  weslambertandGitHub
|
bee5a1e9e8
|
Merge pull request #9711 from Security-Onion-Solutions/fix/so_import_pcap_suricata_metadata_disable_zeek
Only run Zeek if it is defined as the metadata engine
|
2023-02-02 13:27:35 -05:00 |
|
|
Wes
|
bc082dff99
|
Only run Zeek if it is defined as 'mdengine'
|
2023-02-02 16:22:42 +00:00 |
|
|
weslambertandGitHub
|
395cbf330a
|
Merge pull request #9706 from Security-Onion-Solutions/fix/suricata_metadata
Add Suricata metadata configuration
|
2023-02-02 09:54:49 -05:00 |
|
|
Wes
|
5fba3c5872
|
Add Suricata metadata configuration
|
2023-02-02 14:48:01 +00:00 |
|
|
weslambertandGitHub
|
eb7b6e78b9
|
Merge pull request #9702 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_disable
Disable loading of Kibana and Logstash integration policies
|
2023-02-01 16:02:56 -05:00 |
|
|
weslambertandGitHub
|
d242050627
|
Disable loading of Kibana and Logstash logs for now since there are issues with the packages from the registry
|
2023-02-01 15:59:35 -05:00 |
|
|
weslambertandGitHub
|
3dfa7959b3
|
Merge pull request #9698 from Security-Onion-Solutions/fix/strelka_yara_exclusion_2_4
Add 'configured_vulns_ext_vars.yar' to exclusion list
|
2023-02-01 14:38:38 -05:00 |
|
|
weslambertandGitHub
|
2101ca60e9
|
Add 'configured_vulns_ext_vars.yar' to exclusion list
|
2023-02-01 14:25:46 -05:00 |
|
|
weslambertandGitHub
|
056bcd0121
|
Merge pull request #9683 from Security-Onion-Solutions/fix/kibana_osquery_live_query_link_remove
Remove OSQuery live query link
|
2023-01-31 13:38:07 -05:00 |
|
|
weslambertandGitHub
|
98bea0322e
|
Merge pull request #9688 from Security-Onion-Solutions/fix/elastic_agent_elasticsearch_output_typo_fix
Fix Elastic Agent Elasticsearch output typo
|
2023-01-31 12:57:38 -05:00 |
|
|
weslambertandGitHub
|
74eed31eec
|
Change Elasticsearch output name from 'so-manager_elasticsearch2' to 'so-manager_elasticsearch'
|
2023-01-31 12:55:03 -05:00 |
|
|
weslambertandGitHub
|
cbf2bd1373
|
Remove OSQuery live query link
|
2023-01-31 10:59:17 -05:00 |
|
|
weslambertandGitHub
|
bde828cd4f
|
Merge pull request #9676 from Security-Onion-Solutions/fix/so-import-evtx_updates
Updates to so-import-evtx
|
2023-01-31 08:17:02 -05:00 |
|
|
weslambertandGitHub
|
0436f885b8
|
Set values for '@timestamp' and 'event.ingested'
|
2023-01-31 08:04:49 -05:00 |
|
|
Wes
|
5472f53c9f
|
Remove bind mount and reference the correctly named entrypoint script
|
2023-01-30 21:24:30 +00:00 |
|
|
Wes
|
0156784687
|
Add EVTX integration policy for 'so-import-evtx'
|
2023-01-30 21:22:37 +00:00 |
|
|
Wes
|
cc100e50cd
|
Update so-import-evtx to convert EVTX to a JSON file instead of streaming to Elasticsearch
|
2023-01-30 21:09:58 +00:00 |
|
|
weslambertandGitHub
|
b1eb16d3a2
|
Merge pull request #9670 from Security-Onion-Solutions/fix/elastic_agent_integration_policies_zeek_exclude_files
Remove 'prospector.scanner' prefix from 'exclude_files' configuration
|
2023-01-27 16:53:02 -05:00 |
|
|
weslambertandGitHub
|
8240e5b20d
|
Remove 'prospector.scanner' prefix from 'exclude_files' configuration
