CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
10,777 Commits 40 Branches 127 Tags
6eedae601f6d1a4a6738ee3dd6dfd3fc522acc4e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 69c7bb11c6 Merge pull request #9343 from Security-Onion-Solutions/fix/analyzers_localfile_file_path 
FIX: Ensure file path is ascertainable by localfile.py for localfile analyzer
 2022-12-08 17:08:19 -05:00
weslambertandGitHub 9477f29432 Remove double quotes to fix issue with file path sourcing from 'localfile.py' 2022-12-08 17:06:43 -05:00
weslambertandGitHub 2240283457 Merge pull request #9316 from Security-Onion-Solutions/fix/ics_scada_filebeat_disable_ecat_arp_info 
Disable Filebeat input for 'ecat_arp_info' Zeek logs
 2022-12-07 08:08:42 -05:00
weslambertandGitHub def0c85349 Disable Filebeat input for 'ecat_arp_info' Zeek logs 2022-12-07 08:00:21 -05:00
weslambertandGitHub 31832ae150 Merge pull request #9309 from Security-Onion-Solutions/fix/ignore_additional_strelka_rules_causing_compilation_errors 
Ignore additional rules causing YARA compilation errors
 2022-12-06 14:01:14 -05:00
weslambertandGitHub 7ce0924382 Ignore additional rules causing compilation errors 2022-12-06 13:59:21 -05:00
weslambertandGitHub 73304e049c Merge pull request #9304 from Security-Onion-Solutions/feature/ics_scada_additions 
Port STUN, TDS, WireGuard, and ICS/SCADA Changes from 2.3 to 2.4
 2022-12-06 13:14:47 -05:00
weslambertandGitHub a626acced0 Add new ICS/SCADA event fields to the dashboards section of the configuration and remove extra space in key names. 2022-12-06 13:11:55 -05:00
Wes 1b5c1fecd4 Revert SOC default 'alerts' event fields and specify additional event fields for ICS/SCADA events 2022-12-06 17:28:30 +00:00
Wes b048eec3c0 Add STUN, TDS, WireGuard, and ICS/SCADA dashboard queries 2022-12-06 17:17:49 +00:00
Wes f44eee134a Add default queries and ICS/SCADA queries 2022-12-06 16:52:20 +00:00
Wes c741fe6b4d Ensure ICS/SCADA plugins/scripts are enabled 2022-12-06 16:23:26 +00:00
Wes be5775e4a0 Ensure Filebeat defaults file is updated with ICS/SCADA log references 2022-12-06 16:15:09 +00:00
Wes 499b5d95f2 Add 'ics' tag for 'bsap'-prefixed events/logs 2022-12-06 16:01:57 +00:00
Wes 14af1d36cb Ensure ICS/SCADA pipelines are present 2022-12-06 15:58:47 +00:00
weslambertandGitHub 117a3d486a Merge pull request #9210 from Security-Onion-Solutions/fix/add_missing_opcua_activate_session_pipelines_2_4 
Add Missing OPCUA Activate Session Pipelines
 2022-11-22 16:01:45 -05:00
Wes 7f324bc47e Remove extra space used during testing 2022-11-22 20:52:08 +00:00
Wes a6bc5b108f Add missing OPCUA 'activate_session' pipelines 2022-11-22 20:51:44 +00:00
weslambertandGitHub 090f8309c2 Merge pull request #9207 from Security-Onion-Solutions/fix/ingest_typos_2_4 
Fix spelling of 'wireguard.responses' field name
 2022-11-22 15:36:04 -05:00
weslambertandGitHub 356904f751 Fix spelling of 'wireguard.responses' field name 2022-11-22 13:03:04 -05:00
weslambertandGitHub f9cc7888f4 Merge pull request #9204 from Security-Onion-Solutions/fix/ics_ingest_field_names_2_4 
Fix ICS Ingest Field Names
 2022-11-22 12:30:17 -05:00
weslambertandGitHub 6b77843e52 Fix format/speliing for 'enip.status_code' field name 2022-11-22 12:07:55 -05:00
weslambertandGitHub 13faf63770 Fix spelling for 'stun.class' field name 2022-11-22 12:07:15 -05:00
weslambertandGitHub b801997709 Merge pull request #9196 from Security-Onion-Solutions/fix/missing_ics_pipelines_2_4 
Add COTP and TDS ingest pipelines
 2022-11-22 08:44:19 -05:00
Wes a38e312df4 Add COTP and TDS ingest pipelines 2022-11-22 13:36:27 +00:00
weslambertandGitHub bde899e7cb Merge pull request #9194 from Security-Onion-Solutions/fix/ics_tag_syntax_error_2_4 
Fix syntax error for 'ics' tag logic
 2022-11-22 07:32:54 -05:00
