CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
11,435 Commits 40 Branches 127 Tags
663af7935b88ba49e05ab2cfe9cd7d91bfbfb40f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub ee311de9c8 Merge pull request #9841 from Security-Onion-Solutions/fix/soc_analyzers_analyzerNodeId 
Change 'GLOBALS.minion_id' to 'GLOBALS.hostname' for 'analyzerNodeId' value to ensure SOC creates analyzer jobs in the correct directory
 2023-02-22 16:26:03 -05:00
weslambertandGitHub ecf70847fd Change 'GLOBALS.minion_id' to 'GLOBALS.hostname' for 'analyzerNodeId' value to ensure SOC creates analyzer jobs in the correct directory 2023-02-22 16:23:48 -05:00
weslambertandGitHub 5e94a2cd74 Merge pull request #9790 from Security-Onion-Solutions/fix/kibana_default_data_view 
Change default data view from '*:so-*' to 'logs-*'
 2023-02-15 14:21:55 -05:00
weslambertandGitHub b7ad4e0570 Change default data view from 'so-*' to 'logs-*' 2023-02-15 14:19:29 -05:00
weslambertandGitHub 967440f49f Merge pull request #9789 from Security-Onion-Solutions/fix/kibana_visualization_index-pattern_reference 
Replace 'so-*' index-pattern reference with 'logs-*' for Kibana dashboard visualizations
 2023-02-15 11:33:44 -05:00
Wes 790b3c5635 Replace 'so-*' index-pattern reference with 'logs-*' for Kibana dashboard visualizations 2023-02-15 16:30:56 +00:00
weslambertandGitHub 689ba5f341 Merge pull request #9778 from Security-Onion-Solutions/fix/filebeat_remove_docker_image 
Remove 'so-filebeat' from list of trusted containers
 2023-02-13 10:00:36 -05:00
weslambertandGitHub 40d3269db3 Remove 'so-filebeat' from list of trusted containers 2023-02-13 09:58:39 -05:00
weslambertandGitHub 21ca8a9c50 Merge pull request #9770 from Security-Onion-Solutions/fix/elasticsearch_ilm_soc_annotations_settings 
Add SOC annotation settings for Elasticsearch's ILM feature
 2023-02-10 15:51:29 -05:00
weslambertandGitHub acda03ce40 Add annotation settings for Elasticsearch's ILM feature, and remove various index keys 2023-02-10 14:57:11 -05:00
weslambertandGitHub f2f318982e Merge pull request #9768 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_load_additions 
Manage Elasticsearch index lifecycle management policies in Elasticsearch state
 2023-02-10 14:16:32 -05:00
Wes 1255c60317 Move policy load script into Elasticsearch state script directory 2023-02-10 18:59:45 +00:00
Wes 994eabae1b Manage policy loading in Elasticsearch state 2023-02-10 18:57:19 +00:00
weslambertandGitHub 82119b0247 Merge pull request #9765 from Security-Onion-Solutions/fix/elastic_utility_scripts_permissions 
Ensure Elastic utility scripts have the correct permissions
 2023-02-10 10:30:14 -05:00
Wes 1d0e09bdf7 Ensure Elastic utility scripts have the correct permissions 2023-02-10 15:26:46 +00:00
weslambertandGitHub 7564a82b52 Merge pull request #9764 from Security-Onion-Solutions/fix/elasticsearch_ilm_dynamic_policy_loadiing 
ILM Policy Changes
 2023-02-10 10:17:14 -05:00
Wes c9118699a9 Add index management lifecycle policy defintion and reference in index template 2023-02-10 15:10:30 +00:00
Wes d17cf89c68 Fix Bash shebang 2023-02-10 15:01:09 +00:00
Wes 7b7461ef01 Dynamically load index management lifecycle policies based on pillar values 2023-02-10 14:59:29 +00:00
weslambertandGitHub 84c5d2fee9 Merge pull request #9753 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_load_additional_policies 
Add index lifecycle policy templates for other logs
 2023-02-09 10:59:24 -05:00
