6dbe0645e5
use auto_expand_replica, configure ilm for so-case* & so-detection*
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-11-11 13:51:48 -06:00
dcbb0e48d4
make sure its owned by socore
2024-11-08 14:34:29 -05:00
74b95a0bcc
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/templaterepos
2024-11-08 09:20:11 -05:00
8b70aa9f0e
Fix socore permissions
2024-11-08 09:19:41 -05:00
8334fd9c46
Source Dates
2024-11-07 14:44:45 -07:00
47f9b0021c
Merge pull request #13879 from Security-Onion-Solutions/2.4/templaterepos
...
Add local custom template
2024-11-07 15:40:36 -05:00
f5bd8ab585
Rewrite docs
2024-11-07 15:33:47 -05:00
28d468dd41
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/templaterepos
2024-11-07 07:25:01 -05:00
80b82b0bd6
missing replica 0
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-11-06 15:24:13 -06:00
039d5c22ac
fix: crowdstrike integration
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-11-06 14:35:41 -06:00
52a144c052
Added Help Link to Annotation for IgnoredSidRanges
2024-11-05 12:11:17 -07:00
25d55feeef
More Detailed Description
2024-11-05 11:41:14 -07:00
5e48ccafce
Update Default Value
2024-11-05 11:11:34 -07:00
69dd35c30a
Add Option for Ignoring Ranges of SIDs in Suricata Integrity Check
2024-11-04 14:31:53 -07:00
7896f951f3
timestamp fix
2024-10-31 10:24:58 -04:00
01932d873f
Merge pull request #13883 from Security-Onion-Solutions/2.4/lookuprev2
...
2.4/lookuprev2
2024-10-31 08:46:01 -04:00
6b468eaed3
rm eaintegration state file
2024-10-30 16:52:44 -04:00
c509dab5f1
Use socore user
2024-10-30 11:03:14 -04:00
36fc3bbd6d
add so-ip-mappings index
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-10-30 10:24:11 -04:00
5406a263d5
Add local custom template
2024-10-29 19:42:06 -04:00
4c5099d429
Initial support for local lookup
2024-10-29 10:27:54 -04:00
6a3e5415cf
Merge pull request #13832 from Security-Onion-Solutions/2.4/sigmapipelines
...
Add process and file creation mappings
2024-10-28 18:30:21 -04:00
f3ca5b1c42
Remove OS-specific mappings
2024-10-28 09:19:51 -04:00
640f53d085
Cleanup
...
Fix indentation and trailing comma.
2024-10-24 17:05:36 -06:00
1aa9d87c5d
Corrected
...
Put the note on the right model this time.
2024-10-24 17:05:36 -06:00
e11c562022
Added Note to ES Mappings
2024-10-24 17:05:35 -06:00
6ce52bf9ab
Specify Defaults for detectionEngineStatusQueries
...
Specify the defaults as an example to the user.
2024-10-24 13:11:49 -06:00
f67fcecc6e
Clean up StatusQueries String
2024-10-24 11:18:48 -06:00
b7c392a244
Corrected a misspelling
2024-10-24 11:18:48 -06:00
ad0b0a5e95
Refactor to String
...
To accomodate the config screen, the annotation now specifies it as a multiline string with a yaml syntax. The user can edit the yaml to add or remove queries. The UI will parse the YAML before use.
Also updated the IntegrityFailure queries to specify table columns more relevant to a sync failure than the default ones.
2024-10-24 11:18:47 -06:00
c77b0afd8e
Move to Client/Detections
...
Added a basic annotation.
2024-10-24 11:18:47 -06:00
04ebe4efea
Array to Dictionary
2024-10-24 11:18:46 -06:00
cbb4d6846f
Detection Engine Status Queries
...
A few for testing
2024-10-24 11:18:45 -06:00
a0558ace16
replace: False to remove state warning
2024-10-24 10:33:16 -04:00
ca793966a8
set retry and interval to remove state warning
2024-10-24 10:32:42 -04:00
578a18acbe
Merge pull request #13853 from Security-Onion-Solutions/agcr
...
install createrepo for airgap
2024-10-23 14:21:26 -04:00
8cc530dd4c
fix HELD for debian families
2024-10-23 09:36:17 -04:00
1df104967e
fix pkg name
2024-10-22 16:50:23 -04:00
7a0f6d5e93
fix pkg name
2024-10-22 16:42:01 -04:00
8d2ae23ae6
install createrepo on airgap and non airgap
2024-10-22 13:56:38 -04:00
4d093735ec
prevent state from failing if versionlock plugin not installed
2024-10-18 14:41:23 -04:00
39230159ae
update description
2024-10-17 12:10:49 -04:00
76ff0c56cd
create versionlock pillar dir/files during soup to 120
2024-10-17 10:06:40 -04:00
17870bcab8
Merge remote-tracking branch 'origin/2.4/dev' into issue/204
2024-10-17 09:59:36 -04:00
5fb660bc9a
remove kernel bool option, just use list
2024-10-17 09:29:03 -04:00
73ce526467
allow users to lock pkgs from upgrade
2024-10-16 17:06:03 -04:00
322199358d
add support for trendmicro integration
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-10-16 16:45:46 -04:00
dcdfaf66f4
Add process and file creation mappings
2024-10-16 15:20:52 -04:00
a3933bdc79
Merge pull request #13826 from Security-Onion-Solutions/cogburn/ai-switch-flip
...
Changes to allow reviews to start showing
2024-10-15 16:03:18 -06:00
ce6c7c3b91
Merge remote-tracking branch 'origin/2.4/dev' into issue/13808
2024-10-15 13:14:18 -04:00
reyesj2
defensivedepth
Corey Ogburn
m0duspwnens
coreyogburn