealthy transform jobs using kibana 9.3.3 auth flow
2026-05-01 12:44:08 -05:00
ce3ad3a895
Merge pull request #15844 from Security-Onion-Solutions/reyesj2/elastic-agent-warning
...
update default elastic agent logging level to warning
2026-04-30 09:46:28 -05:00
3a4b7b50de
ensure python3-pyyaml is installed before continuing setup
2026-04-30 10:15:09 -04:00
39d0947102
update default elastic agent logging level to warning
2026-04-29 17:38:40 -05:00
0085d9a353
Merge pull request #15842 from Security-Onion-Solutions/reyesj2-patch-1
...
so-elastic-fleet-outputs-update now checks for cert drift. Remove run…
2026-04-29 12:37:04 -05:00
2f01ce3b23
so-elastic-fleet-outputs-update now checks for cert drift. Remove running --cert arg on cert change to prevent highstate from running outputs-update 2x
2026-04-29 12:33:28 -05:00
71b19c1b5f
Merge pull request #15840 from Security-Onion-Solutions/fix/import-postgres-firewall
...
Open postgres in DOCKER-USER firewall everywhere influxdb is open
2026-04-29 09:20:03 -04:00
82e55ae87f
Open postgres on every hostgroup that opens influxdb
...
The static defaults only listed postgres on each role's self-hostgroup,
leaving sensor/searchnode/heavynode/receiver/fleet/idh/desktop/hypervisor
hostgroups unable to reach the manager's so-postgres in distributed
grids. A dynamic block in firewall/map.jinja added postgres to those
hostgroups only when telegraf.output was switched to POSTGRES/BOTH,
which left postgres unreachable by default.
Mirror influxdb statically across manager/managerhype/managersearch/
standalone for every hostgroup that already lists influxdb, and drop
the now-redundant telegraf-gated dynamic block from firewall/map.jinja.
2026-04-29 09:09:50 -04:00
Jorge Reyes
Mike Reeves
Josh Patterson
Doug Burks
Josh Brower
Mike Reeves