Wes ee7f299e6d Fix typo - 'Kratos' to 'Kibana' 2023-02-09 15:56:36 +00:00
Wes bb6fc8da19 Add policy templates for other logs 2023-02-09 15:51:58 +00:00
weslambertandGitHub 364799dcc5 Merge pull request #9751 from Security-Onion-Solutions/fix/elastic_fleet_output_temp_change 
Temporarily use Elasticsearch output for standalone installations
 2023-02-09 09:37:14 -05:00
weslambertandGitHub b744dc0641 Add so-eval to list of modes using the Elasticsearch output for Elastic Agent and Fleet 2023-02-09 09:35:29 -05:00
weslambertandGitHub 613793ad9b Temporarily use Elasticsearch output for Standalone installations 2023-02-09 09:32:04 -05:00
weslambertandGitHub 32823ef640 Merge pull request #9746 from Security-Onion-Solutions/feature/elasticsearch_ilm_utility_scripts 
Add Elasticsearch ILM utility scripts
 2023-02-08 16:43:44 -05:00
Wes b319b50fa1 Add initial ILM status script 2023-02-08 21:39:33 +00:00
Wes 1d6c03feb1 Rename initial ILM lifecycle status explanation script 2023-02-08 21:34:39 +00:00
Wes 91d24d36f9 Add initial ILM lifecycle status explanation script 2023-02-08 21:34:15 +00:00
Wes 3e31bda285 Fix typo in Elasticsearch portion of script names 2023-02-08 21:32:17 +00:00
Wes 1de3871ee9 Add initial ILM service restart script 2023-02-08 21:30:25 +00:00
Wes 03849b0659 Add initial ILM service start script 2023-02-08 21:29:38 +00:00
Wes b38f4ca766 Add initial ILM service stop script 2023-02-08 21:29:16 +00:00
Wes 8027055086 Add initial ILM policy delete script 2023-02-08 21:09:42 +00:00
Wes d6d01f8542 Add initial ILM policy view script 2023-02-08 21:01:02 +00:00
Wes 713e9ee215 Create initial template for ILM policy load script 2023-02-08 20:10:41 +00:00
weslambertandGitHub bee5a1e9e8 Merge pull request #9711 from Security-Onion-Solutions/fix/so_import_pcap_suricata_metadata_disable_zeek 
Only run Zeek if it is defined as the metadata engine
 2023-02-02 13:27:35 -05:00
Wes bc082dff99 Only run Zeek if it is defined as 'mdengine' 2023-02-02 16:22:42 +00:00
weslambertandGitHub 395cbf330a Merge pull request #9706 from Security-Onion-Solutions/fix/suricata_metadata 
Add Suricata metadata configuration
 2023-02-02 09:54:49 -05:00
Wes 5fba3c5872 Add Suricata metadata configuration 2023-02-02 14:48:01 +00:00
weslambertandGitHub eb7b6e78b9 Merge pull request #9702 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_disable 
Disable loading of Kibana and Logstash integration policies
 2023-02-01 16:02:56 -05:00
weslambertandGitHub d242050627 Disable loading of Kibana and Logstash logs for now since there are issues with the packages from the registry 2023-02-01 15:59:35 -05:00
weslambertandGitHub 3dfa7959b3 Merge pull request #9698 from Security-Onion-Solutions/fix/strelka_yara_exclusion_2_4 
Add 'configured_vulns_ext_vars.yar' to exclusion list
 2023-02-01 14:38:38 -05:00
weslambertandGitHub 2101ca60e9 Add 'configured_vulns_ext_vars.yar' to exclusion list 2023-02-01 14:25:46 -05:00
weslambertandGitHub 056bcd0121 Merge pull request #9683 from Security-Onion-Solutions/fix/kibana_osquery_live_query_link_remove 
Remove OSQuery live query link
 2023-01-31 13:38:07 -05:00
weslambertandGitHub 98bea0322e Merge pull request #9688 from Security-Onion-Solutions/fix/elastic_agent_elasticsearch_output_typo_fix 
Fix Elastic Agent Elasticsearch output typo
 2023-01-31 12:57:38 -05:00
weslambertandGitHub 74eed31eec Change Elasticsearch output name from 'so-manager_elasticsearch2' to 'so-manager_elasticsearch' 2023-01-31 12:55:03 -05:00
