CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
10,704 Commits 40 Branches 127 Tags
68efd817e0894de0c8b583a8eaf45f720364f403
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Doug BurksandGitHub 6e1e6e15e8 Merge pull request #9186 from Security-Onion-Solutions/dougburks-patch-2 
Add ICS/SCADA logs to filebeat defaults.yaml
 2022-11-21 13:30:35 -05:00
Doug BurksandGitHub febb781428 Add ICS/SCADA logs to filebeat defaults.yaml 2022-11-21 12:10:55 -05:00
Doug BurksandGitHub 5a0fe6050b Merge pull request #9179 from Security-Onion-Solutions/dougburks-patch-2 
Simplify version in README.md to just 2.4
 2022-11-21 08:46:33 -05:00
Doug BurksandGitHub 778ee4b00f Simplify version in README.md to just 2.4 2022-11-21 08:39:18 -05:00
Doug BurksandGitHub a2da8e5e08 Merge pull request #9129 from Security-Onion-Solutions/dougburks-patch-1 
fix descriptions in files related to analyzers
 2022-11-12 19:26:34 +00:00
Doug BurksandGitHub 632464335f fix descriptions in files related to analyzers 2022-11-12 13:14:02 -05:00
Doug BurksandGitHub f77db78219 fix descriptions in files related to analyzers 2022-11-12 13:13:30 -05:00
Doug BurksandGitHub 2f4ce91678 fix descriptions in files related to analyzers 2022-11-12 13:12:58 -05:00
Doug BurksandGitHub 154dff98de fix descriptions in files related to analyzers 2022-11-12 13:12:23 -05:00
Doug BurksandGitHub a15ca3cc49 fix descriptions in files related to analyzers 2022-11-12 13:11:38 -05:00
Doug BurksandGitHub a6ad7fa3ac Merge pull request #9125 from Security-Onion-Solutions/dougburks-patch-2 
FIX: Avoid deprecation warning in Zeek file extraction script #9123
 2022-11-11 21:33:43 +00:00
Doug BurksandGitHub 40f5bb25ef FIX: Avoid deprecation warning in Zeek file extraction script #9123 2022-11-11 16:28:23 -05:00
Doug BurksandGitHub f3fc52dd2c Merge pull request #9041 from Security-Onion-Solutions/dougburks-patch-1 
https://github.com/Security-Onion-Solutions/securityonion/pull/8952
 2022-11-01 13:40:51 +00:00
Doug BurksandGitHub 2030f08b54 https://github.com/Security-Onion-Solutions/securityonion/pull/8952 2022-11-01 09:35:53 -04:00
Doug BurksandGitHub 7ede0c3c76 Merge pull request #8915 from Security-Onion-Solutions/dougburks-patch-2 
Remove destination_geo.organization_name from Sysmon Network sankey diagram
 2022-10-13 13:04:23 +00:00
Doug BurksandGitHub f6151b3895 Remove destination_geo.organization_name from Sysmon Network sankey diagram 2022-10-13 09:03:10 -04:00
Doug BurksandGitHub 2c5038aa9c Merge pull request #8879 from Security-Onion-Solutions/2.4/improve-sysmon-dashboards 
improve sysmon dashboards
 2022-10-07 16:46:51 +00:00
doug d65fde9536 improve sysmon dashboards 2022-10-07 12:23:40 -04:00
Doug BurksandGitHub ea8d9362ae Merge pull request #8813 from Security-Onion-Solutions/dougburks-patch-1 
Change managing-rules.html to rules.html in soc_idstools.yaml
 2022-09-26 19:00:41 +00:00
Doug BurksandGitHub 80201f1465 Change managing-rules.html to rules.html in soc_idstools.yaml 2022-09-26 14:58:51 -04:00
Doug BurksandGitHub 1b13e454f8 Merge pull request #8812 from Security-Onion-Solutions/2.4/dev-fix-screenshots 
fix screenshots in README.md
 2022-09-26 17:49:10 +00:00
doug 97a6b3c2f3 fix screenshots 2022-09-26 13:46:46 -04:00
Doug BurksandGitHub 4e5eb1cbb8 Merge pull request #8807 from Security-Onion-Solutions/2.4/dev-ocd 
initial quick OCD pass
 2022-09-23 20:39:54 +00:00
doug fee5a7bea9 initial quick OCD pass 2022-09-23 16:29:55 -04:00
Doug BurksandGitHub 8a537204d6 Merge pull request #8783 from Security-Onion-Solutions/2.4/fix-docs-links 
