102 Commits

Author	SHA1	Message	Date
bryant-treacle	82dff3e9da	Fix issues: 8591-8953	2022-08-30 13:48:53 +00:00
Wes Lambert	fe1b72655b	Additional .keyword shims for process mappings	2022-03-24 16:45:06 +00:00
weslambert	406267a892	Add process.name.keyword	2022-03-08 12:42:34 -05:00
Wes Lambert	ffae22beef	Add DTC syslog mappings for .keyword and add refs to defaults.yml	2022-03-04 13:04:11 +00:00
Wes Lambert	1f71816ad7	Add keyword subfield for DTC winlog mappings	2022-03-03 14:54:30 +00:00
Wes Lambert	1c086e36da	Add missing comma for file mappings	2022-03-03 13:49:54 +00:00
Wes Lambert	85979cbce8	Add file, process, and winlog mapping changes	2022-03-03 13:37:27 +00:00
Wes Lambert	8f97f09c9c	Additional .keyword changes for host.hostname client.address, and event.action	2022-03-02 21:54:46 +00:00
Wes Lambert	3ee46e4c29	Add .keyword for destination/source geo.country_name	2022-03-02 21:50:03 +00:00
Wes Lambert	ab9b81ea39	Change match_only_text to text for mac in host mappings	2022-03-02 15:01:05 +00:00
Wes Lambert	ed620b93b7	Add custom analyzer definition to all SO/DTC mappings	2022-03-02 14:43:19 +00:00
Wes Lambert	27c8eaa630	Update all other mappings for .security where applicable	2022-03-02 14:39:23 +00:00
Wes Lambert	e925d435ff	Update event, file, and host mappings to include .security	2022-03-02 14:33:52 +00:00
Wes Lambert	496b161253	Update ECS mappings to include .security	2022-03-02 14:27:36 +00:00
Wes Lambert	aae2fd1fbb	Update DNS mappings to include .security	2022-03-02 14:27:15 +00:00
Wes Lambert	0b45cf7ae1	Update base mappings to include .security	2022-03-02 14:25:57 +00:00
Wes Lambert	d89af5f04f	Update agent mappings to include .security	2022-03-02 14:25:14 +00:00
Wes Lambert	2d2ec45029	Modify base ECS mappings to include .security where possible, as well as custom analyzer definition	2022-03-02 14:19:36 +00:00
Wes Lambert	5489b8559d	Revert "Switch from .security to match_only_text" ... This reverts commit f7862af934.	2022-03-01 18:44:00 +00:00
Wes Lambert	2a9caccc7c	Revert "Add additional .text subfield mappings" ... This reverts commit 61dadc6249.	2022-03-01 18:43:24 +00:00
weslambert	e942d81433	Ensure correct formatting for source override	2022-02-25 19:14:58 -05:00
weslambert	a511fd33e9	Ensure correct formatting for destination override	2022-02-25 19:14:21 -05:00
Wes Lambert	a8bdff89ae	Move files into SO component template directory	2022-02-25 18:00:16 +00:00
Wes Lambert	61dadc6249	Add additional .text subfield mappings	2022-02-25 16:27:37 +00:00
Wes Lambert	0f8a39002f	Add .text subfield mappings for DTC where fields are defined	2022-02-24 19:39:52 +00:00
Wes Lambert	f7862af934	Switch from .security to match_only_text	2022-02-22 20:33:49 +00:00
Wes Lambert	4d1533537b	Remove old index templates	2022-02-18 20:08:13 +00:00
Wes Lambert	9b841fd872	Add 'event.created' and 'event.ingested' keyword mapping	2022-02-08 21:34:32 +00:00
Wes Lambert	c2c4e4df17	Add Snyk component template	2022-02-08 15:23:43 +00:00
Wes Lambert	f9a50d33c3	Add new templates	2022-02-08 13:17:23 +00:00
Wes Lambert	2951e12c96	Remove snyk component template for now and fix folder structure	2022-02-08 13:16:59 +00:00
Wes Lambert	6d0ca6fcbb	Fix mangled key name/typo	2022-02-08 12:59:07 +00:00
Wes Lambert	5090854d4d	Add additional component templates and index template references	2022-02-08 03:03:55 +00:00
Wes Lambert	1366e5288e	Add mappings references for new component templates to index templates	2022-02-07 19:54:23 +00:00
Wes Lambert	03bfb052ed	Add component templates for Elasticsearch, Kibana, Logstash, Netflow, Suricata, and Zeek	2022-02-07 19:42:24 +00:00
Wes Lambert	317f6471d8	Add additional scan and rule filset mappings	2022-02-04 19:05:09 +00:00
Wes Lambert	1ce8bb3523	Fix winlog mapping reference reversion	2022-02-04 18:14:01 +00:00
Wes Lambert	5e03b1a5de	Fix reference for file mappings in template	2022-02-04 18:11:03 +00:00
weslambert	898db542bf	Merge pull request #7117 from Security-Onion-Solutions/feature/winlog_dtc_mappings ... Add winlog mappings	2022-02-04 12:16:16 -05:00
Wes Lambert	69cb83cac9	Add winlog mappings	2022-02-04 17:08:26 +00:00
Wes Lambert	f3902cf77d	Fix EG template and mappings	2022-02-04 16:00:16 +00:00
Wes Lambert	a3031b2b5c	Additional DTC mapping changes	2022-02-04 15:38:51 +00:00
Wes Lambert	1ce386bb7f	Add more DTC transition mappings	2022-02-03 17:33:05 +00:00
Wes Lambert	9db1510b0e	Initial composable template configuration and base mappings	2022-02-02 02:08:31 +00:00
weslambert	fc0a5bce86	Revert field limit from testing	2022-01-27 11:18:35 -05:00
weslambert	60a0204975	Revert changes to common template	2022-01-27 11:02:47 -05:00
weslambert	1b3e7f9d79	Temp changes while adjusting mapping	2022-01-26 14:57:16 -05:00
weslambert	e77648c475	Merge pull request #6994 from Security-Onion-Solutions/feature/dtc ... Additional DTC changes	2022-01-26 12:22:48 -05:00
Wes Lambert	e10749a495	Additional changes to template to accomodate default fields and keyword subfield	2022-01-26 17:16:29 +00:00
Jason Ertel	ed9b74dc33	store related event data as a flattened object blob	2022-01-26 12:16:05 -05:00