Wes
6ed82d7b29
Remove YARA download in setup
2024-05-09 17:27:46 +00:00
Jason Ertel
8364b2a730
update for testing
2024-05-07 14:30:52 -04:00
Jason Ertel
4ebe070cd8
test regexes for detections
2024-05-06 19:03:12 -04:00
DefensiveDepth
7f12d4c815
Exclude new sigma rules
2024-05-03 15:22:53 -04:00
Josh Patterson
b50789a77c
Merge pull request #12928 from Security-Onion-Solutions/orchit
...
Orchit
2024-05-03 15:17:34 -04:00
Doug Burks
6cbbb81cad
FEATURE: Add hyperlink to airgap screen in setup #12925
2024-05-03 12:59:41 -04:00
m0duspwnens
442a717d75
orchit
2024-05-03 12:08:57 -04:00
Doug Burks
5fe8c6a95f
Update so-whiptail to make installation screen more consistent
2024-05-03 09:38:34 -04:00
Doug Burks
9a4a85e3ae
FEATURE: Lower EVAL memory requirement to 8GB RAM #12896
2024-05-01 07:54:38 -04:00
m0duspwnens
a663bf63c6
set Suricata as default pcap engine for eval
2024-04-29 14:22:04 -04:00
Mike Reeves
b5c5c7857b
Merge pull request #12846 from petiepooo/fix/check-srvc-status
...
check status before stopping service
2024-04-25 15:10:42 -04:00
Pete
e53e7768a0
check status before stopping service
...
resolves #12811 so-verify detects rare false error
If salt is uninstalled during call to so-setup where it detects a previous install, the "Failed" keyword from "systemctl stop $service" causes so-verify to falsely detect an installation error. This might happen if the user removes the salt packages between calls to so-setup, or if upgrading from Ubuntu 20.04 to 22.04 then installing 2.4.xx on top of a 2.3.xx installation.
The fix is to wrap the call to stop the service in a check if the service is running.
This ignores the setting of pid var, as the next use of pid is within a while loop that will not execute for the same reason the systemctl stop call was not launched in the background.
2024-04-23 21:24:39 +00:00
Jason Ertel
6046848ee7
skip telemetry summary in airgap mode
2024-04-04 10:25:32 -04:00
Jason Ertel
7c64fc8c05
do not prompt about telemetry on airgap installs
2024-04-03 18:08:42 -04:00
Jason Ertel
941a841da0
fix link
2024-04-03 14:41:57 -04:00
Jason Ertel
2b8a051525
fix link
2024-04-03 14:30:09 -04:00
Jason Ertel
ff777560ac
limit col size
2024-04-01 10:35:15 -04:00
Jason Ertel
2c68fd6311
limit col size
2024-04-01 10:32:54 -04:00
Jason Ertel
c1bf710e46
limit col size
2024-04-01 10:32:25 -04:00
Jason Ertel
3aea2dec85
analytics
2024-04-01 09:50:18 -04:00
DefensiveDepth
d7ecad4333
Initial cut to remove Playbook and deps
2024-03-25 19:42:31 -04:00
Doug Burks
9c6f3f4808
FIX: Specify that static IP address is recommended #12643
2024-03-22 13:41:44 -04:00
Jason Ertel
cd28c00d67
auto-convert email addresses to lowercase during setup
2024-03-11 13:47:31 -04:00
Jason Ertel
b5d8df7fb2
auto-convert email addresses to lowercase during setup
2024-03-11 13:45:57 -04:00
Mike Reeves
9a413a2e31
Fix location of repo
2024-03-06 12:42:22 -05:00
Mike Reeves
1fe8f3d9e4
Merge pull request #12405 from Security-Onion-Solutions/repochange
...
Manage the repo files
2024-02-29 14:01:48 -05:00
Josh Brower
c6baa4be1b
Airgap Support - Detections module
2024-02-26 16:19:32 -05:00
Mike Reeves
9ca0f586ae
Manage the repos
2024-02-21 11:45:02 -05:00
Mike Reeves
2db5f4dd41
Merge pull request #12308 from petiepooo/feat-es-ownfs
...
FEATURE: Check for mountpoint during Elastic size limit calculations
2024-02-12 16:03:36 -05:00
Mike Reeves
f91cb5b81f
Merge pull request #12290 from petiepooo/fix-remove-intca-symlink
...
fix: also remove intca symlink
2024-02-12 12:33:13 -05:00
Pete
cf83d1cb86
feat: use mountpoint for Elastic log limit
...
Instead of just existence, this checks if the directories are separate mountpoints when determining disk size and log_size_limit calculations.
It also sets the percentage to 80 if /nsm/elasticsearch is a separate mountpoint. This allows for better disk utilization on server configurations where /nsm is based on large slow HDDs for increased PCAP retention but /nsm/elasticsearch is based on SSDs for faster Elasticsearch performance.
2024-02-02 12:25:16 -05:00
Pete
7a29b3a529
call salt before stopping salt services
...
salt-call does not work when the salt-master is not running. If these calls are to succeed, they should occur before the salt services are stopped.
2024-02-02 08:45:01 -05:00
Mike Reeves
341ff5b564
Update so-functions
2024-01-31 16:18:51 -05:00
reyesj2
a73d78300a
Add initial stig state
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-01-15 21:17:17 -05:00
weslambert
5e1e685ce0
Exclude Cisco failed_attempts pipeline
2024-01-11 10:52:30 -05:00
Josh Brower
9159eab9fd
Merge pull request #12151 from Security-Onion-Solutions/fix/so-playbook-reset
...
Fix reinstall & reset stability
2024-01-10 14:23:53 -05:00
Mike Reeves
fc2f02c0a0
Update so-functions
2024-01-10 14:19:47 -05:00
Mike Reeves
1e3a00a833
Update so-functions
2024-01-10 14:16:55 -05:00
Josh Brower
6ff764e6a1
refactor for reinstall stability
2024-01-10 10:22:50 -05:00
m0duspwnens
ccfdafea0a
enable startup_states: highstate on managers during setup and not with salt
2024-01-04 16:24:48 -05:00
m0duspwnens
7b9ac7ae6d
remove checkin_at_boot function
2023-12-19 14:05:19 -05:00
m0duspwnens
b3be999aea
dont enable startup_states during setup. use salt to add it
2023-12-19 09:00:32 -05:00
Jason Ertel
997d323763
more log false alarms
2023-12-14 08:55:18 -05:00
Wes
bbe091fa14
Fix accidental change
2023-12-12 15:08:47 +00:00
Wes
d203aec44a
Remove Curator
2023-12-08 19:37:06 +00:00
Jason Ertel
e71ee97717
ignore libwbclient upgrade warning
2023-11-19 19:03:23 -05:00
Jason Ertel
32079a7bce
Merge pull request #11734 from Security-Onion-Solutions/fix/elastic_scripts
...
Improve error handling and add retry logic
2023-11-08 12:19:00 -05:00
Jason Ertel
3701c1d847
ignore retry logging
2023-11-08 11:50:56 -05:00
Jason Ertel
b99c7ce76e
improve verbosity of setup logs
2023-11-06 11:22:35 -05:00
Josh Brower
0dec6693dc
Merge pull request #11678 from Security-Onion-Solutions/2.4/fleetreset
...
Add Elastic Fleet reset script
2023-11-02 11:33:58 -04:00