fix docs links
 2022-09-20 19:34:01 +00:00
Doug BurksandGitHub 0137004344 Fix releaseNotesUrl in defaults.yaml 2022-09-20 15:16:53 -04:00
Doug BurksandGitHub 530c497800 Update motd.md 2022-09-20 15:16:04 -04:00
Doug BurksandGitHub 0eafed32a4 Update docs links in README.md 2022-09-20 15:13:14 -04:00
Doug BurksandGitHub bc57a74ac8 Merge pull request #8782 from Security-Onion-Solutions/dougburks-patch-1 
change version to 2.4.0
 2022-09-20 16:52:39 +00:00
Doug BurksandGitHub aadce055d1 change version to 2.4.0 2022-09-20 12:49:14 -04:00
Doug BurksandGitHub 8c88285365 Merge pull request #8780 from Security-Onion-Solutions/2.4/sysmon-fix-bryant 
2.4/sysmon fix bryant
 2022-09-20 14:32:35 +00:00
Doug BurksandGitHub df18f8f886 Merge pull request #8779 from Security-Onion-Solutions/2.4/dev 
2.4/dev
 2022-09-20 13:32:54 +00:00
doug fdffac83e1 sysmon fix by bryant 2022-09-19 14:47:45 -04:00
Doug BurksandGitHub de0a7d3bcd Merge pull request #8293 from Security-Onion-Solutions/dougburks-patch-1 
change hyperlink for Elastic 8 issues
 2022-07-13 12:41:50 -04:00
Doug BurksandGitHub c67a58a5b1 change hyperlink for Elastic 8 issues 2022-07-13 12:40:03 -04:00
Doug BurksandGitHub 7ae5d49a4a Merge pull request #8290 from Security-Onion-Solutions/dougburks-patch-1 
increment version to 2.3.140
 2022-07-13 09:33:37 -04:00
Doug BurksandGitHub 34d3c6a882 increment version to 2.3.140 2022-07-13 09:32:28 -04:00
Doug BurksandGitHub 00cf0b38d0 Merge pull request #8165 from Security-Onion-Solutions/dougburks-patch-1 
FIX: Improve default dashboards #8136
 2022-06-21 12:57:46 -04:00
Doug BurksandGitHub 94c637449d FIX: Improve default dashboards #8136 2022-06-21 12:53:06 -04:00
Doug BurksandGitHub 286909af4b Merge pull request #8113 from Security-Onion-Solutions/fix/pfsense-category 
FIX: Add event.category field to pfsense firewall logs #8112
 2022-06-13 08:08:00 -04:00
doug 025993407e FIX: Add event.category field to pfsense firewall logs #8112 2022-06-13 08:03:44 -04:00
Doug BurksandGitHub 73baa1d2f0 Merge pull request #8073 from Security-Onion-Solutions/dougburks-patch-1 
Update motd.md to include links to Dashboards and Cases
 2022-06-04 08:53:54 -04:00
Doug BurksandGitHub dce415297c improve readability in motd.md 2022-06-04 06:59:09 -04:00
Doug BurksandGitHub de126647f8 Update motd.md to include links to Dashboards and Cases 2022-06-04 06:55:08 -04:00
Doug BurksandGitHub c34f456151 Merge pull request #8069 from Security-Onion-Solutions/dougburks-patch-1 
add bar and pie examples to overview dashboard in dashboards.queries.…
 2022-06-03 15:04:16 -04:00
Doug BurksandGitHub 83bff5ee87 add bar and pie examples to overview dashboard in dashboards.queries.json 2022-06-03 15:02:40 -04:00
Doug BurksandGitHub 918f431728 Merge pull request #8065 from Security-Onion-Solutions/dougburks-patch-1 
Add sankey diagram to default dashboard in dashboards.queries.json
 2022-06-03 11:13:39 -04:00
Doug BurksandGitHub 4a886338c8 fix description field for default dashboard in dashboards.queries.json 2022-06-03 11:10:01 -04:00
Doug BurksandGitHub 7da1802eae Add sankey diagram to default dashboard in dashboards.queries.json 2022-06-03 11:03:48 -04:00
Doug BurksandGitHub 91f8d3e5e9 Merge pull request #8050 from Security-Onion-Solutions/fix/elastalert-query 
FIX: Elastalert query in Hunt #8049
 2022-05-31 16:54:34 -04:00
Doug BurksandGitHub 269b16bbfd https://github.com/Security-Onion-Solutions/securityonion/issues/8049 2022-05-31 16:51:05 -04:00
