  weslambertandGitHub
|
65735fc4d3
|
Add eval and import roles
|
2023-11-02 09:54:01 -04:00 |
|
|
weslambertandGitHub
|
f9e2940181
|
Merge pull request #11676 from Security-Onion-Solutions/feature/sublime_platform_integration
Sublime Platform Integration
|
2023-11-01 16:13:57 -04:00 |
|
|
Wes
|
f33079f1e3
|
Make settings global
|
2023-11-01 20:09:56 +00:00 |
|
|
Wes
|
c32935e2e6
|
Remove optional integration from configuration if not enabled
|
2023-11-01 17:02:43 +00:00 |
|
|
Wes
|
655c88cd09
|
Make sure enabled_nodes is populated
|
2023-11-01 16:47:51 +00:00 |
|
|
Wes
|
bca1194a46
|
Sublime SOC Action
|
2023-11-01 14:01:55 +00:00 |
|
|
Wes
|
a0926b7b87
|
Load optional integrations
|
2023-11-01 13:59:24 +00:00 |
|
|
Wes
|
44e45843bf
|
Change optional integration Fleet configuration
|
2023-11-01 13:52:38 +00:00 |
|
|
Wes
|
9701d0ac20
|
Optional integration Fleet configuration
|
2023-11-01 13:47:20 +00:00 |
|
|
Wes
|
23ee9c2bb0
|
Sublime Platform integration
|
2023-11-01 13:41:40 +00:00 |
|
|
Wes
|
51247be6b9
|
Sublime Platform integration defaults
|
2023-11-01 13:37:52 +00:00 |
|
|
Wes
|
4dc64400c5
|
Support document_id
|
2023-11-01 13:36:32 +00:00 |
|
|
Wes
|
ae45d40eca
|
Add Sublime Platform ingest pipeline
|
2023-11-01 13:34:30 +00:00 |
|
|
weslambertandGitHub
|
5a85003952
|
Merge pull request #11664 from Security-Onion-Solutions/fix/elastic_import
Add import roles
|
2023-10-31 10:47:13 -04:00 |
|
|
weslambertandGitHub
|
c354924b68
|
Add import roles
|
2023-10-31 10:05:29 -04:00 |
|
|
weslambertandGitHub
|
ed6473a34b
|
Add roles for eval mode
|
2023-10-30 20:41:49 -04:00 |
|
|
weslambertandGitHub
|
9a1e95cd09
|
Merge pull request #11648 from Security-Onion-Solutions/fix/ilm_remove_policy
Remove ILM policies for Cases and OSQuery manager indices
|
2023-10-27 17:28:59 -04:00 |
|
|
weslambertandGitHub
|
76dd6f07ab
|
Remove policy for OSQuery manager indices
|
2023-10-27 17:26:33 -04:00 |
|
|
weslambertandGitHub
|
c955f9210a
|
Remove policy for Cases indices
|
2023-10-27 17:24:27 -04:00 |
|
|
Wes
|
891ea997e7
|
Add lifecycle policies and warm settings
|
2023-10-26 12:25:37 +00:00 |
|
|
weslambertandGitHub
|
0c2b3f3c62
|
Merge pull request #11600 from Security-Onion-Solutions/fix/suricata_pkt_src
Parse pkt_src for Suricata logs
|
2023-10-23 15:51:30 -04:00 |
|
|
weslambertandGitHub
|
660020cc76
|
Parse pkt_src for Suricata logs
|
2023-10-23 15:45:41 -04:00 |
|
|
weslambertandGitHub
|
5119e6c45a
|
Merge pull request #11570 from Security-Onion-Solutions/feature/additional_integrations
Additional integrations
|
2023-10-19 09:30:40 -04:00 |
|
|
Wes
|
c135f886a9
|
Remove Carbon Black Cloud integration
|
2023-10-18 20:41:34 +00:00 |
|
|
Wes
|
28b7a24cc1
|
Add templates for integrations
|
2023-10-18 20:36:04 +00:00 |
|
|
Wes
|
767a54c91b
|
Add pkgs
|
2023-10-18 20:07:26 +00:00 |
|
|
weslambertandGitHub
|
f0e380870d
|
