  weslambertandGitHub
|
6785e0ec9e
|
Merge pull request #9640 from Security-Onion-Solutions/fix/elastic_agent_import_mode
Elastic Agent and Fleet - Import Mode
|
2023-01-25 17:01:33 -05:00 |
|
|
weslambertandGitHub
|
c73cd78f08
|
Merge pull request #9643 from Security-Onion-Solutions/2.4/dev
Merge Dev
|
2023-01-25 16:59:47 -05:00 |
|
|
Wes
|
5c58cda872
|
Move certificate configuration outside of conditional logic
|
2023-01-25 19:29:50 +00:00 |
|
|
Wes
|
c3717dae67
|
Add Elastic Fleet firewall configuration for Import Mode
|
2023-01-25 18:27:00 +00:00 |
|
|
Wes
|
86a925e1c7
|
Download Elastic Agent images for Import Mode
|
2023-01-25 16:09:12 +00:00 |
|
|
Wes
|
838beabae5
|
Add missing single quote for Elastic Agent Elasticsearch output
|
2023-01-25 15:58:06 +00:00 |
|
|
Wes
|
c46b5e734b
|
Add 'elastic-fleet' to the list of allowed states for Import Mode
|
2023-01-25 14:38:23 +00:00 |
|
|
Wes
|
1414b75e01
|
Allow 'elastic-fleet' state to be applied for Import Mode
|
2023-01-25 14:07:25 +00:00 |
|
|
Wes
|
506baa854d
|
Configure Elasticsearch output if running Import Mode
|
2023-01-25 13:52:54 +00:00 |
|
|
weslambertandGitHub
|
4868bd8f5e
|
Merge pull request #9638 from Security-Onion-Solutions/fix/elastic_agent_integration_kratos_data_stream_rename
Rename Kratos Data Stream
|
2023-01-25 08:45:37 -05:00 |
|
|
weslambertandGitHub
|
c9f458e1e2
|
Set event.dataset for all Kratos logs to 'access' for now
|
2023-01-25 08:19:50 -05:00 |
|
|
weslambertandGitHub
|
7bf9d77962
|
Rename Kratos data stream
|
2023-01-25 08:18:21 -05:00 |
|
|
weslambertandGitHub
|
3f9764d22d
|
Merge pull request #9633 from Security-Onion-Solutions/fix/elastic_agent_more_improvements
More Elastic Agent Integration Improvements
|
2023-01-24 15:16:52 -05:00 |
|
|
Wes
|
4b9c92c53d
|
Set RITA event.dataset value explicitly
|
2023-01-24 18:00:34 +00:00 |
|
|
Wes
|
38ead7cb82
|
Remove import tag for now
|
2023-01-24 17:58:19 +00:00 |
|
|
Wes
|
44d149b1c3
|
Allow imported data to use a tag of 'import'
|
2023-01-24 17:01:52 +00:00 |
|
|
Wes
|
1e5377c78a
|
Condense RITA integration policies, add ICS tags, and improve output readability
|
2023-01-24 16:56:20 +00:00 |
|
|
weslambertandGitHub
|
7e0e5071d9
|
Merge pull request #9627 from Security-Onion-Solutions/fix/elastic_agent_integration_improvements
Elastic Agent Integration Improvements
|
2023-01-24 10:10:01 -05:00 |
|
|
Wes
|
7b4d8a47f0
|
Add copyright header to 'so-elastic-fleet-*' scripts
|
2023-01-24 15:07:00 +00:00 |
|
|
Wes
|
f19cf75311
|
Change how event.dataset is determined for Suricata events
|
2023-01-24 14:45:00 +00:00 |
|
|
Wes
|
51692ac66c
|
Update index pattern in various template definitions to match new data stream naming convention
|
2023-01-23 21:52:44 +00:00 |
|
|
Wes
|
40c6b380df
|
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
|
2023-01-23 21:44:46 +00:00 |
|
|
Wes
|
d342f3c4b8
|
Add 'so-elastic-fleet-integration-policy-bulk-delete' to perform bulk deletion of integration policies