Doug BurksandGitHub cd382a1b25 FIX: Elastalert query in Hunt #8049 2022-05-31 16:50:32 -04:00
Doug BurksandGitHub e1c9b0d108 FIX: Elastalert query in Hunt #8049 2022-05-31 16:47:52 -04:00
Doug BurksandGitHub 9a98667e85 FIX: Elastalert query in Hunt #8049 2022-05-31 16:47:11 -04:00
doug b93a108386 update Cases screenshot in README 2022-05-27 16:33:08 -04:00
doug 6089f3906d update screenshots and README 2022-05-27 16:32:00 -04:00
Doug BurksandGitHub 6bd02c0b99 Merge pull request #8003 from Security-Onion-Solutions/feature/elastic-7.17.4 
UPGRADE: Elastic 7.17.4 #8002
 2022-05-24 13:24:13 -04:00
Doug BurksandGitHub 1d0bb21908 UPGRADE: Elastic 7.17.4 #8002 2022-05-24 13:19:30 -04:00
Doug BurksandGitHub bde06e7ec5 UPGRADE: Elastic 7.17.4 #8002 2022-05-24 13:19:01 -04:00
Doug BurksandGitHub eb9597217c Merge pull request #7949 from Security-Onion-Solutions/fix/dashboards-hunt-queries 
update dashboards.queries.json and hunt.queries.json
 2022-05-16 08:47:06 -04:00
doug 5cbb50a781 update dashboards.queries.json and hunt.queries.json 2022-05-16 08:33:48 -04:00
Doug BurksandGitHub 58b049257d Merge pull request #7932 from Security-Onion-Solutions/dougburks-patch-1 
remove duplicate showSubtitle from hunt.queries.json
 2022-05-12 09:24:18 -04:00
Doug BurksandGitHub 6ed3f42449 remove duplicate showSubtitle from hunt.queries.json 2022-05-12 09:23:00 -04:00
Doug BurksandGitHub 2910b56ea1 Merge pull request #7835 from Security-Onion-Solutions/elastic-7.17.3 
UPGRADE: Elastic 7.17.3 #7807
 2022-04-21 09:02:51 -04:00
Doug BurksandGitHub e608285341 UPGRADE: Elastic 7.17.3 #7807 2022-04-21 08:57:08 -04:00
Doug BurksandGitHub 04856540dc UPGRADE: Elastic 7.17.3 #7807 2022-04-21 08:54:09 -04:00
Doug BurksandGitHub feb7eeeb8e UPGRADE: Elastic 7.17.3 #7807 2022-04-21 08:47:40 -04:00
Doug BurksandGitHub 44f4b1da7f Merge pull request #7832 from Security-Onion-Solutions/fix/prevent-multiple-instances 
FIX: Prevent multiple instances of so-sensor-clean and so-playbook-sync #6622
 2022-04-20 17:00:09 -04:00
Doug BurksandGitHub 1edb443c5d so-playbook-sync pgrep should be more strict to avoid multiple matches on Ubuntu 2022-04-20 16:48:26 -04:00
Doug BurksandGitHub 8fc03afdc0 so-sensor-clean pgrep should be more strict to avoid matching multiples on Ubuntu 2022-04-20 16:47:18 -04:00
Doug BurksandGitHub 3aac644da5 Merge pull request #7830 from Security-Onion-Solutions/dougburks-patch-1 
FIX: Improve Zeek file extraction #7829
 2022-04-20 14:13:13 -04:00
Doug BurksandGitHub 15ef0968d9 FIX: Improve Zeek file extraction #7829 2022-04-20 14:01:46 -04:00
Doug BurksandGitHub 6339ee3bf3 Merge pull request #7818 from Security-Onion-Solutions/dougburks-patch-1 
Slight change to IDH verbiage in so-whiptail
 2022-04-18 16:35:22 -04:00
Doug BurksandGitHub 5d62ece03b Slight change to IDH verbiage in so-whiptail 2022-04-18 16:33:54 -04:00
Doug BurksandGitHub 6905ca276a Merge pull request #7816 from Security-Onion-Solutions/dougburks-patch-1 
remove old comments from so-whiptail
 2022-04-18 11:30:43 -04:00
Doug BurksandGitHub 3682754399 remove old comments from so-whiptail 2022-04-18 11:29:46 -04:00
Doug BurksandGitHub 3fb7399000 Merge pull request #7813 from Security-Onion-Solutions/dougburks-patch-1 
Remove distributed verbiage from other node option in so-whiptail
 2022-04-18 08:24:52 -04:00
Doug BurksandGitHub 400879c079 Remove distributed verbiage from other node option in so-whiptail 2022-04-18 07:53:57 -04:00
Doug BurksandGitHub 62f3f13bbc Merge pull request #7803 from Security-Onion-Solutions/dougburks-patch-1 
