  weslambertandGitHub
|
c95f48e49a
|
Merge pull request #7330 from Security-Onion-Solutions/fix/pb-override
Override destination/source mappings with .keyword for Playbook
|
2022-02-25 13:07:31 -05:00 |
|
|
Wes Lambert
|
a8bdff89ae
|
Move files into SO component template directory
|
2022-02-25 18:00:16 +00:00 |
|
|
Wes Lambert
|
08097fe9ec
|
Add Playbook override mappings
|
2022-02-25 17:58:51 +00:00 |
|
|
weslambertandGitHub
|
a6ab09501e
|
Merge pull request #7326 from Security-Onion-Solutions/fix/additional_text_subfield_mappings
Add additional .text subfield mappings
|
2022-02-25 11:29:26 -05:00 |
|
|
Wes Lambert
|
61dadc6249
|
Add additional .text subfield mappings
|
2022-02-25 16:27:37 +00:00 |
|
|
weslambertandGitHub
|
22b01dab1e
|
Merge pull request #7317 from Security-Onion-Solutions/fix/add_text_subfield_to_dtc_mappings
Add .text subfield mappings for DTC where fields are defined
|
2022-02-24 14:47:11 -05:00 |
|
|
Wes Lambert
|
0f8a39002f
|
Add .text subfield mappings for DTC where fields are defined
|
2022-02-24 19:39:52 +00:00 |
|
|
weslambertandGitHub
|
5e29c71381
|
Merge pull request #7315 from Security-Onion-Solutions/fix/split_zeek_dns
Split Zeek DNS records into a separate index
|
2022-02-24 13:21:52 -05:00 |
|
|
weslambertandGitHub
|
23fb62c0d6
|
Split Zeek DNS records into a separate index
|
2022-02-24 12:52:25 -05:00 |
|
|
weslambertandGitHub
|
313487a887
|
Merge pull request #7313 from Security-Onion-Solutions/fix/kibana_dashboard_load
Add Kibana dashboard updates for 2.3.110
|
2022-02-24 09:48:28 -05:00 |
|
|
weslambertandGitHub
|
bc1794e437
|
Fix function name
|
2022-02-24 09:42:14 -05:00 |
|
|
weslambertandGitHub
|
45ccfc5ad4
|
Add back post to .100 and call for .110
|
2022-02-24 09:35:43 -05:00 |
|
|
weslambertandGitHub
|
582bf4c64c
|
Remove dashboard updates for .100 so we don't run twice
|
2022-02-24 09:25:59 -05:00 |
|
|
weslambertandGitHub
|
7f08ecdcbe
|
Add function reference for .110 post changes
|
2022-02-24 09:25:15 -05:00 |
|
|
weslambertandGitHub
|
a22e470038
|
Add Kibana dashboard updates for 2.3.110
|
2022-02-24 09:20:44 -05:00 |
|
|
weslambertandGitHub
|
bc2c1b4ccc
|
Merge pull request #6935 from abesinger/issue/6912
Updated syslog pipeline, resolves #6912.
