Wes
|
713e9ee215
|
Create initial template for ILM policy load script
|
2023-02-08 20:10:41 +00:00 |
|
m0duspwnens
|
6e45f1b6e1
|
Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/firewall
|
2023-02-03 09:55:50 -05:00 |
|
Wes
|
bc082dff99
|
Only run Zeek if it is defined as 'mdengine'
|
2023-02-02 16:22:42 +00:00 |
|
m0duspwnens
|
9eae31e488
|
add managersearch to allowed roles for so-firewall. fix setup error from so-firewall "Please specify a role with --role="
|
2023-02-02 10:03:22 -05:00 |
|
weslambert
|
d242050627
|
Disable loading of Kibana and Logstash logs for now since there are issues with the packages from the registry
|
2023-02-01 15:59:35 -05:00 |
|
weslambert
|
74eed31eec
|
Change Elasticsearch output name from 'so-manager_elasticsearch2' to 'so-manager_elasticsearch'
|
2023-01-31 12:55:03 -05:00 |
|
Wes
|
5472f53c9f
|
Remove bind mount and reference the correctly named entrypoint script
|
2023-01-30 21:24:30 +00:00 |
|
Wes
|
0156784687
|
Add EVTX integration policy for 'so-import-evtx'
|
2023-01-30 21:22:37 +00:00 |
|
Wes
|
cc100e50cd
|
Update so-import-evtx to convert EVTX to a JSON file instead of streaming to Elasticsearch
|
2023-01-30 21:09:58 +00:00 |
|
weslambert
|
8240e5b20d
|
Remove 'prospector.scanner' prefix from 'exclude_files' configuration
|
2023-01-27 16:46:43 -05:00 |
|
Doug Burks
|
b160d0add5
|
Fix typos in so-elastic-fleet-integration-policy-load
|
2023-01-27 15:45:58 -05:00 |
|
weslambert
|
68fac4488e
|
Fix syntax for Zeek integration policies
|
2023-01-27 15:27:15 -05:00 |
|
weslambert
|
e47f64bd04
|
Change event.category from 'file' to 'network'
|
2023-01-27 12:00:30 -05:00 |
|
weslambert
|
f49627cec1
|
Update Zeek file exclusions and add a minor output formatting change
|
2023-01-27 11:47:14 -05:00 |
|
weslambert
|
6b251a2596
|
Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field
|
2023-01-27 11:30:06 -05:00 |
|
weslambert
|
a8d2631d75
|
Merge pull request #9650 from Security-Onion-Solutions/fix/elastic_agent_add_import_mode
Elastic Agent - Import Mode
|
2023-01-26 11:33:20 -05:00 |
|
Wes
|
b381c5424e
|
Remove extra whitespace after 'so-elastic-agent-builder' line in 'so-image-common'
|
2023-01-26 16:13:23 +00:00 |
|
Wes
|
f1db1bc273
|
Ensure Kratos events are sent to a data stream instead of an index
|
2023-01-26 16:12:06 +00:00 |
|
Wes
|
8051fc70eb
|
Temporarily disable the loading of the RITA package policy
|
2023-01-26 16:03:59 +00:00 |
|
Wes
|
a9a119f1ab
|
Add Elasticsearch output to 'so-elastic-fleet-setup' for Import Mode
|
2023-01-26 16:02:27 +00:00 |
|
weslambert
|
6ee66a34bc
|
Revert "Elastic Agent and Fleet - Import Mode"
|
2023-01-25 17:12:03 -05:00 |
|
m0duspwnens
|
790aa6b684
|
add logstash pillar items for minions
|
2023-01-25 15:18:56 -05:00 |
|
Wes
|
5c58cda872
|
Move certificate configuration outside of conditional logic
|
2023-01-25 19:29:50 +00:00 |
|
Wes
|
86a925e1c7
|
Download Elastic Agent images for Import Mode
|
2023-01-25 16:09:12 +00:00 |
|
Wes
|
838beabae5
|
Add missing single quote for Elastic Agent Elasticsearch output
|
2023-01-25 15:58:06 +00:00 |
|
Wes
|
506baa854d
|
Configure Elasticsearch output if running Import Mode
|
2023-01-25 13:52:54 +00:00 |
|
weslambert
|
7bf9d77962
|
Rename Kratos data stream
|
2023-01-25 08:18:21 -05:00 |
|
Wes
|
38ead7cb82
|
Remove import tag for now
|
2023-01-24 17:58:19 +00:00 |
|
Wes
|
1e5377c78a
|
Condense RITA integration policies, add ICS tags, and improve output readability
|
2023-01-24 16:56:20 +00:00 |
|
weslambert
|
7e0e5071d9
|
Merge pull request #9627 from Security-Onion-Solutions/fix/elastic_agent_integration_improvements
Elastic Agent Integration Improvements
|
2023-01-24 10:10:01 -05:00 |
|
Wes
|
7b4d8a47f0
|
Add copyright header to 'so-elastic-fleet-*' scripts
|
2023-01-24 15:07:00 +00:00 |
|
m0duspwnens
|
ee98e0684e
|
change MASTER to MANAGER
|
2023-01-24 09:44:01 -05:00 |
|
Wes
|
40c6b380df
|
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
|
2023-01-23 21:44:46 +00:00 |
|
Wes
|
d342f3c4b8
|
Add 'so-elastic-fleet-integration-policy-bulk-delete' to perform bulk deletion of integration policies
|
2023-01-23 21:38:13 +00:00 |
|
Josh Brower
|
d3cb57bba2
|
Rerun the playbook state
|
2023-01-23 08:16:28 -05:00 |
|
Wes
|
739c174898
|
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 21:50:10 +00:00 |
|
Jason Ertel
|
79fb5dc525
|
prevent false success occurring when deleting the grafana dashboard
|
2023-01-19 14:19:55 -05:00 |
|
Jason Ertel
|
05c7999df3
|
merge
|
2023-01-19 10:06:58 -05:00 |
|
Jason Ertel
|
05a6d702b0
|
Add logic to determine if setup succeeded and provide relevant output
|
2023-01-19 10:03:03 -05:00 |
|
Josh Brower
|
e83e54936e
|
Temp disable Elastic Registry Repo
|
2023-01-19 07:25:25 -05:00 |
|
Wes
|
0e437f84e7
|
Add back echo statement to print the import policy being loaded
|
2023-01-11 21:13:30 +00:00 |
|
Wes
|
ea01e68846
|
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 21:01:31 +00:00 |
|
weslambert
|
4391c22335
|
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:23:50 -05:00 |
|
Wes
|
33e2affb1d
|
Remove newlines from end of Syslog processor definitions
|
2023-01-11 14:08:28 +00:00 |
|
Wes
|
caf0ea6b53
|
Add Elastic Agent policy view script
|
2023-01-11 13:56:21 +00:00 |
|
Wes
|
a146f1134e
|
Add Elastic Agent utility scripts
|
2023-01-11 13:54:42 +00:00 |
|
m0duspwnens
|
dbbcea0009
|
look for True
|
2023-01-09 11:53:32 -05:00 |
|
m0duspwnens
|
c313b19b50
|
Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/firewall
|
2023-01-09 11:18:08 -05:00 |
|
Mike Reeves
|
73ae48d28e
|
Merge pull request #9539 from Security-Onion-Solutions/mkr24
Changes to accept minion
|
2023-01-09 11:17:45 -05:00 |
|
Mike Reeves
|
0e1e9ff343
|
Changes to accept minion
|
2023-01-09 11:15:29 -05:00 |
|