2867 Commits

Author	SHA1	Message	Date
weslambert	5ada85942b	Lowercase network.transport	2020-10-08 07:59:57 -04:00
Doug Burks	2489ca608a	Improve Hunt FTP queries #1479	2020-10-08 05:30:17 -04:00
m0duspwnens	be7167d99b	Merge remote-tracking branch 'remotes/origin/dev' into issue/1403	2020-10-07 17:45:22 -04:00
m0duspwnens	821ce19aad	new dashboard for sensors	2020-10-07 17:38:16 -04:00
m0duspwnens	1bdc45ef0e	new dashboard for sensors	2020-10-07 17:37:11 -04:00
m0duspwnens	4f8bb9c2f1	updates to standalone and eval dashboards	2020-10-07 16:48:29 -04:00
m0duspwnens	7dd839cfa2	add zeek capture loss graph and resize redis queue for standalone	2020-10-07 15:53:31 -04:00
Wes Lambert	7543144afe	Don't use regex for determining rule type	2020-10-07 16:15:43 +00:00
weslambert	8e829b47ae	Remove dataset name since pipeline no longer in use	2020-10-07 11:48:56 -04:00
m0duspwnens	8540a691dc	only send loss if timestamp on data has changed	2020-10-07 11:23:06 -04:00
Wes Lambert	015a441e79	Change rule.signature_info to rule.reference and ensure common.nids exists	2020-10-07 15:20:26 +00:00
m0duspwnens	1106b2bf96	only send loss if timestamp on data has changed	2020-10-07 11:15:10 -04:00
Wes Lambert	f0a1457ffd	Update common.nids	2020-10-07 15:14:08 +00:00
m0duspwnens	d09f0f841e	only send loss if timestamp on data has changed	2020-10-07 11:13:03 -04:00
m0duspwnens	6f2d47cc40	only send loss if timestamp on data has changed	2020-10-07 11:11:06 -04:00
m0duspwnens	2317e8b348	only send loss if timestamp on data has changed	2020-10-07 11:08:41 -04:00
m0duspwnens	f96d6ae4f4	only send loss if timestamp on data has changed	2020-10-07 11:06:54 -04:00
m0duspwnens	5e534571ff	set timestamp with capture loss	2020-10-07 10:20:51 -04:00
m0duspwnens	14dd80b410	handle whitespace	2020-10-06 18:46:32 -04:00
m0duspwnens	af2df2c7d1	just print the loss	2020-10-06 18:44:22 -04:00
m0duspwnens	f95712c502	update log file	2020-10-06 18:38:51 -04:00
m0duspwnens	48ca2cdff1	fix pillars we check	2020-10-06 18:10:41 -04:00
m0duspwnens	73ce948d42	add zeekcaptureloss to data to influxdb. rename broloss to zeekloss - https://github.com/Security-Onion-Solutions/securityonion/issues/1403	2020-10-06 18:05:41 -04:00
Wes Lambert	8c07c098f6	Pipeline cleanup	2020-10-06 20:14:15 +00:00
Wes Lambert	350cc41740	Let zeek.common handle common fields for zeek.tunnels	2020-10-06 20:12:23 +00:00
m0duspwnens	035d215398	fix yum db if corrupted - https://github.com/Security-Onion-Solutions/securityonion/issues/163	2020-10-06 14:28:01 -04:00
m0duspwnens	3d71766b64	Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into issue/1460	2020-10-06 13:58:02 -04:00
m0duspwnens	34dfc809c7	handle thread count for suricata and default max-pending-packets to 5000 - https://github.com/Security-Onion-Solutions/securityonion/issues/1460	2020-10-06 13:57:50 -04:00
Wes Lambert	a6a69c57d1	Rename so-elasticsearch-templates to so-elasticsearch-templates-load	2020-10-06 17:18:42 +00:00
Wes Lambert	787f1d8732	Add so-elasticsearch-templates-list	2020-10-06 17:15:27 +00:00
Wes Lambert	4a5d50cf80	Add so-elasticsearch-pipelines-list and fix common script perms	2020-10-06 17:01:58 +00:00
m0duspwnens	5eada1cdd5	handle install locations of files copied	2020-10-06 11:39:34 -04:00
m0duspwnens	a5f4c96db0	qol user interaction improvements to analyst install	2020-10-06 11:19:43 -04:00
m0duspwnens	4eea0a464c	include remaining log functions from so-functions	2020-10-06 10:57:43 -04:00
m0duspwnens	7840002d18	update log file in title func	2020-10-06 10:51:31 -04:00
m0duspwnens	85168e9318	add title function	2020-10-06 10:49:38 -04:00
m0duspwnens	2420cd5db1	add some system characteristics to log like normal install does	2020-10-06 10:46:11 -04:00
Doug Burks	a686704d37	remove rule.uuid now that underlying issue has been resolved	2020-10-06 09:39:57 -04:00
Wes Lambert	019bec992d	Add Strelka YARA matches as alerts	2020-10-06 12:19:44 +00:00
m0duspwnens	acabcd27a7	change for network miner 2.6 - https://github.com/Security-Onion-Solutions/securityonion/issues/1290	2020-10-05 18:17:24 -04:00
Josh Patterson	24ff34ee81	Merge pull request #1457 from Security-Onion-Solutions/issue/1371 ... Issue/1371	2020-10-05 15:51:35 -04:00
Josh Brower	2e012432b4	Merge pull request #1455 from Security-Onion-Solutions/feature/training-req ... Write out nested json	2020-10-05 15:34:43 -04:00
Josh Brower	de9ace62d4	Write out nested json	2020-10-05 15:34:02 -04:00
m0duspwnens	748dc5ba91	logstash changes per https://github.com/Security-Onion-Solutions/securityonion/issues/1444	2020-10-05 14:10:05 -04:00
Josh Patterson	f7daa391c7	Merge pull request #1453 from Security-Onion-Solutions/issue/1441 ... enable suricata threshold-file and point to proper file	2020-10-05 12:56:39 -04:00
Doug Burks	a45aa43f41	Add trailing comma to "thehive" stanza	2020-10-05 12:35:33 -04:00
m0duspwnens	63884b73e1	enable suricata threshold-file and point to proper file - https://github.com/Security-Onion-Solutions/securityonion/issues/1441	2020-10-05 12:10:52 -04:00
Wes Lambert	575da0f9d3	Change alert to case	2020-10-05 15:45:10 +00:00
weslambert	bc31e19e37	Put back rule.category for Wazuh alerts	2020-10-05 11:34:29 -04:00
weslambert	968dce0aee	Adjust Wazuh logging so we don't log alerts to a separate file and so we don't write a separate log file for non-JSON for archives	2020-10-05 10:03:40 -04:00