|
2022-02-24 08:33:55 -05:00 |
|
|
weslambertandGitHub
|
2aa811dcd2
|
Merge pull request #7300 from Security-Onion-Solutions/fix/new_es_template_config
Add IDH and Kratos index templates
|
2022-02-23 12:24:38 -05:00 |
|
|
weslambertandGitHub
|
6a0ecb9e9c
|
Add IDH and Kratos index templates
|
2022-02-23 12:13:46 -05:00 |
|
|
weslambertandGitHub
|
00dbf54a5f
|
Merge pull request #7295 from Security-Onion-Solutions/TOoSmOotH-patch-5
Update so-functions
|
2022-02-23 10:50:32 -05:00 |
|
|
weslambertandGitHub
|
9f7612b599
|
Merge pull request #7283 from Security-Onion-Solutions/fix/match_only_text
Switch from .security to using match_only_text with .text
|
2022-02-22 15:41:29 -05:00 |
|
|
Wes Lambert
|
f7862af934
|
Switch from .security to match_only_text
|
2022-02-22 20:33:49 +00:00 |
|
|
weslambertandGitHub
|
3124f2bd12
|
Merge pull request #7255 from Security-Onion-Solutions/fix/remove_old_templates
Remove old index templates
|
2022-02-18 15:23:07 -05:00 |
|
|
Wes Lambert
|
4d1533537b
|
Remove old index templates
|
2022-02-18 20:08:13 +00:00 |
|
|
weslambertandGitHub
|
87a5e64f12
|
Merge pull request #7249 from Security-Onion-Solutions/fix/component_index_association
Update component -> index association for file/scan mappings for Strelka
|
2022-02-18 12:19:41 -05:00 |
|
|
weslambertandGitHub
|
6ee3287d2d
|
Update component -> index association for file/scan mappings for Strelka
|
2022-02-18 08:12:34 -05:00 |
|
|
weslambertandGitHub
|
6842099e11
|
Merge pull request #7224 from Security-Onion-Solutions/fix/zeek_viz
Switch from dns.answers to dns.answers.name for DTC
|
2022-02-17 10:05:46 -05:00 |
|
|
Wes Lambert
|
5c1f61bda8
|
Switch from dns.answers to dns.answers.name for DTC
|
2022-02-17 15:03:46 +00:00 |
|
|
weslambertandGitHub
|
53c7ad6041
|
Merge pull request #7223 from Security-Onion-Solutions/fix/shard_settings_setup
Ensure setup configures pillar correctly for index settings
|
2022-02-17 09:48:11 -05:00 |
|
|
weslambertandGitHub
|
c0f9cb188b
|
Add missing colon
|
2022-02-17 07:58:05 -05:00 |
|
|
weslambertandGitHub
|
d309c4fc0a
|
Update pillar structure for index_settings/shards
|
2022-02-17 07:10:29 -05:00 |
|
|
weslambertandGitHub
|
d084625ee0
|
Merge pull request #7218 from Security-Onion-Solutions/fix/composable_templates_soup
Add pillar update for ES index templates for 2.3.110
|
2022-02-16 16:24:57 -05:00 |
|
|
weslambertandGitHub
|
e71b606dd6
|
Add pillar update for ES index templates for 2.3.110
|
2022-02-16 16:22:06 -05:00 |
|
|
weslambertandGitHub
|
f1f9322bee
|
Merge pull request #7216 from Security-Onion-Solutions/fix/es_template_netflow_mappings_indent
Fix indent for so-netflow component template references
|
2022-02-16 14:47:31 -05:00 |
|
|
weslambertandGitHub
|
185ea2fd99
|
Fix indent for so-netflow component template references
|
2022-02-16 14:46:12 -05:00 |
|
|
weslambertandGitHub
|
9e222b1464
|
Merge pull request #7206 from Security-Onion-Solutions/feature/template-reorg
Re-organize Elasticsearch Index Templates
|
2022-02-15 16:50:14 -05:00 |
|
|
Wes Lambert
|
4fa3749418
|
Remove bind or ES templates
|
2022-02-15 18:08:03 +00:00 |
|
|
Wes Lambert
|
786a189f65
|
Merge branch 'feature/template-reorg' of https://github.com/security-onion-solutions/securityonion into feature/template-reorg
|
2022-02-15 17:06:02 +00:00 |
|
|
Wes Lambert
|
de731fc05d
|
Remove default templates from ES template pillar since they are now managed in the defaults file.
