CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 12:53:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,598 Commits 40 Branches 127 Tags
682cbfd223f3c4792f37b4e009a7bbf4f96844c2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 926551d398 Merge pull request #5998 from Security-Onion-Solutions/fix/hl_host_name 
Rename HTTP client headers and host
 2021-10-25 13:21:11 -04:00
weslambertandGitHub 3be0d05eea Update field removal based on HTTP input changes 2021-10-25 13:16:30 -04:00
weslambertandGitHub 7fa43a276a Rename default headers and host for HTTP input 2021-10-25 13:15:20 -04:00
weslambertandGitHub 40dd33affe Merge pull request #5971 from Security-Onion-Solutions/feature/es_templates 
Add .keyword subfield for conflict fields
 2021-10-21 15:07:00 -04:00
weslambertandGitHub 77ee1db44c Add .keyword subfield for conflict fields 2021-10-21 12:56:03 -04:00
weslambertandGitHub 6f3e441bf7 Merge pull request #5945 from Security-Onion-Solutions/fix/soc_index_pattern 
Remove space to allow pattern(s) to be correctly interpreted
 2021-10-19 13:05:40 -04:00
weslambertandGitHub 9453ed7fa1 Remove space to allow pattern(s) to be correctly interpreted 2021-10-19 13:01:40 -04:00
weslambertandGitHub 7590728a0b Merge pull request #5915 from Security-Onion-Solutions/feature/ti_module 
Add TI module
 2021-10-15 17:17:33 -04:00
weslambertandGitHub bb36fc1ed8 Add TI module defaults 2021-10-15 17:16:38 -04:00
weslambertandGitHub d0a6dafc8b Add TI module 2021-10-15 17:09:59 -04:00
weslambertandGitHub 59852841ff Add keyword subfield for event.module 2021-10-15 13:29:50 -04:00
weslambertandGitHub 6f1f7d2a63 Merge pull request #5905 from Security-Onion-Solutions/feature/soc_es_index_pattern 
Allow setting ES index patterns for SOC in pillar
 2021-10-15 13:28:04 -04:00
Wes Lambert 8feeff97b5 Add EG index pattern during setup (if enabled) 2021-10-15 16:19:19 +00:00
Wes Lambert 032373187c Allow setting ES index patterns for SOC in pillar 2021-10-15 16:02:53 +00:00
weslambertandGitHub 490f7eaf81 Merge pull request #5886 from Security-Onion-Solutions/feature/eg_pivot 
Add EG pivot
 2021-10-14 14:49:38 -04:00
Wes Lambert f1fafa015e Add EG to list of groups to include 127.0.0.1 2021-10-14 16:27:28 +00:00
Wes Lambert 6cdc214582 Add pillar in setup and change name of EG variable 2021-10-14 15:33:37 +00:00
Wes Lambert 15049f44b9 Add EG pivot 2021-10-14 15:15:23 +00:00
weslambertandGitHub 3b45e68ead Merge pull request #5885 from Security-Onion-Solutions/feature/jinjafy_soc_actions 
Allow SOC actions to use Jinja
 2021-10-14 10:03:12 -04:00
Wes Lambert 5ee0ea3fe7 Allow SOC actions to use Jinja 2021-10-14 13:59:55 +00:00
weslambertandGitHub 55c60f485c Merge pull request #5884 from Security-Onion-Solutions/feature/hl_eg 
Add EG firewall allowance via setup
 2021-10-14 09:55:07 -04:00
Wes Lambert 78e88e0765 Add EG firewall allowance via setup 2021-10-13 21:42:54 +00:00
Wes Lambert a9b250c0f4 Add EG firewall config 2021-10-13 21:37:59 +00:00
weslambertandGitHub f9001654bb Merge pull request #5871 from Security-Onion-Solutions/feature/hl_eg 
Initial EG stuff
 2021-10-13 15:07:03 -04:00