weslambertandGitHub cbf2bd1373 Remove OSQuery live query link 2023-01-31 10:59:17 -05:00
weslambertandGitHub bde828cd4f Merge pull request #9676 from Security-Onion-Solutions/fix/so-import-evtx_updates 
Updates to so-import-evtx
 2023-01-31 08:17:02 -05:00
weslambertandGitHub 0436f885b8 Set values for '@timestamp' and 'event.ingested' 2023-01-31 08:04:49 -05:00
Wes 5472f53c9f Remove bind mount and reference the correctly named entrypoint script 2023-01-30 21:24:30 +00:00
Wes 0156784687 Add EVTX integration policy for 'so-import-evtx' 2023-01-30 21:22:37 +00:00
Wes cc100e50cd Update so-import-evtx to convert EVTX to a JSON file instead of streaming to Elasticsearch 2023-01-30 21:09:58 +00:00
weslambertandGitHub b1eb16d3a2 Merge pull request #9670 from Security-Onion-Solutions/fix/elastic_agent_integration_policies_zeek_exclude_files 
Remove 'prospector.scanner' prefix from 'exclude_files' configuration
 2023-01-27 16:53:02 -05:00
weslambertandGitHub 8240e5b20d Remove 'prospector.scanner' prefix from 'exclude_files' configuration 2023-01-27 16:46:43 -05:00
weslambertandGitHub 68fac4488e Fix syntax for Zeek integration policies 2023-01-27 15:27:15 -05:00
weslambertandGitHub fa9e62a816 Merge pull request #9665 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_import_suricata_event.category 
Change event.category from 'file' to 'network' in Import Suricata integration policy
 2023-01-27 12:03:34 -05:00
weslambertandGitHub e47f64bd04 Change event.category from 'file' to 'network' 2023-01-27 12:00:30 -05:00
weslambertandGitHub 6d2f379ba5 Merge pull request #9664 from Security-Onion-Solutions/fix/elastic_agent_integration_policies_zeek_exclude_files 
Update Zeek file exclusions and add a minor output formatting change
 2023-01-27 11:58:19 -05:00
weslambertandGitHub f49627cec1 Update Zeek file exclusions and add a minor output formatting change 2023-01-27 11:47:14 -05:00
weslambertandGitHub 5ab3d1e8f1 Merge pull request #9663 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_zeek_import_ics_tag 
Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field
 2023-01-27 11:34:28 -05:00
weslambertandGitHub 6b251a2596 Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field 2023-01-27 11:30:06 -05:00
weslambertandGitHub 5468aa82b0 Merge pull request #9662 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_event.dataset_rename 
Change event.dataset value for zeek.files and zeek.tunnels ingest pipelines
 2023-01-27 11:19:45 -05:00
weslambertandGitHub 2772b03dca Change event.dataset value from 'tunnels' to 'tunnel' 2023-01-27 11:03:49 -05:00
weslambertandGitHub 716ec7f936 Change event.dataset value from 'files' to 'file' 2023-01-27 11:02:44 -05:00
weslambertandGitHub 27b1f1bd07 Merge pull request #9654 from Security-Onion-Solutions/fix/logstash_cleanup 
FIX: Logstash Pipeline Cleanup
 2023-01-26 13:19:50 -05:00
Wes e4271043c6 Remove unnecessary Logstash pipelines 2023-01-26 18:05:14 +00:00
Wes b3123f7895 Remove unnecessary Logstash pipelines from the pillar 2023-01-26 17:57:07 +00:00
weslambertandGitHub a8d2631d75 Merge pull request #9650 from Security-Onion-Solutions/fix/elastic_agent_add_import_mode 
Elastic Agent - Import Mode
 2023-01-26 11:33:20 -05:00
Wes b381c5424e Remove extra whitespace after 'so-elastic-agent-builder' line in 'so-image-common' 2023-01-26 16:13:23 +00:00
Wes f1db1bc273 Ensure Kratos events are sent to a data stream instead of an index 2023-01-26 16:12:06 +00:00