|
2022-02-15 17:04:57 +00:00 |
|
|
Wes Lambert
|
3df58eadd1
|
Modify logic to include custom templates
|
2022-02-15 17:00:24 +00:00 |
|
|
weslambertandGitHub
|
1a53ec4372
|
Fix malformed copy/paste
|
2022-02-15 11:14:10 -05:00 |
|
|
Wes Lambert
|
dce3b7a874
|
Update defaults file to include ES index templates
|
2022-02-15 15:53:07 +00:00 |
|
|
Wes Lambert
|
8e389bf6e5
|
Add ES template map file
|
2022-02-14 15:38:32 +00:00 |
|
|
Wes Lambert
|
ebce67060f
|
Initial template refactor
|
2022-02-14 15:20:33 +00:00 |
|
|
weslambertandGitHub
|
380fa7d0c8
|
Merge pull request #7153 from Security-Onion-Solutions/fix/dtc_event_mappings
Add 'event.created' and 'event.ingested' keyword mapping
|
2022-02-08 16:36:49 -05:00 |
|
|
Wes Lambert
|
9b841fd872
|
Add 'event.created' and 'event.ingested' keyword mapping
|
2022-02-08 21:34:32 +00:00 |
|
|
weslambertandGitHub
|
c216457a3e
|
Merge pull request #7147 from Security-Onion-Solutions/fix/ct_snyk
Add Snyk component template
|
2022-02-08 10:25:27 -05:00 |
|
|
Wes Lambert
|
c2c4e4df17
|
Add Snyk component template
|
2022-02-08 15:23:43 +00:00 |
|
|
weslambertandGitHub
|
7be1549d41
|
Merge pull request #7146 from Security-Onion-Solutions/feature/additional_dtc_ct
Additional component templates
|
2022-02-08 10:12:31 -05:00 |
|
|
Wes Lambert
|
f9a50d33c3
|
Add new templates
|
2022-02-08 13:17:23 +00:00 |
|
|
Wes Lambert
|
2951e12c96
|
Remove snyk component template for now and fix folder structure
|
2022-02-08 13:16:59 +00:00 |
|
|
Wes Lambert
|
6d0ca6fcbb
|
Fix mangled key name/typo
|
2022-02-08 12:59:07 +00:00 |
|
|
Wes Lambert
|
2dd5db15b6
|
Add component and index template listing scripts
|
2022-02-08 03:40:42 +00:00 |
|
|
Wes Lambert
|
5090854d4d
|
Add additional component templates and index template references
|
2022-02-08 03:03:55 +00:00 |
|
|
weslambertandGitHub
|
b41c5439c6
|
Merge pull request #7141 from Security-Onion-Solutions/fix/index_template_mapping_reference
Add mapping references for new component templates to index templates
|
2022-02-07 15:06:19 -05:00 |
|
|
Wes Lambert
|
1366e5288e
|
Add mappings references for new component templates to index templates
|
2022-02-07 19:54:23 +00:00 |
|
|
weslambertandGitHub
|
f9196a8228
|
Merge pull request #7140 from Security-Onion-Solutions/feature/dtc_new_mappings
New DTC/Component Template Mappings
|
2022-02-07 14:47:07 -05:00 |
|
|
Wes Lambert
|
03bfb052ed
|
Add component templates for Elasticsearch, Kibana, Logstash, Netflow, Suricata, and Zeek
|
2022-02-07 19:42:24 +00:00 |
|
|
weslambertandGitHub
|
c9b40d8569
|
Merge pull request #7136 from Security-Onion-Solutions/feature/so_es_indices_list_sort
Sort index listing alphabetically and add header
|
2022-02-07 09:34:58 -05:00 |
|
|
Wes Lambert
|
50215c550b
|
Sort index listing alphabetically and add header (@gebhard73)
|
2022-02-07 14:31:42 +00:00 |
|
|
weslambertandGitHub
|
d0b54a3a34
|
Merge pull request #7119 from Security-Onion-Solutions/feature/dtc_additional
