CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity
4,822 Commits 24 Branches 119 Tags
6b292ea62b90170e09ba967a0ed224e52ff3438c
Commit Graph

4822 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambert
6b292ea62b Merge pull request #1448 from Security-Onion-Solutions/fix/so_elastic_clear 
Fix/so elastic clear
 2020-10-05 09:40:04 -04:00
Wes Lambert
da8957b4f4 Use Elasticsearch pillar vs manager IP for so-elastic-clear 2020-10-05 13:37:06 +00:00
Wes Lambert
1970d95d5f Make Filebeat registry persistent to avoid re-reading old data 2020-10-05 13:30:04 +00:00
Doug Burks
e7cba6ba1d Change SOC Alerts eventFetchLimit from 5000 to 500 #1447 2020-10-05 09:29:01 -04:00
Doug Burks
948e0c4c61 Add rule.name to Hunt Wazuh Alerts query #1442 2020-10-05 09:26:13 -04:00
Jason Ertel
cf5b1245ea Add configurable flags to enable/disable dismiss and escalate buttons 2020-10-05 09:16:17 -04:00
weslambert
771d091d6e Merge pull request #1446 from Security-Onion-Solutions/feature/wazuh_severity 
Add event.severity and event.severity_label config for Wazuh alerts
 2020-10-05 08:52:20 -04:00
Wes Lambert
77d31cb289 Add event.severity and event.severity_label config for Wazuh alerts 2020-10-05 12:50:29 +00:00
weslambert
203e84d2cf Update comma verbiage for HOME_NET in whiptail menu 2020-10-05 08:08:22 -04:00
Josh Brower
7b05cf4266 Merge pull request #1443 from Security-Onion-Solutions/feature/training-req 
Feature/training req
 2020-10-04 21:37:03 -04:00
Josh Brower
8a78485906 Config Playbook SOC Alerts 2020-10-04 21:35:42 -04:00
Josh Brower
c80b6ce104 Add so-allow-view and playbook event.sev.label 2020-10-04 20:39:21 -04:00
William Wernert
8310559273 Merge pull request #1440 from Security-Onion-Solutions/feature/generate-playbook-api-key 
Feature/generate playbook api key
 2020-10-02 14:37:58 -04:00
William Wernert
2a100c0dcc Add OLD_ prefix + only update rules if playbook enabled 2020-10-02 14:34:30 -04:00
William Wernert
d0c267ca90 Fix sed command to not delete lines after match 2020-10-02 14:31:16 -04:00
William Wernert
54da2b869c Add OLD_ db init files for soup compatibility 2020-10-02 14:12:23 -04:00
William Wernert
ab662e9b81 Merge branch 'dev' into feature/generate-playbook-api-key 
# Conflicts:
#	salt/common/tools/sbin/soup
 2020-10-02 13:48:52 -04:00
William Wernert
db12b6f3c6 Remove salt call to automation_user_create 2020-10-02 13:17:57 -04:00
William Wernert
96d32fda51 Add old api key to pillar during soup 2020-10-02 13:16:58 -04:00
Mike Reeves
15f0c98281 Fix Formatting 2020-10-02 13:06:03 -04:00
William Wernert
20fd757847 Run playbook-ruleupdate after soctopus is running 2020-10-02 10:05:10 -04:00
William Wernert
39e14b3910 Merge branch 'dev' into feature/generate-playbook-api-key 2020-10-02 08:39:09 -04:00
Mike Reeves
c7fcdc8084 Merge pull request #1438 from Security-Onion-Solutions/socyaml 
Socyaml
 2020-10-01 18:08:33 -04:00
Mike Reeves
4991ea8de3 Jason made me rename json 2020-10-01 18:07:06 -04:00
Mike Reeves
36ccece724 commas gone crazy 2020-10-01 18:02:06 -04:00
Mike Reeves
a0432e97b0 Python print ftl 2020-10-01 17:57:56 -04:00
Mike Reeves
490278a4c3 Add alert events filed 2020-10-01 17:49:17 -04:00
Mike Reeves
bd5efbabd9 Fix Mode 2020-10-01 17:43:43 -04:00
Mike Reeves
8fa426f265 Cleanup sync 2020-10-01 17:41:55 -04:00
Mike Reeves
9d9d3aac53 Switch to JSON from yaml 2020-10-01 17:37:57 -04:00
Mike Reeves
744a8bca73 More json for soc 2020-10-01 17:30:23 -04:00
Mike Reeves
8a41636e7f More json for soc 2020-10-01 17:28:45 -04:00
Mike Reeves
dc79dca7fe More json for soc 2020-10-01 17:25:51 -04:00
Mike Reeves
1c55f738ec More json for soc 2020-10-01 17:23:29 -04:00
William Wernert
e98012ae2c Fix jinja and change state orrder in setup 2020-10-01 17:16:26 -04:00
Mike Reeves
92fa33159e More json for soc 2020-10-01 17:12:08 -04:00
Mike Reeves
5730c85988 More json for soc 2020-10-01 17:04:15 -04:00
Mike Reeves
63be0734c9 More json for soc 2020-10-01 17:00:25 -04:00
Mike Reeves
5653828154 More json for soc 2020-10-01 16:57:04 -04:00
weslambert
2d2f4de337 Merge pull request #1437 from Security-Onion-Solutions/fix/kib_scripted_thehive 
Update scripted field for TheHive case
 2020-10-01 16:54:02 -04:00
Wes Lambert
8a81a5148b Update scripted field for TheHive case 2020-10-01 20:52:57 +00:00
weslambert
98bef8fb9d Merge pull request #1436 from Security-Onion-Solutions/fix/kibana_soc_thehive_case 
Add SOC url for api integration
 2020-10-01 16:47:11 -04:00
Wes Lambert
eced18c3cc Add SOC url for api integration 2020-10-01 20:29:28 +00:00
Jason Ertel
8e15ed56d6 'Escalated' filter toggle will auto-enable 'acknowledged' filter toggle 2020-10-01 16:23:47 -04:00
Mike Reeves
cc2f2de5b5 soc.json stuff 2020-10-01 15:23:07 -04:00
Mike Reeves
b423e8d22a soc.json stuff 2020-10-01 15:20:13 -04:00
Mike Reeves
1a561f6b12 soc.json stuff 2020-10-01 15:18:34 -04:00
William Wernert
a5bf4bbb35 Fix test for key in global.sls 2020-10-01 14:47:18 -04:00
Doug Burks
e836f96c65 move rule.uuid after rule.name 2020-10-01 12:09:52 -04:00
Doug Burks
4851069a10 remove rule.gid from Alerts groupby since Wazuh and Playbook may not have that field 2020-10-01 11:51:40 -04:00