weslambertandGitHub d2bc1a5523 Fix syntax error for 'ics' tag logic 2022-11-22 07:24:54 -05:00
weslambertandGitHub 68efd817e0 Merge pull request #9189 from Security-Onion-Solutions/feature/filebeat_config_ics_event_tag_2_4 
Add 'ics' tag to events generated from ICS protocol logs
 2022-11-21 17:06:14 -05:00
weslambertandGitHub fe180d5657 Fix indentation 2022-11-21 17:02:17 -05:00
weslambertandGitHub 9994d47a43 Add 'ics' tag to events generated from ICS protocol logs 2022-11-21 16:46:47 -05:00
weslambertandGitHub 061f0b0595 Merge pull request #9159 from Security-Onion-Solutions/feature/additional_ics_scada_ingest_pipelines_2_4 
Add additional ICS/SCADA ingest node pipelines
 2022-11-21 10:32:00 -05:00
Wes 05b9a067fd Add additional ICS/SCADA ingest node pipelines 2022-11-17 16:03:21 +00:00
weslambertandGitHub c14c8c1306 Merge pull request #9154 from Security-Onion-Solutions/fix/ics_scada_ingest_pipeline_updates_2_4 
Update ingest node pipelines for ICS/SCADA protocols
 2022-11-16 16:17:19 -05:00
Wes 638a3568b0 Update ingest node pipelines for ICS/SCADA protocols 2022-11-16 21:11:21 +00:00
weslambertandGitHub 8b0ea7104f Merge pull request #9003 from Security-Onion-Solutions/fix/remove_ja3er_references 
Remove JA3er references
 2022-10-26 10:37:45 -04:00
weslambertandGitHub 0ede5a7313 Remove JA3er references 2022-10-26 10:24:25 -04:00
weslambertandGitHub 409b8c276e Merge pull request #8999 from Security-Onion-Solutions/fix/sensoroni_analyzers_pyyaml_wheel_name 
Fix PyYAML .whl file name and remove JA3er analyzer
 2022-10-25 15:32:20 -04:00
Wes 803d2d4d75 Add PyYAML .whl files back since they were 'deleted' in the previous commit 2022-10-25 19:15:54 +00:00
Wes 0267ece4bf Fix PyYAML .whl file name and remove JA3er analyzer 2022-10-25 19:11:52 +00:00
weslambertandGitHub 078213ddb3 Merge pull request #8898 from Security-Onion-Solutions/feature/elastic-agent-configuration-log-package 
Add log package for Fleet to allow for custom log ingestion
 2022-10-11 12:14:15 -04:00
weslambertandGitHub dd09ce7aab Add log package for Fleet to allow for custom log ingestion 2022-10-11 12:00:57 -04:00
weslambertandGitHub 8437592bb5 Merge pull request #8869 from Security-Onion-Solutions/feature/elastic-8.4.3 
Elastic 8.4.3
 2022-10-06 16:03:36 -04:00
weslambertandGitHub bee1b06f76 Update to Kibana 8.4.3 2022-10-06 15:14:43 -04:00
weslambertandGitHub 985e1728d7 Update to Kibana 8.4.3 2022-10-06 15:13:27 -04:00
weslambertandGitHub 49dace66de Merge pull request #8796 from Security-Onion-Solutions/fix/elasticsearch_fleet_component_template_syntax 
Fix syntax for Fleet component templates
 2022-09-22 11:14:16 -04:00
Wes 0fd5fee868 Fix syntax for Fleet component templates 2022-09-22 15:07:43 +00:00
weslambertandGitHub e35c77be62 Merge pull request #8785 from Security-Onion-Solutions/fix/elasticsearch_component_templates_fleet_main 
Add additional component templates for Fleet and fix references for Elastic Agent index templates in defaults.yaml
 2022-09-20 17:02:02 -04:00
Wes 46dd4c2749 Rename component mappings and references for Security Onion 2022-09-20 20:33:06 +00:00
Wes 7f2c5bc757 Add component templates for Fleet 2022-09-20 20:27:26 +00:00
weslambertandGitHub d4fb78fe3b Merge pull request #8775 from Security-Onion-Solutions/fix/elasticsearch_elastic_agent_index_templates_load 
Update so-elasticsearch-templates-load to allow for proper loading of differently formatted Elastic Agent index templates
 2022-09-19 16:44:21 -04:00
weslambertandGitHub 509c32482f Update so-elasticsearch-templates-load to allow for proper loading of differently formatted Elastic Agent index templates 2022-09-19 16:39:49 -04:00
weslambertandGitHub 4c2ac9dd93 Merge pull request #8770 from Security-Onion-Solutions/fix/elasticsearch_cluster_settings 