|
2023-01-27 16:46:43 -05:00 |
|
|
weslambertandGitHub
|
68fac4488e
|
Fix syntax for Zeek integration policies
|
2023-01-27 15:27:15 -05:00 |
|
|
weslambertandGitHub
|
fa9e62a816
|
Merge pull request #9665 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_import_suricata_event.category
Change event.category from 'file' to 'network' in Import Suricata integration policy
|
2023-01-27 12:03:34 -05:00 |
|
|
weslambertandGitHub
|
e47f64bd04
|
Change event.category from 'file' to 'network'
|
2023-01-27 12:00:30 -05:00 |
|
|
weslambertandGitHub
|
6d2f379ba5
|
Merge pull request #9664 from Security-Onion-Solutions/fix/elastic_agent_integration_policies_zeek_exclude_files
Update Zeek file exclusions and add a minor output formatting change
|
2023-01-27 11:58:19 -05:00 |
|
|
weslambertandGitHub
|
f49627cec1
|
Update Zeek file exclusions and add a minor output formatting change
|
2023-01-27 11:47:14 -05:00 |
|
|
weslambertandGitHub
|
5ab3d1e8f1
|
Merge pull request #9663 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_zeek_import_ics_tag
Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field
|
2023-01-27 11:34:28 -05:00 |
|
|
weslambertandGitHub
|
6b251a2596
|
Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field
|
2023-01-27 11:30:06 -05:00 |
|
|
weslambertandGitHub
|
5468aa82b0
|
Merge pull request #9662 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_event.dataset_rename
Change event.dataset value for zeek.files and zeek.tunnels ingest pipelines
|
2023-01-27 11:19:45 -05:00 |
|
|
weslambertandGitHub
|
2772b03dca
|
Change event.dataset value from 'tunnels' to 'tunnel'
|
2023-01-27 11:03:49 -05:00 |
|
|
weslambertandGitHub
|
716ec7f936
|
Change event.dataset value from 'files' to 'file'
|
2023-01-27 11:02:44 -05:00 |
|
|
weslambertandGitHub
|
27b1f1bd07
|
Merge pull request #9654 from Security-Onion-Solutions/fix/logstash_cleanup
FIX: Logstash Pipeline Cleanup
|
2023-01-26 13:19:50 -05:00 |
|
|
Wes
|
e4271043c6
|
Remove unnecessary Logstash pipelines
|
2023-01-26 18:05:14 +00:00 |
|
|
Wes
|
b3123f7895
|
Remove unnecessary Logstash pipelines from the pillar
|
2023-01-26 17:57:07 +00:00 |
|
|
weslambertandGitHub
|
a8d2631d75
|
Merge pull request #9650 from Security-Onion-Solutions/fix/elastic_agent_add_import_mode
Elastic Agent - Import Mode
|
2023-01-26 11:33:20 -05:00 |
|
|
Wes
|
b381c5424e
|
Remove extra whitespace after 'so-elastic-agent-builder' line in 'so-image-common'
|
2023-01-26 16:13:23 +00:00 |
|
|
Wes
|
f1db1bc273
|
Ensure Kratos events are sent to a data stream instead of an index
|
2023-01-26 16:12:06 +00:00 |
|
|
Wes
|
7d68ef0e8b
|
Add Elastic Agent and Fleet to firewall configuration for Import Mode
|
2023-01-26 16:07:31 +00:00 |
|
|
Wes
|
43ffcb1d63
|
Allow setup to set up Elastic Fleet for Import Mode
|
2023-01-26 16:05:16 +00:00 |
|
|
Wes
|
8051fc70eb
|
Temporarily disable the loading of the RITA package policy
|
2023-01-26 16:03:59 +00:00 |
|
|
Wes
|
a9a119f1ab
|
Add Elasticsearch output to 'so-elastic-fleet-setup' for Import Mode