Merge pull request #11567 from Security-Onion-Solutions/fix/mhr_docs
Add note regarding DNS resolver
|
2023-10-18 13:46:25 -04:00 |
|
|
weslambertandGitHub
|
34717fb65e
|
Add note regarding DNS resolver
|
2023-10-18 13:44:09 -04:00 |
|
|
weslambertandGitHub
|
830b5b9a21
|
Merge pull request #11560 from Security-Onion-Solutions/foxtrot
Elastic 8.10.4
|
2023-10-17 13:47:21 -04:00 |
|
|
weslambertandGitHub
|
06e731c762
|
Update VERSION
|
2023-10-17 13:33:12 -04:00 |
|
|
weslambertandGitHub
|
be2a829524
|
Elastic 8.10.4
|
2023-10-17 10:49:03 -04:00 |
|
|
weslambertandGitHub
|
8cab242ad0
|
Elastic 8.10.4
|
2023-10-17 10:48:31 -04:00 |
|
|
weslambertandGitHub
|
99054a2687
|
Elastic 8.10.4
|
2023-10-17 10:47:26 -04:00 |
|
|
weslambertandGitHub
|
adcb7840bd
|
Elastic 8.10.3
|
2023-10-17 10:38:20 -04:00 |
|
|
weslambertandGitHub
|
8db6fef92d
|
Elastic 8.10.3
|
2023-10-17 10:35:36 -04:00 |
|
|
weslambertandGitHub
|
24329e3731
|
Update config_saved_objects.ndjson
|
2023-10-17 10:34:38 -04:00 |
|
|
weslambertandGitHub
|
1db88bdbb5
|
Update so-common
|
2023-10-17 10:33:39 -04:00 |
|
|
weslambertandGitHub
|
7c2cdb78e9
|
Update VERSION
|
2023-10-17 10:31:53 -04:00 |
|
|
weslambertandGitHub
|
c02e491609
|
Merge pull request #11430 from Security-Onion-Solutions/fix/elastic_packages
Upgrade packages and load integrations when packages change
|
2023-09-28 14:10:39 -04:00 |
|
|
Wes
|
670cd19051
|
Exclude package upgrade script
|
2023-09-28 18:04:07 +00:00 |
|
|
Wes
|
8c44481ee1
|
Load templates after package changes
|
2023-09-28 17:57:31 +00:00 |
|
|
Wes
|
018186ccbd
|
Upgrade packages and load integrations when packages change
|
2023-09-28 16:43:56 +00:00 |
|
|
weslambertandGitHub
|
ceae22adab
|
Merge pull request #11423 from Security-Onion-Solutions/fix/elastic_known_certs
Exclude known_certs
|
2023-09-28 09:20:38 -04:00 |
|
|
weslambertandGitHub
|
202eb7e876
|
Exclude known_certs
|
2023-09-28 09:16:56 -04:00 |
|
|
weslambertandGitHub
|
4dc477cc1d
|
Merge pull request #11391 from Security-Onion-Solutions/fix/elasticsearch_strelka_image_version
Make scan.pe.image_version type of 'float'
|
2023-09-26 10:21:17 -04:00 |
|
|
Wes
|
0bba68769b
|
Make scan.pe.image_version type of 'float'
|
2023-09-26 14:05:12 +00:00 |
|
|
weslambertandGitHub
|
f9ace4791f
|
Merge pull request #11384 from Security-Onion-Solutions/fix/analyzers_testing
Add a note about testing analyzers outside of the Sensoroni Docker container
|
2023-09-25 14:48:45 -04:00 |
|
|
weslambertandGitHub
|
7cb9b5f257
|
Add the blank line that was removed from the previous commit
|
2023-09-25 14:41:20 -04:00 |
|
|
weslambertandGitHub
|
c95af6b992
|
Add a note about testing analyzers outside of the Sensoroni Docker container
|
2023-09-25 14:39:33 -04:00 |
|
|
weslambertandGitHub
|
2fc4d2923d
|
Merge pull request #11289 from Security-Onion-Solutions/fix/elastic_agent_404
/app/dashboards to /kibana/app/dashboards
|
2023-09-25 09:11:50 -04:00 |