|
2023-01-23 21:38:13 +00:00 |
|
|
weslambertandGitHub
|
9c83b775ee
|
Merge pull request #9604 from Security-Onion-Solutions/feature/sensoroni_scripts
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 16:59:29 -05:00 |
|
|
Wes
|
739c174898
|
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 21:50:10 +00:00 |
|
|
weslambertandGitHub
|
8c4e00cfbd
|
Merge pull request #9600 from Security-Onion-Solutions/fix/elasticsearch_template_logs_default_remove
Remove default "logs-*" template settings for now
|
2023-01-19 10:30:44 -05:00 |
|
|
weslambertandGitHub
|
7d3f6121eb
|
Remove default "logs-*" template settings for now
|
2023-01-19 10:29:10 -05:00 |
|
|
weslambertandGitHub
|
90f3e33cc6
|
Merge pull request #9597 from Security-Onion-Solutions/fix/elasticsearch_template_logs_default_priority_modification
Modify default 'logs-*' Elasticsearch template priority
|
2023-01-18 17:30:52 -05:00 |
|
|
weslambertandGitHub
|
7a499c9051
|
Modify default 'logs-*' template priority
|
2023-01-18 17:24:07 -05:00 |
|
|
weslambertandGitHub
|
1bf088e976
|
Merge pull request #9591 from Security-Onion-Solutions/fix/kibana_basepath_rewrite_disable
Disable Kibana's native base path rewrite and add publicBaseUrl
|
2023-01-17 16:59:06 -05:00 |
|
|
weslambertandGitHub
|
1fed3cf474
|
Disable Kibana's native base path rewrite and add publicBaseUrl
|
2023-01-17 16:54:31 -05:00 |
|
|
weslambertandGitHub
|
1723f58c04
|
Merge pull request #9579 from Security-Onion-Solutions/fix/elasticsearch_templates_so-ids
Remove so-ids since the data stream is now 'logs-suricata-*'
|
2023-01-13 16:17:38 -05:00 |
|
|
weslambertandGitHub
|
ca80548bf0
|
Remove so-ids since the data stream is now 'logs-suricata-*'
|
2023-01-13 16:15:58 -05:00 |
|
|
weslambertandGitHub
|
3e5127810d
|
Merge pull request #9577 from Security-Onion-Solutions/fix/elasticsearch_elastic_agent_templates
Make sure Elastic Agent data streams do not use replicas
|
2023-01-13 16:12:09 -05:00 |
|
|
weslambertandGitHub
|
73a4dae28e
|
Make sure Elastic Agent data streams do not use replicas
|
2023-01-13 16:10:44 -05:00 |
|
|
weslambertandGitHub
|
7cba5626b7
|
Merge pull request #9570 from Security-Onion-Solutions/fix/elasticsearch_templates_elastic_agent
Change priority for Elastic Agent Elasticsearch index templates
|
2023-01-12 16:48:12 -05:00 |
|
|
weslambertandGitHub
|
654d869e3e
|
Change priority from 500 to 200 for Elastic Agent index templates to avoid collisions with other templates
|
2023-01-12 16:46:08 -05:00 |
|
|
weslambertandGitHub
|
be6b42494c
|
Merge pull request #9569 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_kratos
Kratos Index Changes
|
2023-01-12 15:33:51 -05:00 |
|
|
weslambertandGitHub
|
fb8d8ea972
|
Update Elasticsearch index template for Kratos
|
2023-01-12 15:31:41 -05:00 |
|
|
weslambertandGitHub
|
9416552338
|
Don't set the Kratos index explicitly
|
2023-01-12 15:25:35 -05:00 |
|
|
weslambertandGitHub
|
66f9a06458