Add additional scan and rule fileset mappings
|
2022-02-04 14:14:20 -05:00 |
|
|
Wes Lambert
|
317f6471d8
|
Add additional scan and rule filset mappings
|
2022-02-04 19:05:09 +00:00 |
|
|
weslambertandGitHub
|
08c7181f1a
|
Merge pull request #7118 from Security-Onion-Solutions/fix/dtc_file_mappings
Fix/dtc file mappings
|
2022-02-04 13:22:11 -05:00 |
|
|
Wes Lambert
|
1ce8bb3523
|
Fix winlog mapping reference reversion
|
2022-02-04 18:14:01 +00:00 |
|
|
Wes Lambert
|
5e03b1a5de
|
Fix reference for file mappings in template
|
2022-02-04 18:11:03 +00:00 |
|
|
weslambertandGitHub
|
898db542bf
|
Merge pull request #7117 from Security-Onion-Solutions/feature/winlog_dtc_mappings
Add winlog mappings
|
2022-02-04 12:16:16 -05:00 |
|
|
weslambertandGitHub
|
66452b14ef
|
Merge pull request #7116 from Security-Onion-Solutions/fix/endgame_mappings
Fix EG template and mappings
|
2022-02-04 12:16:07 -05:00 |
|
|
Wes Lambert
|
69cb83cac9
|
Add winlog mappings
|
2022-02-04 17:08:26 +00:00 |
|
|
Wes Lambert
|
f3902cf77d
|
Fix EG template and mappings
|
2022-02-04 16:00:16 +00:00 |
|
|
weslambertandGitHub
|
1af63edc6b
|
Merge pull request #7115 from Security-Onion-Solutions/feature/additional_dtc_mappings
Additional DTC mapping changes
|
2022-02-04 10:46:47 -05:00 |
|
|
Wes Lambert
|
a3031b2b5c
|
Additional DTC mapping changes
|
2022-02-04 15:38:51 +00:00 |
|
|
weslambertandGitHub
|
1edc1dd842
|
Merge pull request #7096 from Security-Onion-Solutions/fix/dtc-ct-keyword-subfield
Add more DTC transition mappings
|
2022-02-03 12:35:34 -05:00 |
|
|
Wes Lambert
|
1ce386bb7f
|
Add more DTC transition mappings
|
2022-02-03 17:33:05 +00:00 |
|
|
weslambertandGitHub
|
c7d23df000
|
Merge pull request #7076 from Security-Onion-Solutions/fix/zeek_dns_answers_name
Rename dns.answers to prevent field conflict
|
2022-02-03 12:22:26 -05:00 |
|
|
weslambertandGitHub
|
c5b5c5858e
|
Rename to prevent field conflict
|
2022-02-02 14:31:46 -05:00 |
|
|
weslambertandGitHub
|
5e9e0d971b
|
Merge pull request #7070 from Security-Onion-Solutions/feature/composable_templates
Initial composable template configuration and base mappings
|
2022-02-02 10:25:15 -05:00 |
|
|
Wes Lambert
|
9db1510b0e
|
Initial composable template configuration and base mappings
|
2022-02-02 02:08:31 +00:00 |
|
|
weslambertandGitHub
|
6a2111c2ae
|
Merge pull request #7037 from Security-Onion-Solutions/fix/revert_zeek_dns_answers
Revert back to dns.answers for now
|
2022-01-31 09:55:22 -05:00 |
|
|
weslambertandGitHub
|
367b59188b
|
Revert back to dns.answers for now
|
2022-01-31 09:54:39 -05:00 |
|
|
weslambertandGitHub
|
4ecf4ab253
|
Merge pull request #7020 from Security-Onion-Solutions/feature/dash_updates
EG and HL Dashboard Updates
|
2022-01-28 13:19:02 -05:00 |
|
|
weslambertandGitHub
|
5142e6ccc7
|
Update so-kibana-config-load
|
2022-01-28 13:01:33 -05:00 |
|
|
Wes Lambert
|
3b76c2421c
|
Update to allow for passing HL saved objects
|
2022-01-28 17:59:34 +00:00 |