Re-establish Elasticsearch cluster (search) settings
 2022-09-19 12:10:55 -04:00
Wes 9095bc2205 Re-establish Elasticsearch cluster (search) settings 2022-09-19 15:41:54 +00:00
weslambertandGitHub 0a8aae8180 Merge pull request #8757 from Security-Onion-Solutions/fix/elastic_agent_templates_managed_by_securityonion 
Change managed_by value from 'fleet' to 'security_onion' for Elastic Agent templates in defaults.yaml
 2022-09-16 17:20:03 -04:00
Wes 12e940f809 Change managed_by value from 'fleet' to 'security_onion' for Elastic Agent templates in defaults.yaml 2022-09-16 20:55:49 +00:00
weslambertandGitHub 6212a288e4 Merge pull request #8752 from Security-Onion-Solutions/fix/logstash_remove_osquery_livequery_output_configuration 
Remove Osquery live query Logstash output configuration
 2022-09-15 15:53:49 -04:00
Wes 1a90eeb1b1 Remove Osquery live query Logstash output configuration 2022-09-15 19:45:28 +00:00
weslambertandGitHub 39c7c8cf80 Merge pull request #8738 from Security-Onion-Solutions/fix/remove_old_pipeline_config 
Remove old Logstash pipeline configuration - initial cleanup
 2022-09-14 10:30:37 -04:00
Wes 926a1e0189 Remove Snort output configuration 2022-09-14 14:22:00 +00:00
Wes ce3ea456b6 Remove flow output configuration 2022-09-14 14:21:21 +00:00
Wes d1a8b88eb9 Remove postprocess configuration 2022-09-14 14:20:24 +00:00
Wes e3cd8a9c6a Remove main pipeline configuration 2022-09-14 14:20:08 +00:00
Wes 43f89adbd4 Remove preprocess configuration 2022-09-14 14:19:07 +00:00
weslambertandGitHub 94f47a847d Merge pull request #8721 from Security-Onion-Solutions/fix/elasticsearch_elastic_agent_template_defaults 
Add back Elastic Agent default templates
 2022-09-12 15:23:23 -04:00
weslambertandGitHub 030f4d228a Add back Elastic Agent default templates 2022-09-12 15:10:24 -04:00
weslambertandGitHub c25b981c50 Merge pull request #8688 from Security-Onion-Solutions/elastic_agent_security_subfield_additions 
Elastic Agent .security subfield additions
 2022-09-08 08:05:16 -04:00
Wes 86d60e444d Add Elastic Agent index/template configuration to defaults file 2022-09-08 00:20:22 +00:00
Wes b39a5061ca Load Elastic Agent component templates (managed by Security Onion) 2022-09-07 21:26:43 +00:00
Wes eeffded248 Remove duplicate security subfield configuration from component templates 2022-09-07 21:23:04 +00:00
Wes 3c50072690 Add Elastic Agent component templates 2022-09-07 18:51:57 +00:00
weslambertandGitHub 8099b1688b Merge pull request #8319 from Security-Onion-Solutions/fix/elasticsearch_query_missing_query_path 
Fix missing query path for so-elasticsearch-query
 2022-07-18 09:47:16 -04:00
weslambertandGitHub 2914007393 Add forward slash to fix issue with missing query path 2022-07-18 09:07:34 -04:00
weslambertandGitHub f5e10430ed Add forward slash to fix issue with missing query path 2022-07-18 09:07:13 -04:00
weslambertandGitHub 52ebbf8ff3 Merge pull request #8304 from Security-Onion-Solutions/fix/kibana_space_defaults_web_response_url 
Change web_response to evaluate the response from the Spaces API and the default space query
 2022-07-14 12:08:02 -04:00
weslambertandGitHub 2443e8b97e Change web_response to evaluate the response from the Spaces API and the default space query 2022-07-14 12:04:56 -04:00
weslambertandGitHub 4241eb4b29 Merge pull request #8298 from Security-Onion-Solutions/fix/kibana_space_defaults_shebang 
Add shebang so that so-kibana-space-defaults will work correctly on Ubuntu
 2022-07-13 16:50:21 -04:00
weslambertandGitHub 0fd4f34b5b Add shebang so that so-kibana-space-defaults will work correctly on Ubuntu 2022-07-13 16:48:39 -04:00
weslambertandGitHub 4a5664db7b Merge pull request #8289 from Security-Onion-Solutions/fix/soup_unsupported_indices_check 