|
Merge pull request #9566 from Security-Onion-Solutions/fix/elastic_fleet_integration_policy_load
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 16:17:40 -05:00 |
|
|
Wes
|
0e437f84e7
|
Add back echo statement to print the import policy being loaded
|
2023-01-11 21:13:30 +00:00 |
|
|
Wes
|
ea01e68846
|
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 21:01:31 +00:00 |
|
|
weslambertandGitHub
|
acad7acc4a
|
Merge pull request #9562 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_load_suricata_import
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:27:37 -05:00 |
|
|
weslambertandGitHub
|
4391c22335
|
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:23:50 -05:00 |
|
|
weslambertandGitHub
|
39d1f07fab
|
Merge pull request #9561 from Security-Onion-Solutions/fix/filebeat_remove_module_setup
Remove pipeline.load from top.sls so that Filebeat module loading is not attempted
|
2023-01-11 12:21:39 -05:00 |
|
|
weslambertandGitHub
|
b3e0183e39
|
Remove pipeline.load from top.sls so that Filebeat module loading is not attempted
|
2023-01-11 12:19:06 -05:00 |
|
|
weslambertandGitHub
|
355953427c
|
Merge pull request #9553 from Security-Onion-Solutions/feature/filebeat_to_elastic_agent_conversion
Initial Conversion of Filebeat Inputs to Elastic Agent Inputs
|
2023-01-11 09:22:40 -05:00 |
|
|
Wes
|
52b620b137
|
Add additional conditional logic for Filebeat and disable Filebeat
|
2023-01-11 14:10:11 +00:00 |
|
|
Wes
|
33e2affb1d
|
Remove newlines from end of Syslog processor definitions
|
2023-01-11 14:08:28 +00:00 |
|
|
Wes
|
c3b83f1fc8
|
Update template settings to use data streams
|
2023-01-11 14:03:11 +00:00 |
|
|
Wes
|
5062dd2873
|
Suricata Elasticsearch ingest node pipeline changes - set 'alert' dataset
|
2023-01-11 14:02:09 +00:00 |
|
|
Wes
|
2e886d0c55
|
Remove data_index_name processor since we are using data streams
|
2023-01-11 13:58:38 +00:00 |
|
|
Wes
|
5d86edeed4
|
Modify Logstash Elastic Agent output to accomodate for events with and without 'metadata.pipeline'
|
2023-01-11 13:57:32 +00:00 |
|
|
Wes
|
caf0ea6b53
|
Add Elastic Agent policy view script
|
2023-01-11 13:56:21 +00:00 |
|
|
Wes
|
a146f1134e
|
Add Elastic Agent utility scripts
|
2023-01-11 13:54:42 +00:00 |
|
|
weslambertandGitHub
|
2c3bd6e3fd
|
Merge pull request #9502 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_rita_beacon_2_4
Update RITA beacon parsing
|
2023-01-03 11:14:04 -05:00 |
|
|
Wes
|
c8ff2c7a06
|
Update RITA beacon parsing
|
2023-01-03 16:03:49 +00:00 |
|
|
weslambertandGitHub
|
c220c322ef
|
Merge pull request #9431 from Security-Onion-Solutions/fix/elasticsearch_templates_elastic_agent
Remove 'so-' prefix for Elastic Agent/Fleet component templates
|
2022-12-19 10:14:39 -05:00 |
|
|
weslambertandGitHub
|
fd1be0ab2c
|
Remove 'so-' prefix for Elastic Agent/Fleet component templates
|
2022-12-19 10:11:26 -05:00 |
|
|
weslambertandGitHub
|
09b012ad4e
|