Wes 7d68ef0e8b Add Elastic Agent and Fleet to firewall configuration for Import Mode 2023-01-26 16:07:31 +00:00
Wes 43ffcb1d63 Allow setup to set up Elastic Fleet for Import Mode 2023-01-26 16:05:16 +00:00
Wes 8051fc70eb Temporarily disable the loading of the RITA package policy 2023-01-26 16:03:59 +00:00
Wes a9a119f1ab Add Elasticsearch output to 'so-elastic-fleet-setup' for Import Mode 2023-01-26 16:02:27 +00:00
Wes 6a803dfe35 Add Elastic Fleet to top file configuration for Import Mode 2023-01-26 16:01:03 +00:00
Wes 1fb6cf7bfe Add Elastic Fleet to allowed states for Import Mode 2023-01-26 15:59:49 +00:00
weslambertandGitHub 211b87e7ae Merge pull request #9644 from Security-Onion-Solutions/revert-9640-fix/elastic_agent_import_mode 
Revert "Elastic Agent and Fleet - Import Mode"
 2023-01-25 17:23:27 -05:00
weslambertandGitHub 6ee66a34bc Revert "Elastic Agent and Fleet - Import Mode" 2023-01-25 17:12:03 -05:00
weslambertandGitHub 6785e0ec9e Merge pull request #9640 from Security-Onion-Solutions/fix/elastic_agent_import_mode 
Elastic Agent and Fleet - Import Mode
 2023-01-25 17:01:33 -05:00
weslambertandGitHub c73cd78f08 Merge pull request #9643 from Security-Onion-Solutions/2.4/dev 
Merge Dev
 2023-01-25 16:59:47 -05:00
Wes 5c58cda872 Move certificate configuration outside of conditional logic 2023-01-25 19:29:50 +00:00
Wes c3717dae67 Add Elastic Fleet firewall configuration for Import Mode 2023-01-25 18:27:00 +00:00
Wes 86a925e1c7 Download Elastic Agent images for Import Mode 2023-01-25 16:09:12 +00:00
Wes 838beabae5 Add missing single quote for Elastic Agent Elasticsearch output 2023-01-25 15:58:06 +00:00
Wes c46b5e734b Add 'elastic-fleet' to the list of allowed states for Import Mode 2023-01-25 14:38:23 +00:00
Wes 1414b75e01 Allow 'elastic-fleet' state to be applied for Import Mode 2023-01-25 14:07:25 +00:00
Wes 506baa854d Configure Elasticsearch output if running Import Mode 2023-01-25 13:52:54 +00:00
weslambertandGitHub 4868bd8f5e Merge pull request #9638 from Security-Onion-Solutions/fix/elastic_agent_integration_kratos_data_stream_rename 
Rename Kratos Data Stream
 2023-01-25 08:45:37 -05:00
weslambertandGitHub c9f458e1e2 Set event.dataset for all Kratos logs to 'access' for now 2023-01-25 08:19:50 -05:00
weslambertandGitHub 7bf9d77962 Rename Kratos data stream 2023-01-25 08:18:21 -05:00
weslambertandGitHub 3f9764d22d Merge pull request #9633 from Security-Onion-Solutions/fix/elastic_agent_more_improvements 
More Elastic Agent Integration Improvements
 2023-01-24 15:16:52 -05:00
Wes 4b9c92c53d Set RITA event.dataset value explicitly 2023-01-24 18:00:34 +00:00
Wes 38ead7cb82 Remove import tag for now 2023-01-24 17:58:19 +00:00
Wes 44d149b1c3 Allow imported data to use a tag of 'import' 2023-01-24 17:01:52 +00:00
Wes 1e5377c78a Condense RITA integration policies, add ICS tags, and improve output readability 2023-01-24 16:56:20 +00:00
weslambertandGitHub 7e0e5071d9 Merge pull request #9627 from Security-Onion-Solutions/fix/elastic_agent_integration_improvements 
Elastic Agent Integration Improvements
 2023-01-24 10:10:01 -05:00
Wes 7b4d8a47f0 Add copyright header to 'so-elastic-fleet-*' scripts 2023-01-24 15:07:00 +00:00
Wes f19cf75311 Change how event.dataset is determined for Suricata events 2023-01-24 14:45:00 +00:00
Wes 51692ac66c Update index pattern in various template definitions to match new data stream naming convention 2023-01-23 21:52:44 +00:00