|
2023-01-26 16:02:27 +00:00 |
|
|
Wes
|
6a803dfe35
|
Add Elastic Fleet to top file configuration for Import Mode
|
2023-01-26 16:01:03 +00:00 |
|
|
Wes
|
1fb6cf7bfe
|
Add Elastic Fleet to allowed states for Import Mode
|
2023-01-26 15:59:49 +00:00 |
|
|
weslambertandGitHub
|
211b87e7ae
|
Merge pull request #9644 from Security-Onion-Solutions/revert-9640-fix/elastic_agent_import_mode
Revert "Elastic Agent and Fleet - Import Mode"
|
2023-01-25 17:23:27 -05:00 |
|
|
weslambertandGitHub
|
6ee66a34bc
|
Revert "Elastic Agent and Fleet - Import Mode"
|
2023-01-25 17:12:03 -05:00 |
|
|
weslambertandGitHub
|
6785e0ec9e
|
Merge pull request #9640 from Security-Onion-Solutions/fix/elastic_agent_import_mode
Elastic Agent and Fleet - Import Mode
|
2023-01-25 17:01:33 -05:00 |
|
|
weslambertandGitHub
|
c73cd78f08
|
Merge pull request #9643 from Security-Onion-Solutions/2.4/dev
Merge Dev
|
2023-01-25 16:59:47 -05:00 |
|
|
Wes
|
5c58cda872
|
Move certificate configuration outside of conditional logic
|
2023-01-25 19:29:50 +00:00 |
|
|
Wes
|
c3717dae67
|
Add Elastic Fleet firewall configuration for Import Mode
|
2023-01-25 18:27:00 +00:00 |
|
|
Wes
|
86a925e1c7
|
Download Elastic Agent images for Import Mode
|
2023-01-25 16:09:12 +00:00 |
|
|
Wes
|
838beabae5
|
Add missing single quote for Elastic Agent Elasticsearch output
|
2023-01-25 15:58:06 +00:00 |
|
|
Wes
|
c46b5e734b
|
Add 'elastic-fleet' to the list of allowed states for Import Mode
|
2023-01-25 14:38:23 +00:00 |
|
|
Wes
|
1414b75e01
|
Allow 'elastic-fleet' state to be applied for Import Mode
|
2023-01-25 14:07:25 +00:00 |
|
|
Wes
|
506baa854d
|
Configure Elasticsearch output if running Import Mode
|
2023-01-25 13:52:54 +00:00 |
|
|
weslambertandGitHub
|
4868bd8f5e
|
Merge pull request #9638 from Security-Onion-Solutions/fix/elastic_agent_integration_kratos_data_stream_rename
Rename Kratos Data Stream
|
2023-01-25 08:45:37 -05:00 |
|
|
weslambertandGitHub
|
c9f458e1e2
|
Set event.dataset for all Kratos logs to 'access' for now
|
2023-01-25 08:19:50 -05:00 |
|
|
weslambertandGitHub
|
7bf9d77962
|
Rename Kratos data stream
|
2023-01-25 08:18:21 -05:00 |
|
|
weslambertandGitHub
|
3f9764d22d
|
Merge pull request #9633 from Security-Onion-Solutions/fix/elastic_agent_more_improvements
More Elastic Agent Integration Improvements
|
2023-01-24 15:16:52 -05:00 |
|
|
Wes
|
4b9c92c53d
|
Set RITA event.dataset value explicitly
|
2023-01-24 18:00:34 +00:00 |
|
|
Wes
|
38ead7cb82
|
Remove import tag for now
|
2023-01-24 17:58:19 +00:00 |
|
|
Wes
|
44d149b1c3
|
Allow imported data to use a tag of 'import'
|
2023-01-24 17:01:52 +00:00 |
|
|
Wes
|
1e5377c78a
|
Condense RITA integration policies, add ICS tags, and improve output readability
|
2023-01-24 16:56:20 +00:00 |
|
|
weslambertandGitHub
|
7e0e5071d9
|
Merge pull request #9627 from Security-Onion-Solutions/fix/elastic_agent_integration_improvements
Elastic Agent Integration Improvements
|
2023-01-24 10:10:01 -05:00 |
|
|
Wes
|
7b4d8a47f0
|
