6669 Commits

Author	SHA1	Message	Date
weslambert	66f9a06458	Merge pull request #9566 from Security-Onion-Solutions/fix/elastic_fleet_integration_policy_load ... Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement	2023-01-11 16:17:40 -05:00
Wes	0e437f84e7	Add back echo statement to print the import policy being loaded	2023-01-11 21:13:30 +00:00
Wes	ea01e68846	Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement	2023-01-11 21:01:31 +00:00
Josh Patterson	add71cbdee	Merge pull request #9565 from Security-Onion-Solutions/2.4/firewall ... 2.4/firewall	2023-01-11 15:04:25 -05:00
m0duspwnens	80f65fcd62	remove 514/tcp from filebeat for now	2023-01-11 14:54:05 -05:00
Mike Reeves	66924b63a7	Update 9999_output_redis.conf.jinja	2023-01-11 14:53:16 -05:00
Mike Reeves	bdaed849ea	Update 0900_input_redis.conf.jinja	2023-01-11 14:52:32 -05:00
m0duspwnens	0d45c1583e	add so-filebeat docker container ports and add to standalone	2023-01-11 14:48:20 -05:00
m0duspwnens	81e07997f0	add so-elastic-fleet docker container ports and add to standalone	2023-01-11 14:28:35 -05:00
weslambert	4391c22335	Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies	2023-01-11 12:23:50 -05:00
weslambert	b3e0183e39	Remove pipeline.load from top.sls so that Filebeat module loading is not attempted	2023-01-11 12:19:06 -05:00
Wes	52b620b137	Add additional conditional logic for Filebeat and disable Filebeat	2023-01-11 14:10:11 +00:00
Wes	33e2affb1d	Remove newlines from end of Syslog processor definitions	2023-01-11 14:08:28 +00:00
Wes	c3b83f1fc8	Update template settings to use data streams	2023-01-11 14:03:11 +00:00
Wes	5062dd2873	Suricata Elasticsearch ingest node pipeline changes - set 'alert' dataset	2023-01-11 14:02:09 +00:00
Wes	2e886d0c55	Remove data_index_name processor since we are using data streams	2023-01-11 13:58:38 +00:00
Wes	5d86edeed4	Modify Logstash Elastic Agent output to accomodate for events with and without 'metadata.pipeline'	2023-01-11 13:57:32 +00:00
Wes	caf0ea6b53	Add Elastic Agent policy view script	2023-01-11 13:56:21 +00:00
Wes	a146f1134e	Add Elastic Agent utility scripts	2023-01-11 13:54:42 +00:00
Mike Reeves	7cecc910d5	Merge pull request #9458 from Security-Onion-Solutions/2.4/firewall ... 2.4/firewall	2023-01-11 08:49:15 -05:00
m0duspwnens	76fff1b1e0	add logstash ports	2023-01-10 17:02:54 -05:00
Doug Burks	c15db73561	Avoid unnecessary Zeek processes in Import Mode	2023-01-10 16:48:47 -05:00
Doug Burks	554754421c	Avoid unecessary Suricata processes in Import Mode	2023-01-10 16:48:06 -05:00
Doug Burks	322efa304a	Avoid unnecessary processes in Import Mode	2023-01-10 16:47:18 -05:00
Mike Reeves	ab3a7abcc7	run restore each time	2023-01-10 16:08:44 -05:00
Mike Reeves	302bf28b6c	Merge branch '2.4/firewall' of https://github.com/Security-Onion-Solutions/securityonion into 2.4/firewall	2023-01-09 15:00:05 -05:00
Mike Reeves	5058210bbb	Changes to iptables.jinja	2023-01-09 14:59:55 -05:00
m0duspwnens	ac157432de	include docker	2023-01-09 14:58:36 -05:00
m0duspwnens	ec5c565cec	put elastalert on sosbridge	2023-01-09 14:49:33 -05:00
m0duspwnens	dbbcea0009	look for True	2023-01-09 11:53:32 -05:00
m0duspwnens	c313b19b50	Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/firewall	2023-01-09 11:18:08 -05:00
Mike Reeves	73ae48d28e	Merge pull request #9539 from Security-Onion-Solutions/mkr24 ... Changes to accept minion	2023-01-09 11:17:45 -05:00
Mike Reeves	0e1e9ff343	Changes to accept minion	2023-01-09 11:15:29 -05:00
Doug Burks	c1dfb9f935	Add missing Zeek log to filebeat defaults.yaml	2023-01-06 14:27:40 -05:00
Doug Burks	10e82c5f1c	Remove line numbers from vi	2023-01-06 14:23:54 -05:00
m0duspwnens	d4c6834cd0	merge with 2.4/dev	2023-01-06 14:01:58 -05:00
m0duspwnens	4aacc6d1db	change role names in so-firewall-minion	2023-01-06 11:09:09 -05:00
m0duspwnens	cb1822a62d	change ref to DOCKER.sosrange	2023-01-05 15:57:06 -05:00
m0duspwnens	f10238da42	fw changes	2023-01-04 16:06:14 -05:00
Mike Reeves	2e53476a06	Merge pull request #9516 from Security-Onion-Solutions/mkr24 ... Add PW auth for Redis	2023-01-04 14:50:27 -05:00
Mike Reeves	275aead5b9	Allow auth for redis check for tgraf	2023-01-04 14:30:28 -05:00
Mike Reeves	e52b54720a	Allow auth for redis check for tgraf	2023-01-04 14:26:24 -05:00
Mike Reeves	5afad52b3f	Allow auth for redis check for tgraf	2023-01-04 14:18:08 -05:00
Mike Reeves	9bc08661c5	Allow auth for redis check for tgraf	2023-01-04 14:15:53 -05:00
Mike Reeves	48a3f4e261	Allow auth for redis check for tgraf	2023-01-04 14:14:10 -05:00
doug	7ba4bdd87b	fix jinja whitespace	2023-01-04 13:50:25 -05:00
Mike Reeves	831300b540	Require password auth for redis access	2023-01-04 11:02:40 -05:00
Doug Burks	5754365c6d	Improve default sysmon fields and add new network_connection fields	2023-01-04 07:42:24 -05:00
Mike Reeves	08d7b24fb4	Update soc_global.yaml	2023-01-03 12:17:51 -05:00
Mike Reeves	df89445ab5	Update soc_global.yaml	2023-01-03 12:17:14 -05:00