Wes Lambert 2a504a061b Add Curator action files for EG indices 2021-10-13 18:40:34 +00:00
Wes Lambert e1629d7ec4 Initial EG stuff 2021-10-13 17:13:07 +00:00
weslambertandGitHub 18d81352c6 Merge pull request #5537 from Security-Onion-Solutions/delta 
Add improved ignore functionality for YARA rules used by Strelka and add default ignored rules that break compilation
 2021-09-16 10:38:49 -04:00
weslambertandGitHub 2affaf07a2 Merge pull request #5521 from Security-Onion-Solutions/fix/strelka-yara 
Fix/strelka yara
 2021-09-15 11:33:44 -04:00
weslambertandGitHub 39e5ded58d Refactor ignore list and only ignore for signature-base for now 2021-09-15 11:32:29 -04:00
weslambertandGitHub 4d41d3aee1 Ignore these rules by default because they are causing issues with YARA compilation with Strelka 2021-09-15 10:29:11 -04:00
weslambertandGitHub 5c8067728e Remove unnecessary logic 2021-09-15 10:22:17 -04:00
weslambertandGitHub 03b45512fa Merge pull request #5436 from Security-Onion-Solutions/fix/kibana_server_url 
Incude server.publicBaseUrl
 2021-09-08 12:13:48 -04:00
weslambertandGitHub b8600be0f1 Incude server.publicBaseUrl 2021-09-08 12:12:09 -04:00
weslambertandGitHub 72542322ca Merge pull request #4857 from Security-Onion-Solutions/fix/beats_output_fb_modules 
Check if Filebeat modules are being used for incoming (external) Beats
 2021-07-19 13:11:06 -04:00
weslambertandGitHub fea4f3f973 Check if Filebeat modules are being used for incoming Beats 2021-07-19 12:57:42 -04:00
weslambertandGitHub bde86e0383 Use http_auth instead of username/password until Curator is upgraded to next version 2021-07-19 12:42:46 -04:00
weslambertandGitHub 7e1be8a3a4 Merge pull request #4798 from Security-Onion-Solutions/fix/strelka_filepath_mapping 
Replace staging with processed in Strelka file path mapping
 2021-07-14 11:16:15 -04:00
Wes Lambert 05aad07bfc Replace staging path with processed path for analyzed files 2021-07-14 15:04:46 +00:00
weslambertandGitHub 42ba9888d7 Merge pull request #4797 from Security-Onion-Solutions/fix/wazuh_data_port 
Change field name and mapping for Wazuh's data.port
 2021-07-14 10:14:53 -04:00
Wes Lambert 723172bc1f Add path_unmatch for data.port so it is not mapped as integer 2021-07-14 13:45:09 +00:00
Wes Lambert 323b5d6694 Add dynamic mapping for wazuh 2021-07-14 13:43:34 +00:00
Wes Lambert 441cd3fc59 Move Wazuh-specific data to wazuh.data 2021-07-14 13:42:51 +00:00
weslambertandGitHub 7cdb967810 Only route to FB module pipeline if filebeat in metadata 2021-07-13 11:36:18 -04:00
weslambertandGitHub c0f3c5b3db Merge pull request #4773 from Security-Onion-Solutions/feature/filebeat-logging-level 
Allow setting Filebeat logging level in pillar
 2021-07-12 10:55:43 -04:00
weslambertandGitHub a895270bc8 Allow setting Filebeat logging level in pillar 2021-07-12 10:27:43 -04:00
weslambertandGitHub ce0b064972 Add conditional for heavynode for redis and elasticsearch 2021-07-06 14:21:29 -04:00
weslambertandGitHub 2f3f04e4ca Change from nodename to host 2021-07-06 14:18:39 -04:00
weslambertandGitHub 2e91f27336 Add conditional for heavynode 2021-07-06 14:17:49 -04:00