|
|
weslambertandGitHub
|
69689b470b
|
Merge pull request #7005 from Security-Onion-Solutions/fix/revert_cases_field_limit
Revert field limit from testing
|
2022-01-27 11:33:31 -05:00 |
|
|
weslambertandGitHub
|
fc0a5bce86
|
Revert field limit from testing
|
2022-01-27 11:18:35 -05:00 |
|
|
weslambertandGitHub
|
39257df396
|
Merge pull request #7004 from Security-Onion-Solutions/fix/revert_dtc
Revert changes to common template
|
2022-01-27 11:15:50 -05:00 |
|
|
weslambertandGitHub
|
60a0204975
|
Revert changes to common template
|
2022-01-27 11:02:47 -05:00 |
|
|
weslambertandGitHub
|
e303fb12cf
|
Merge pull request #7000 from Security-Onion-Solutions/fix/zeek_dns_answers_pipeline
Fix Zeek field name so it doesn't conflict with mapping of other dns.…
|
2022-01-26 15:04:12 -05:00 |
|
|
weslambertandGitHub
|
8f0a327cb5
|
Fix Zeek field name so it doesn't conflict with mapping of other dns.answers fields
|
2022-01-26 15:02:59 -05:00 |
|
|
weslambertandGitHub
|
bdc5e89822
|
Merge pull request #6999 from Security-Onion-Solutions/fix/case_mapping_changes_temp
Mapping changes for case index
|
2022-01-26 14:59:45 -05:00 |
|
|
weslambertandGitHub
|
1b3e7f9d79
|
Temp changes while adjusting mapping
|
2022-01-26 14:57:16 -05:00 |
|
|
weslambertandGitHub
|
e77648c475
|
Merge pull request #6994 from Security-Onion-Solutions/feature/dtc
Additional DTC changes
|
2022-01-26 12:22:48 -05:00 |
|
|
Wes Lambert
|
e10749a495
|
Additional changes to template to accomodate default fields and keyword subfield
|
2022-01-26 17:16:29 +00:00 |
|
|
weslambertandGitHub
|
ba52bd3835
|
Update template with syntax fixes
|
2022-01-25 08:56:03 -05:00 |
|
|
weslambertandGitHub
|
f7a4cc20f2
|
Update so-common-template.json.jinja
|
2022-01-21 12:36:38 -05:00 |
|
|
weslambertandGitHub
|
1b860e11e7
|
Merge pull request #6936 from Security-Onion-Solutions/fix/field_conflicts
Remove dynamic keyword template to prevent field conflicts with mappi…
|
2022-01-20 12:48:15 -05:00 |
|
|
weslambertandGitHub
|
d1efa71c57
|
Remove dynamic keyword template to prevent field conflicts with mappings defined in common template
|
2022-01-20 12:34:32 -05:00 |
|
|
weslambertandGitHub
|
d0c8dd0626
|
Merge pull request #6931 from Security-Onion-Solutions/fix/cases_dynamic_disable
Disable dynamic mapping and increase order to reduce potential field …
|
2022-01-20 09:48:01 -05:00 |
|
|
weslambertandGitHub
|
e137ad60c5
|
Disable dynamic mapping and increase order to reduce potential field conflicts
|
2022-01-20 09:44:41 -05:00 |
|
|
weslambertandGitHub
|
c512351dd6
|
Add mapping for scan.exiftool and scan.pe.sections.entropy
|
2022-01-14 17:01:13 -05:00 |
|
|
weslambertandGitHub
|
a90bc9dba9
|
Add mapping for scan.pe.sections.entropy
|
2022-01-14 16:58:53 -05:00 |
|
|
weslambertandGitHub
|
17509a9231
|
Merge pull request #6822 from Security-Onion-Solutions/fix/event_fields
Add event.acknowledged and event.escalated mappings
|
2022-01-10 16:14:45 -05:00 |
|