Add copyright header to 'so-elastic-fleet-*' scripts
|
2023-01-24 15:07:00 +00:00 |
|
|
Wes
|
f19cf75311
|
Change how event.dataset is determined for Suricata events
|
2023-01-24 14:45:00 +00:00 |
|
|
Wes
|
51692ac66c
|
Update index pattern in various template definitions to match new data stream naming convention
|
2023-01-23 21:52:44 +00:00 |
|
|
Wes
|
40c6b380df
|
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
|
2023-01-23 21:44:46 +00:00 |
|
|
Wes
|
d342f3c4b8
|
Add 'so-elastic-fleet-integration-policy-bulk-delete' to perform bulk deletion of integration policies
|
2023-01-23 21:38:13 +00:00 |
|
|
weslambertandGitHub
|
9c83b775ee
|
Merge pull request #9604 from Security-Onion-Solutions/feature/sensoroni_scripts
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 16:59:29 -05:00 |
|
|
Wes
|
739c174898
|
Add scripts for starting, stopping, and restarting Sensoroni
|
2023-01-19 21:50:10 +00:00 |
|
|
weslambertandGitHub
|
8c4e00cfbd
|
Merge pull request #9600 from Security-Onion-Solutions/fix/elasticsearch_template_logs_default_remove
Remove default "logs-*" template settings for now
|
2023-01-19 10:30:44 -05:00 |
|
|
weslambertandGitHub
|
7d3f6121eb
|
Remove default "logs-*" template settings for now
|
2023-01-19 10:29:10 -05:00 |
|
|
weslambertandGitHub
|
90f3e33cc6
|
Merge pull request #9597 from Security-Onion-Solutions/fix/elasticsearch_template_logs_default_priority_modification
Modify default 'logs-*' Elasticsearch template priority
|
2023-01-18 17:30:52 -05:00 |
|
|
weslambertandGitHub
|
7a499c9051
|
Modify default 'logs-*' template priority
|
2023-01-18 17:24:07 -05:00 |
|
|
weslambertandGitHub
|
1bf088e976
|
Merge pull request #9591 from Security-Onion-Solutions/fix/kibana_basepath_rewrite_disable
Disable Kibana's native base path rewrite and add publicBaseUrl
|
2023-01-17 16:59:06 -05:00 |
|
|
weslambertandGitHub
|
1fed3cf474
|
Disable Kibana's native base path rewrite and add publicBaseUrl
|
2023-01-17 16:54:31 -05:00 |
|
|
weslambertandGitHub
|
1723f58c04
|
Merge pull request #9579 from Security-Onion-Solutions/fix/elasticsearch_templates_so-ids
Remove so-ids since the data stream is now 'logs-suricata-*'
|
2023-01-13 16:17:38 -05:00 |
|
|
weslambertandGitHub
|
ca80548bf0
|
Remove so-ids since the data stream is now 'logs-suricata-*'
|
2023-01-13 16:15:58 -05:00 |
|
|
weslambertandGitHub
|
3e5127810d
|
Merge pull request #9577 from Security-Onion-Solutions/fix/elasticsearch_elastic_agent_templates
Make sure Elastic Agent data streams do not use replicas
|
2023-01-13 16:12:09 -05:00 |
|
|
weslambertandGitHub
|
73a4dae28e
|
Make sure Elastic Agent data streams do not use replicas
|
2023-01-13 16:10:44 -05:00 |
|
|
weslambertandGitHub
|
7cba5626b7
|
Merge pull request #9570 from Security-Onion-Solutions/fix/elasticsearch_templates_elastic_agent
Change priority for Elastic Agent Elasticsearch index templates
|
2023-01-12 16:48:12 -05:00 |
|
|
weslambertandGitHub
|
654d869e3e
|
Change priority from 500 to 200 for Elastic Agent index templates to avoid collisions with other templates