weslambertandGitHub 10b1829830 Add conditional for heavynode 2021-07-06 14:16:34 -04:00
weslambertandGitHub 4946f32d88 Add extra_hosts entry for local instance when running as heavy node 2021-07-06 14:14:58 -04:00
weslambertandGitHub fcbacd473d Add ELK, redis 2021-06-30 09:34:56 -04:00
weslambertandGitHub 06d77d9972 Update so-common-template.json 2021-06-30 09:31:32 -04:00
weslambertandJason Ertel c5b81f2f4b Fix output so that it can be redirected to local file with appropriate syntax 2021-06-23 14:41:38 -04:00
weslambertandGitHub d411a9e1ff Merge pull request #4597 from Security-Onion-Solutions/fix/pipeline-view-output 
Fix output so that it can be redirected to local file with appropriat…
 2021-06-23 09:24:41 -04:00
weslambertandGitHub 3fbc850774 Fix output so that it can be redirected to local file with appropriate syntax 2021-06-23 09:17:37 -04:00
weslambertandGitHub 1bef1d5652 Update to apply to any so-prefixed index 2021-06-10 08:16:00 -04:00
weslambertandGitHub cba719b3a0 Remove extra comma 2021-06-02 16:42:09 -04:00
weslambertandGitHub 4241bb08b8 Add suricata/zeek until we migrate templates 2021-06-02 16:37:43 -04:00
weslambertandGitHub 4c74e7f308 Add event.kind and set name to module[dot]dataset 2021-06-02 15:35:26 -04:00
weslambertandGitHub db48c15f1d Create event.kind field and rename dataset to be module[dot]dataset 2021-06-02 15:33:18 -04:00
weslambertandGitHub a1b34e7a88 Fix Suricata index name 2021-06-02 15:30:14 -04:00
Wes Lambert 728d1f7540 Make Zeek and Suricata great again 2021-05-06 14:06:17 +00:00
Wes Lambert ee92ba20b0 Add modules path reference 2021-05-06 13:56:39 +00:00
Wes Lambert 1b749cf004 Additional config 2021-05-06 13:55:07 +00:00
Wes Lambert 37929dbd7d Add additional config for Filebeat modules 2021-05-06 13:54:28 +00:00
Wes Lambert 865ba912f8 Merge remote-tracking branch 'remotes/origin/dev' into pipeline 2021-05-06 13:19:31 +00:00
weslambertandGitHub c867d6648a Merge pull request #4098 from Security-Onion-Solutions/delta 
Add ignore above for message keyword field
 2021-05-05 08:53:39 -04:00
Wes Lambert a1a79719fc Add ignore above for message keyword field 2021-05-05 12:07:30 +00:00
weslambertandGitHub d4e8ea8e72 Merge pull request #4079 from Security-Onion-Solutions/delta 
Add event_data to common template so elastalert/playbook event_data f…
 2021-05-03 13:45:17 -04:00
Wes Lambert 619402cc67 Add event_data to common template so elastalert/playbook event_data fields can be indexed and searchable 2021-05-03 17:03:30 +00:00
weslambertandGitHub 427dd31fcb Merge pull request #3876 from Security-Onion-Solutions/delta 
FIX:Remove ESUSER/ESPASS for now to prevent issues with attempting Elasti…
 2021-04-15 08:11:15 -04:00
Wes Lambert f61bf73f97 Remove ESUSER/ESPASS for now to prevent issues with attempting Elastic Auth when connecting to ES. 2021-04-15 11:59:34 +00:00
weslambertandGitHub 5eb0137c21 Merge pull request #3705 from Security-Onion-Solutions/delta 
Enforce date type for ingest.timestamp
 2021-03-31 08:40:41 -04:00
Wes Lambert 942de130ca Enforce date type for ingest.timestamp 2021-03-31 12:24:51 +00:00
weslambertandGitHub ff317cdcf1 Merge pull request #3684 from Security-Onion-Solutions/delta 