Add missing 'fi' to if/then for unsupported indices check
 2022-07-13 09:15:22 -04:00
weslambertandGitHub 513c7ae56c Add missing 'fi' to if/then for unsupported indices check 2022-07-13 09:13:28 -04:00
weslambertandGitHub fa894cf83b Merge pull request #8288 from Security-Onion-Solutions/fix/soup_elastalert_indices_deletion_check 
Ensure Elastalert indices are deleted before continuing with SOUP
 2022-07-13 08:44:04 -04:00
weslambertandGitHub 8e92060c29 Ensure Elastalert indices are deleted before continuing with SOUP -- if they are not, generate a failure condition 2022-07-13 08:38:55 -04:00
weslambertandGitHub d7eb8b9bcb Merge pull request #8281 from Security-Onion-Solutions/fix/soup_elasticsearch8_index_compatibility 
SOUP - Check for indices created by Elasticsearch 6
 2022-07-12 16:20:47 -04:00
weslambertandGitHub d0a0ca8458 Update exit code for ES checks 2022-07-12 16:15:44 -04:00
weslambertandGitHub 4502182b53 Typo - Ensure Elasticsearch version 6 indices are checked 2022-07-12 15:35:46 -04:00
weslambertandGitHub 0fc6f7b022 Add check for Elasticsearch 6 indices 2022-07-12 15:34:24 -04:00
weslambertandGitHub e9a22d0aff Merge pull request #8275 from Security-Onion-Solutions/fix/filebeat_es_output_additions 
Specify outputs for Elasticsearch and Kibana for Eval and Import Mode
 2022-07-11 19:03:07 -04:00
weslambertandGitHub 11d3ed36b7 Specify outputs for Elasticsearch and Kibana for Eval and Import Mode 
Add outputs for Elasticsearch and Kibana for Eval/Import Mode, since Logstash is not used in Eval Mode or Import Mode. Otherwise, logs from these inputs end up in a filebeat-prefixed index.
 2022-07-11 17:22:09 -04:00
weslambertandGitHub d828bbfe47 Merge pull request #8273 from Security-Onion-Solutions/fix/kibana_space_defaults_cases 
Add securitySolutionCases feature to ensure Cases are disabled by default
 2022-07-11 16:39:30 -04:00
weslambertandGitHub bd32394560 Add securitySolutionCases feature to ensure Cases are disabled by default 2022-07-11 16:38:05 -04:00
weslambertandGitHub 6f4f050a96 Merge pull request #8272 from Security-Onion-Solutions/fix/soup_kibana_space_defaults 
Run so-kibana-space-defaults when upgrading to 2.3.140
 2022-07-11 14:47:11 -04:00
weslambertandGitHub f77edaa5c9 Run so-kibana-space-defaults to re-establish the default enabled features since Fleet feature name changed 2022-07-11 14:41:23 -04:00
weslambertandGitHub dd1d5b1a83 Merge pull request #8270 from Security-Onion-Solutions/fix/curator_actions_delete_kratos 
Add delete and warm action for Kratos indices in applicable Curator delete/warm scripts
 2022-07-11 11:39:43 -04:00
weslambertandGitHub e82b6fcdec Typo - Change 'delete' to 'warm' 2022-07-11 11:34:53 -04:00
weslambertandGitHub 8c8ac41b36 Add action for Kratos indices 2022-07-11 11:32:03 -04:00
weslambertandGitHub b611dda143 Add delete action for Kratos indices 2022-07-11 11:31:22 -04:00
weslambertandGitHub 3f5b98d14d Merge pull request #8269 from Security-Onion-Solutions/fix/curator_actions_kratos 
Add Curator actions and adjust Curator close scripts to account for so-kibana and so-kratos indices
 2022-07-11 11:21:20 -04:00
Wes Lambert 0b6219d95f Adjust Curator close scripts to include Kibana and Kratos indices 2022-07-11 14:51:33 +00:00
Wes Lambert 2f729e24d9 Add Curator action files for Kratos indices 2022-07-11 14:34:10 +00:00
weslambertandGitHub 992b6e14de Merge pull request #8268 from Security-Onion-Solutions/fix/kibana_disable_fleetv2 
Disable fleetv2 because it is now used to control Fleet visibility and 'fleet' is now used for 'Integrations'
 2022-07-11 10:09:12 -04:00
weslambertandGitHub 09a1d8c549 Disable fleetv2 because it is now used to control Fleet visibility and 'fleet' is now used for 'Integrations' 2022-07-11 10:06:24 -04:00