|
2023-01-12 16:46:08 -05:00 |
|
|
weslambertandGitHub
|
be6b42494c
|
Merge pull request #9569 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_kratos
Kratos Index Changes
|
2023-01-12 15:33:51 -05:00 |
|
|
weslambertandGitHub
|
fb8d8ea972
|
Update Elasticsearch index template for Kratos
|
2023-01-12 15:31:41 -05:00 |
|
|
weslambertandGitHub
|
9416552338
|
Don't set the Kratos index explicitly
|
2023-01-12 15:25:35 -05:00 |
|
|
weslambertandGitHub
|
66f9a06458
|
Merge pull request #9566 from Security-Onion-Solutions/fix/elastic_fleet_integration_policy_load
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 16:17:40 -05:00 |
|
|
Wes
|
0e437f84e7
|
Add back echo statement to print the import policy being loaded
|
2023-01-11 21:13:30 +00:00 |
|
|
Wes
|
ea01e68846
|
Fix Zeek import policies and remove unnecessary dash in RITAENABLED statement
|
2023-01-11 21:01:31 +00:00 |
|
|
weslambertandGitHub
|
acad7acc4a
|
Merge pull request #9562 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_load_suricata_import
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:27:37 -05:00 |
|
|
weslambertandGitHub
|
4391c22335
|
Move Suricata import policy definition so that it does not get caught in the for loop for Zeek policies
|
2023-01-11 12:23:50 -05:00 |
|
|
weslambertandGitHub
|
39d1f07fab
|
Merge pull request #9561 from Security-Onion-Solutions/fix/filebeat_remove_module_setup
Remove pipeline.load from top.sls so that Filebeat module loading is not attempted
|
2023-01-11 12:21:39 -05:00 |
|
|
weslambertandGitHub
|
b3e0183e39
|
Remove pipeline.load from top.sls so that Filebeat module loading is not attempted
|
2023-01-11 12:19:06 -05:00 |
|
|
weslambertandGitHub
|
355953427c
|
Merge pull request #9553 from Security-Onion-Solutions/feature/filebeat_to_elastic_agent_conversion
Initial Conversion of Filebeat Inputs to Elastic Agent Inputs
|
2023-01-11 09:22:40 -05:00 |
|
|
Wes
|
52b620b137
|
Add additional conditional logic for Filebeat and disable Filebeat
|
2023-01-11 14:10:11 +00:00 |
|
|
Wes
|
33e2affb1d
|
Remove newlines from end of Syslog processor definitions
|
2023-01-11 14:08:28 +00:00 |
|
|
Wes
|
c3b83f1fc8
|
Update template settings to use data streams
|
2023-01-11 14:03:11 +00:00 |
|
|
Wes
|
5062dd2873
|
Suricata Elasticsearch ingest node pipeline changes - set 'alert' dataset
|
2023-01-11 14:02:09 +00:00 |
|
|
Wes
|
2e886d0c55
|
Remove data_index_name processor since we are using data streams
|
2023-01-11 13:58:38 +00:00 |
|
|
Wes
|
5d86edeed4
|
Modify Logstash Elastic Agent output to accomodate for events with and without 'metadata.pipeline'
|
2023-01-11 13:57:32 +00:00 |
|
|
Wes
|
caf0ea6b53
|
Add Elastic Agent policy view script
|
2023-01-11 13:56:21 +00:00 |
|
|
Wes
|
a146f1134e
|
Add Elastic Agent utility scripts
|
2023-01-11 13:54:42 +00:00 |
|
|
weslambertandGitHub
|
2c3bd6e3fd
|
Merge pull request #9502 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_rita_beacon_2_4
Update RITA beacon parsing
|
2023-01-03 11:14:04 -05:00 |
|