Add Elastic scripts
 2021-03-30 12:06:00 -04:00
Wes Lambert 7049383ba6 Add Elastic scripts 2021-03-30 15:47:05 +00:00
Wes Lambert b481cf885b Update saved objects and remove index patterns because this is now handled by Field Caps API 2021-03-19 18:30:42 +00:00
weslambertandGitHub 8d29f757b1 Merge pull request #3471 from Security-Onion-Solutions/kilo 
Reverse Zeek index close/delete count for Curator
 2021-03-16 14:34:46 -04:00
Wes Lambert 7a02150389 Reverse Zeek index close/delete count for Curator 2021-03-16 17:16:55 +00:00
weslambertandGitHub 5fd483a99d Merge pull request #3466 from Security-Onion-Solutions/soup2340 
Soup for 2.3.40
 2021-03-16 13:03:33 -04:00
Wes Lambert 038c58f3d5 Ignore TIME_WAIT when checking for Strelka frontend port reservation 2021-03-16 14:51:16 +00:00
Wes Lambert f142b754dc Add Strelka files.processed directory so files will be moved from staging to processed 2021-03-15 15:43:31 +00:00
Wes Lambert b6a785395d Add Strelka staging directory for state 2021-03-15 15:42:13 +00:00
Wes Lambert 6ea8eab9af Modify soup to add Strelka rule repo in pillar 2021-02-24 20:32:47 +00:00
weslambertandGitHub 583b65e952 Fix syntax 2021-01-21 11:52:23 -05:00
weslambertandGitHub d6043d091b Merge pull request #2701 from Security-Onion-Solutions/feature/filebeat_events 
Allow for Filebeat queue/output adjustments via pillar
 2021-01-21 10:36:33 -05:00
Wes Lambert 19d22e1f8a Allow for Filebeat queue/output adjustments via pillar 2021-01-21 15:34:54 +00:00
weslambertandGitHub a99246c600 Merge pull request #2698 from Security-Onion-Solutions/fix/reserved_ports 
Fix/reserved ports
 2021-01-21 08:39:35 -05:00
Wes Lambert 0039877779 Check for port availability for Wazuh and Strelka 2021-01-21 13:29:09 +00:00
Wes Lambert 9a91674688 Add reserved ports file for sysctl 2021-01-21 13:18:22 +00:00
Wes Lambert 74e315841a Modify common to reserve Docker proxy ports 2021-01-21 13:17:16 +00:00
Wes LambertandWilliam Wernert 7f64d57111 Reserve port for Wazuh API and check if port is already in use 2021-01-06 14:37:28 -05:00
Wes LambertandWilliam Wernert e7db1a99bd Set @timestamp to winlog.systemTime 2021-01-06 14:37:28 -05:00
weslambertandWilliam Wernert c864cc607f Remove multiple old so-yara-update cron jobs, if needed 2021-01-06 14:37:27 -05:00
weslambertandWilliam Wernert 958635b012 Remove old Strelka cron job 2021-01-06 14:37:27 -05:00
weslambertandGitHub 36ae09ac4a Merge pull request #2545 from Security-Onion-Solutions/fix/wazuh_port_reservation 
Reserve port for Wazuh API and check if port is already in use
 2021-01-06 11:49:23 -05:00
weslambertandGitHub 55344725e7 Merge pull request #2544 from Security-Onion-Solutions/fix/winlog_timestamp 
Set @timestamp to winlog.systemTime
 2021-01-06 11:49:01 -05:00
Wes Lambert 875908dc90 Set @timestamp to winlog.systemTime 2021-01-06 16:47:35 +00:00
Wes Lambert f2b677bfcb Reserve port for Wazuh API and check if port is already in use 2021-01-06 15:52:10 +00:00
weslambertandGitHub 707528d7e8 Merge pull request #2530 from Security-Onion-Solutions/fix/strelka_cron_2 
Remove multiple old so-yara-update cron jobs, if needed
 2021-01-04 16:30:22 -05:00