Merge pull request #9372 from Security-Onion-Solutions/fix/sensoroni_analyzers_configuration_check_2_4
Fix localfile analyzer 'file_path' check and add new list value verification function for helpers
|
2022-12-13 11:47:18 -05:00 |
|
|
Wes
|
3ab8a0be60
|
Update tests to account for change in 'file_path' value verification
|
2022-12-13 16:29:18 +00:00 |
|
|
Wes
|
eae05e83e6
|
Use new list verification function for 'file_path'
|
2022-12-13 16:28:50 +00:00 |
|
|
Wes
|
117d230b9d
|
Add new test for list value verification function
|
2022-12-13 16:28:22 +00:00 |
|
|
Wes
|
5422c5b3e2
|
Add new function to verify list value
|
2022-12-13 16:27:58 +00:00 |
|
|
weslambertandGitHub
|
69c7bb11c6
|
Merge pull request #9343 from Security-Onion-Solutions/fix/analyzers_localfile_file_path
FIX: Ensure file path is ascertainable by localfile.py for localfile analyzer
|
2022-12-08 17:08:19 -05:00 |
|
|
weslambertandGitHub
|
9477f29432
|
Remove double quotes to fix issue with file path sourcing from 'localfile.py'
|
2022-12-08 17:06:43 -05:00 |
|
|
weslambertandGitHub
|
2240283457
|
Merge pull request #9316 from Security-Onion-Solutions/fix/ics_scada_filebeat_disable_ecat_arp_info
Disable Filebeat input for 'ecat_arp_info' Zeek logs
|
2022-12-07 08:08:42 -05:00 |
|
|
weslambertandGitHub
|
def0c85349
|
Disable Filebeat input for 'ecat_arp_info' Zeek logs
|
2022-12-07 08:00:21 -05:00 |
|
|
weslambertandGitHub
|
31832ae150
|
Merge pull request #9309 from Security-Onion-Solutions/fix/ignore_additional_strelka_rules_causing_compilation_errors
Ignore additional rules causing YARA compilation errors
|
2022-12-06 14:01:14 -05:00 |
|
|
weslambertandGitHub
|
7ce0924382
|
Ignore additional rules causing compilation errors
|
2022-12-06 13:59:21 -05:00 |
|
|
weslambertandGitHub
|
73304e049c
|
Merge pull request #9304 from Security-Onion-Solutions/feature/ics_scada_additions
Port STUN, TDS, WireGuard, and ICS/SCADA Changes from 2.3 to 2.4
|
2022-12-06 13:14:47 -05:00 |
|
|
weslambertandGitHub
|
a626acced0
|
Add new ICS/SCADA event fields to the dashboards section of the configuration and remove extra space in key names.
|
2022-12-06 13:11:55 -05:00 |
|
|
Wes
|
1b5c1fecd4
|
Revert SOC default 'alerts' event fields and specify additional event fields for ICS/SCADA events
|
2022-12-06 17:28:30 +00:00 |
|
|
Wes
|
b048eec3c0
|
Add STUN, TDS, WireGuard, and ICS/SCADA dashboard queries
|
2022-12-06 17:17:49 +00:00 |
|
|
Wes
|
f44eee134a
|
Add default queries and ICS/SCADA queries
|
2022-12-06 16:52:20 +00:00 |
|
|
Wes
|
c741fe6b4d
|
Ensure ICS/SCADA plugins/scripts are enabled
|
2022-12-06 16:23:26 +00:00 |
|
|
Wes
|
be5775e4a0
|
Ensure Filebeat defaults file is updated with ICS/SCADA log references
|
2022-12-06 16:15:09 +00:00 |
|
|
Wes
|
499b5d95f2
|
Add 'ics' tag for 'bsap'-prefixed events/logs
|
2022-12-06 16:01:57 +00:00 |
|
|
Wes
|
14af1d36cb
|
Ensure ICS/SCADA pipelines are present
|
2022-12-06 15:58:47 +00:00 |
|
|
weslambertandGitHub
|
117a3d486a
|