move thehive removal from up_to_2.3.120 to post_to_2.3.120
 2022-04-15 15:48:12 -04:00
Doug BurksandGitHub 0eda9a3bd7 move thehive removal from up_to_2.3.120 to post_to_2.3.120 2022-04-15 15:45:01 -04:00
Doug BurksandGitHub ee00678362 Merge pull request #7802 from Security-Onion-Solutions/dougburks-patch-1 
Replace old saltstack repo in so-preflight
 2022-04-15 13:17:14 -04:00
Doug BurksandGitHub ce192c2526 Update so-preflight 2022-04-15 13:11:15 -04:00
Doug BurksandGitHub f461d01961 Merge pull request #7800 from Security-Onion-Solutions/dougburks-patch-1 
Improve grammar in so-whiptail
 2022-04-15 10:52:29 -04:00
Doug BurksandGitHub a69d361d1b Improve grammar in so-whiptail 2022-04-15 10:45:34 -04:00
Doug BurksandGitHub 1e187f0c44 Merge pull request #7703 from Security-Onion-Solutions/hotfix/2.3.110 
Hotfix/2.3.110
 2022-04-04 23:37:28 -04:00
Doug BurksandGitHub a3f8a10eb9 Merge pull request #7608 from Security-Onion-Solutions/fix/telegraf-non-root 
FIX: Run telegraf as non-root #7468
 2022-03-18 15:17:28 -04:00
Doug BurksandGitHub eda7a8d7ea FIX: Update telegraf influxdbsize.sh to collect influxdb size from influxdb_size.log #7468 2022-03-18 13:15:43 -04:00
Doug BurksandGitHub f7dc5588ae FIX: Update common init.sls to create cron job to write influxdb size for telegraf #7468 2022-03-18 13:13:46 -04:00
Doug BurksandGitHub c13994994b FIX: Update telegraf init.sls to run telegraf as non-root #7468 2022-03-18 13:11:56 -04:00
Doug BurksandGitHub 50477071b8 Merge pull request #7588 from Security-Onion-Solutions/fix/prevent-multiple-instances 
FIX: Prevent multiple instances of so-sensor-clean and so-playbook-sync #6622
 2022-03-16 13:54:00 -04:00
Doug BurksandGitHub e65f2a5513 FIX: Prevent multiple instances of so-sensor-clean #6622 2022-03-16 13:28:39 -04:00
Doug BurksandGitHub e56f90d83c FIX: Prevent multiple instances of so-playbook-sync #6622 2022-03-16 13:27:37 -04:00
Doug BurksandGitHub 9bf0265cea Merge pull request #7566 from Security-Onion-Solutions/feature/hunt-soc-auth 
FEATURE: Add new Hunt query for SOC logins #7327
 2022-03-15 10:58:40 -04:00
Doug BurksandGitHub eec44a6b02 Add a SOC Auth query to hunt.queries.json 2022-03-15 10:38:46 -04:00
Doug BurksandGitHub d1e1887e36 Add support for Kratos audit logs in hunt.eventfields.json 2022-03-15 10:37:58 -04:00
Doug BurksandGitHub 63cef4daff Merge pull request #7557 from Security-Onion-Solutions/dougburks-patch-1 
FIX: surilogcompress cron job not running
 2022-03-15 07:41:05 -04:00
Doug BurksandGitHub db4f138a78 FIX: surilogcompress cron job not running 
The suricata user was originally created with `/opt/so/conf/suricata` as its home directory. I think at some point we changed permissions on `/opt/so/conf` and at that point the `surilogcompress` cron job stopped working. Changing the home directory to `/nsm/suricata` works on all of my PROD systems (including Ubuntu and CentOS).

For more information, please see:
https://github.com/Security-Onion-Solutions/securityonion/issues/7133
 2022-03-15 07:10:02 -04:00
Doug BurksandGitHub 06efef7b81 Merge pull request #7467 from Security-Onion-Solutions/dougburks-patch-1 
Revert security_opt addition in telegraf init.sls
 2022-03-08 18:51:52 -05:00
Doug BurksandGitHub b76c01ef53 Revert security_opt addition in telegraf init.sls 2022-03-08 18:27:15 -05:00
Doug BurksandGitHub da8e885ede Merge pull request #7451 from Security-Onion-Solutions/fix/docker-apparmor 
Update init.sls to avoid telegraf apparmor issues
 2022-03-07 17:06:42 -05:00