|
|
Wes
|
eeeae08ec8
|
/app/ to /app/dashboards/
|
2023-09-21 18:39:06 +00:00 |
|
|
weslambertandGitHub
|
377802410e
|
Merge pull request #11352 from Security-Onion-Solutions/fix/import_evtx_exists
Fix EVTX Imports
|
2023-09-19 16:11:22 -04:00 |
|
|
Wes
|
2e0ea3f374
|
Set final pipeline
|
2023-09-19 13:33:12 +00:00 |
|
|
Wes
|
508260bd46
|
Use event.created for timestamp
|
2023-09-19 13:32:03 +00:00 |
|
|
Wes
|
a1e963f834
|
Reverse timestamps where necessary
|
2023-09-19 13:28:20 +00:00 |
|
|
Wes
|
5bac1e4d15
|
Show correct dates and Kibana URL for already processed EVTX files
|
2023-09-18 21:31:15 +00:00 |
|
|
weslambertandGitHub
|
fe1bae96ed
|
Merge pull request #11297 from Security-Onion-Solutions/fix/soc_idh
Change description to indicate that opencanary modules only apply to IDH nodes
|
2023-09-15 11:16:06 -04:00 |
|
|
weslambertandGitHub
|
eab6173a31
|
Merge pull request #11329 from Security-Onion-Solutions/fix/elastic_templates_clean
Clean component template directory
|
2023-09-15 11:00:17 -04:00 |
|
|
Wes
|
98499c3963
|
Clean component template directory
|
2023-09-15 13:51:46 +00:00 |
|
|
Wes
|
35ebbc974c
|
Change description to indicate that opencanary modules only apply to IDH nodes
|
2023-09-11 13:52:16 +00:00 |
|
|
Wes
|
f1d0db8171
|
/app to /kibana/app
|
2023-09-11 13:30:11 +00:00 |
|
|
weslambertandGitHub
|
70e1309c9f
|
Merge pull request #11261 from Security-Onion-Solutions/fix/remove_default_templates
Remove templates
|
2023-09-06 10:57:09 -04:00 |
|
|
Wes
|
cf19c8f8c2
|
Remove templates
|
2023-09-05 13:43:41 +00:00 |
|
|
weslambertandGitHub
|
b8f69b5008
|
Merge pull request #11239 from Security-Onion-Solutions/fix/syslog_heavynode
Add so-elastic-agent
|
2023-09-01 12:20:44 -04:00 |
|
|
weslambertandGitHub
|
765a22e6f0
|
Add so-elastic-agent
|
2023-09-01 11:31:23 -04:00 |
|
|
weslambertandGitHub
|
ce2a7135cb
|
Merge pull request #11232 from Security-Onion-Solutions/fix/strelka_entropy
Strelka entropy mapping
|
2023-08-31 11:21:00 -04:00 |
|
|
Wes
|
0fed757b11
|
Add entropy mapping
|
2023-08-31 15:10:27 +00:00 |
|
|
Wes
|
1a3b3b21fb
|
Change entropy value syntax
|
2023-08-31 15:09:19 +00:00 |
|
|
weslambertandGitHub
|
ac38f32e32
|
Merge pull request #11218 from Security-Onion-Solutions/feature/soc_administration_analyzers
Analyzer SOC Administration
|
2023-08-30 16:54:02 -04:00 |
|
|
weslambertandGitHub
|
41300af944
|
Set global to false
|
2023-08-30 16:30:32 -04:00 |
|
|
weslambertandGitHub
|
21e91a7537
|
Fix api_version
|
2023-08-30 16:10:38 -04:00 |
|
|
weslambertandGitHub
|
4127e0fc53
|
Merge pull request #11219 from Security-Onion-Solutions/fix/elastic_fortigate
Correct Fortigate Integration
|
2023-08-30 15:54:39 -04:00 |
|
|
weslambertandGitHub
|
d090852895
|
Correct fortigate template name
|
2023-08-30 15:40:40 -04:00 |
|
|
weslambertandGitHub
|
78915f900b
|
Add fortigate package
|
2023-08-30 15:37:30 -04:00 |
|
|
Wes