Merge pull request #9210 from Security-Onion-Solutions/fix/add_missing_opcua_activate_session_pipelines_2_4
Add Missing OPCUA Activate Session Pipelines
|
2022-11-22 16:01:45 -05:00 |
|
|
Wes
|
7f324bc47e
|
Remove extra space used during testing
|
2022-11-22 20:52:08 +00:00 |
|
|
Wes
|
a6bc5b108f
|
Add missing OPCUA 'activate_session' pipelines
|
2022-11-22 20:51:44 +00:00 |
|
|
weslambertandGitHub
|
090f8309c2
|
Merge pull request #9207 from Security-Onion-Solutions/fix/ingest_typos_2_4
Fix spelling of 'wireguard.responses' field name
|
2022-11-22 15:36:04 -05:00 |
|
|
weslambertandGitHub
|
356904f751
|
Fix spelling of 'wireguard.responses' field name
|
2022-11-22 13:03:04 -05:00 |
|
|
weslambertandGitHub
|
f9cc7888f4
|
Merge pull request #9204 from Security-Onion-Solutions/fix/ics_ingest_field_names_2_4
Fix ICS Ingest Field Names
|
2022-11-22 12:30:17 -05:00 |
|
|
weslambertandGitHub
|
6b77843e52
|
Fix format/speliing for 'enip.status_code' field name
|
2022-11-22 12:07:55 -05:00 |
|
|
weslambertandGitHub
|
13faf63770
|
Fix spelling for 'stun.class' field name
|
2022-11-22 12:07:15 -05:00 |
|
|
weslambertandGitHub
|
b801997709
|
Merge pull request #9196 from Security-Onion-Solutions/fix/missing_ics_pipelines_2_4
Add COTP and TDS ingest pipelines
|
2022-11-22 08:44:19 -05:00 |
|
|
Wes
|
a38e312df4
|
Add COTP and TDS ingest pipelines
|
2022-11-22 13:36:27 +00:00 |
|
|
weslambertandGitHub
|
bde899e7cb
|
Merge pull request #9194 from Security-Onion-Solutions/fix/ics_tag_syntax_error_2_4
Fix syntax error for 'ics' tag logic
|
2022-11-22 07:32:54 -05:00 |
|
|
weslambertandGitHub
|
d2bc1a5523
|
Fix syntax error for 'ics' tag logic
|
2022-11-22 07:24:54 -05:00 |
|
|
weslambertandGitHub
|
68efd817e0
|
Merge pull request #9189 from Security-Onion-Solutions/feature/filebeat_config_ics_event_tag_2_4
Add 'ics' tag to events generated from ICS protocol logs
|
2022-11-21 17:06:14 -05:00 |
|
|
weslambertandGitHub
|
fe180d5657
|
Fix indentation
|
2022-11-21 17:02:17 -05:00 |
|
|
weslambertandGitHub
|
9994d47a43
|
Add 'ics' tag to events generated from ICS protocol logs
|
2022-11-21 16:46:47 -05:00 |
|
|
weslambertandGitHub
|
061f0b0595
|
Merge pull request #9159 from Security-Onion-Solutions/feature/additional_ics_scada_ingest_pipelines_2_4
Add additional ICS/SCADA ingest node pipelines
|
2022-11-21 10:32:00 -05:00 |
|
|
Wes
|
05b9a067fd
|
Add additional ICS/SCADA ingest node pipelines
|
2022-11-17 16:03:21 +00:00 |
|
|
weslambertandGitHub
|
c14c8c1306
|
Merge pull request #9154 from Security-Onion-Solutions/fix/ics_scada_ingest_pipeline_updates_2_4
Update ingest node pipelines for ICS/SCADA protocols
|
2022-11-16 16:17:19 -05:00 |
|
|
Wes
|
638a3568b0
|
Update ingest node pipelines for ICS/SCADA protocols
|
2022-11-16 21:11:21 +00:00 |
|
|
weslambertandGitHub
|
8b0ea7104f
|
Merge pull request #9003 from Security-Onion-Solutions/fix/remove_ja3er_references
Remove JA3er references
|
2022-10-26 10:37:45 -04:00 |
|