|
8cc19b0748
|
Add analyzer configuration description
|
2023-08-30 19:16:38 +00:00 |
|
|
Wes
|
fe690922de
|
Add analyzer configuration to the defaults file
|
2023-08-30 19:16:05 +00:00 |
|
|
weslambertandGitHub
|
bee83a320b
|
Merge pull request #11212 from Security-Onion-Solutions/fix/elastic_heavynode_syslog
Add syslog to heavynode
|
2023-08-30 10:48:03 -04:00 |
|
|
Wes
|
60b0af5ab7
|
Allow external syslog
|
2023-08-30 13:05:30 +00:00 |
|
|
Wes
|
0e22acc255
|
Add tcp and udp integration
|
2023-08-30 13:04:32 +00:00 |
|
|
Wes
|
655eea2b00
|
Add port_bindings
|
2023-08-30 13:03:56 +00:00 |
|
|
Wes
|
ce05f29dc4
|
Add port_bindings for port 514
|
2023-08-30 13:03:28 +00:00 |
|
|
weslambertandGitHub
|
7e12167b52
|
Merge pull request #11208 from Security-Onion-Solutions/fix/elasticsearch_syslog
Make sure a data stream is created for syslog
|
2023-08-30 08:37:39 -04:00 |
|
|
weslambertandGitHub
|
706a6e2d56
|
Make sure a data stream is created for syslog
|
2023-08-30 08:34:04 -04:00 |
|
|
weslambertandGitHub
|
f4191fb7fa
|
Merge pull request #11197 from Security-Onion-Solutions/feature/elastic_integration_apache
Add Apache package and templates
|
2023-08-29 11:27:08 -04:00 |
|
|
weslambertandGitHub
|
d2063c7e11
|
Add auditd reference back
|
2023-08-29 11:14:49 -04:00 |
|
|
weslambertandGitHub
|
c01a9006a6
|
Add Apache package
|
2023-08-29 11:01:22 -04:00 |
|
|
weslambertandGitHub
|
f118e25e8c
|
Add Apache references
|
2023-08-29 11:00:31 -04:00 |
|
|
weslambertandGitHub
|
d40bbf6b09
|
Add Apache templates
|
2023-08-29 10:59:40 -04:00 |
|
|
weslambertandGitHub
|
d4bffba736
|
Merge pull request #11153 from Security-Onion-Solutions/fix/elastic_fleet_integrations
Add more Elastic Fleet integrations
|
2023-08-23 16:22:14 -04:00 |
|
|
Wes
|
d2d0d53eef
|
Change order
|
2023-08-23 20:20:44 +00:00 |
|
|
Wes
|
31a49268cb
|
Add o365 and okta
|
2023-08-23 20:20:06 +00:00 |
|
|
Wes
|
2f51349ff8
|
Add SOC configuration
|
2023-08-23 20:07:42 +00:00 |
|
|
Wes
|
3f2793088a
|
Add templates
|
2023-08-23 19:02:50 +00:00 |
|
|
Wes
|
0f24c8e8bb
|
Add packages
|
2023-08-23 19:02:32 +00:00 |
|
|
weslambertandGitHub
|
4a582804b0
|
Merge pull request #11139 from Security-Onion-Solutions/fix/soc_event_fields
Update SOC event fields
|
2023-08-22 10:46:38 -04:00 |
|
|
weslambertandGitHub
|
563a495725
|
Add Playbook
|
2023-08-21 11:24:07 -04:00 |
|
|
weslambertandGitHub
|
9e18fe64cf
|
Remove OSSEC configuration
|
2023-08-21 11:20:47 -04:00 |
|
|
weslambertandGitHub
|
708a681ed9
|
Merge pull request #11123 from Security-Onion-Solutions/fix/elastic_fleet_zeek_console
Exclude console log
|
2023-08-21 10:31:32 -04:00 |
|
|
weslambertandGitHub
|
fa31bd4bf7
|
Exclude console log
|
2023-08-21 09:20:49 -04:00 |
|
|
weslambertandGitHub
|
488c4d5000
|
Merge pull request #11079 from Security-Onion-Solutions/fix/import_evtx_pcap
Assign pipeline to import
|
2023-08-17 12:29:01 -04:00 |
|