  weslambertandGitHub
|
03082339ca
|
Merge pull request #10592 from Security-Onion-Solutions/fix/analyzer_dependencies
Update analyzer dependencies
|
2023-06-14 12:22:06 -04:00 |
|
|
weslambertandGitHub
|
3f1741e75a
|
Merge pull request #10585 from Security-Onion-Solutions/fix/elasticsearch_templates
Update Elasticsearch templates for Fleet
|
2023-06-14 09:33:23 -04:00 |
|
|
Wes
|
48331ce35b
|
Add system.system component templates
|
2023-06-14 13:29:11 +00:00 |
|
|
Wes
|
c2ac60b82e
|
Add system.system template and add event-mappings
|
2023-06-14 13:28:00 +00:00 |
|
|
Wes
|
c205438771
|
Update dependencies
|
2023-06-14 02:35:29 +00:00 |
|
|
Wes
|
8cde05807c
|
Remove elastic-agent dir
|
2023-06-13 21:33:04 +00:00 |
|
|
Wes
|
2ac0aba916
|
Add osquery files
|
2023-06-13 21:32:02 +00:00 |
|
|
Wes
|
af003cc2a1
|
Add osquery templates
|
2023-06-13 20:43:39 +00:00 |
|
|
Wes
|
bd7644a557
|
Add another template
|
2023-06-13 19:13:20 +00:00 |
|
|
Wes
|
5547a1b7ab
|
Add event mappings
|
2023-06-13 18:23:50 +00:00 |
|
|
Wes
|
1b90fd8581
|
Add custom component templates
|
2023-06-13 18:21:45 +00:00 |
|
|
Wes
|
e43b7607bb
|
Add more component templates
|
2023-06-13 17:04:03 +00:00 |
|
|
Wes
|
a265c06e31
|
Add other component templates
|
2023-06-13 15:47:25 +00:00 |
|
|
Wes
|
2aa954cb0a
|
Add component templates
|
2023-06-13 15:25:23 +00:00 |
|
|
Wes
|
73812b11a3
|
Allow ingest node pipelines that start with a period
|
2023-06-13 13:37:56 +00:00 |
|
|
Wes
|
38ab426470
|
Add final Fleet pipeline
|
2023-06-13 13:36:26 +00:00 |
|
|
Wes
|
d0a6881c2c
|
Add event mappings and remove meta information for now
|
2023-06-13 13:35:46 +00:00 |
|
|
Wes
|
57268ba934
|
Change priority of templates
|
2023-06-12 14:29:45 +00:00 |
|
|
Wes
|
1208915896
|
Remove Elastic Agent package templates
|
2023-06-12 14:24:59 +00:00 |
|
|
Wes
|
42f5ad9939
|
Add templates for system.auth and systen.syslog
|
2023-06-12 14:23:24 +00:00 |
|
|
weslambertandGitHub
|
32f3ee0b01
|
Merge pull request #10564 from Security-Onion-Solutions/fix/elasticsearch_templates
Update templates for integrations
|
2023-06-12 09:05:31 -04:00 |
|
|
Wes
|
ad5a424c03
|
Update templates for integrations
|
2023-06-09 18:32:50 +00:00 |
|
|
weslambertandGitHub
|
d1c86cb9ff
|
Merge pull request #10550 from Security-Onion-Solutions/kilo
Elastalert and EQL
|
2023-06-08 11:21:18 -04:00 |
|
|
weslambertandGitHub
|
8ccb24dda2
|
Update version to 2.4.3
|
2023-06-08 11:05:05 -04:00 |
|
|
weslambertandGitHub
|
932054e9da
|
Update version to 2.4.0
|
2023-06-08 11:04:45 -04:00 |
|
|
weslambertandGitHub
|
f68527d366
|
Merge pull request #10541 from Security-Onion-Solutions/fix/curator_action_ignore_empty_list
Use ignore_empty_list
|
2023-06-07 10:36:38 -04:00 |
|
|
Wes
|
81e3d26540
|
Ignore empty list
|
2023-06-07 13:14:52 +00:00 |
|
|
weslambertandGitHub
|
96b60fa39a
|
Restore original URL syntax, but use data stream
|
2023-06-06 20:53:05 -04:00 |
|
|
weslambertandGitHub
|
f172a74fbc
|
Remove EQL setting
|
2023-06-06 20:51:29 -04:00 |
|
|
weslambertandGitHub
|
c4be56ec7b
|
Update host syntax
|
2023-06-06 20:51:03 -04:00 |
|
|
weslambertandGitHub
|
96195806ab
|
Update version to 2.4.0-kilo
|
2023-06-06 20:50:10 -04:00 |
|
|
weslambertandGitHub
|
88bbd3440d
|
Merge pull request #10522 from Security-Onion-Solutions/fix/playbook_index
Change Playbook index to a data stream and update mapping for event.severity_label
|
2023-06-06 09:03:49 -04:00 |
|
|
Wes
|
495a9c0783
|
Add mapping for event.severity_label
|
2023-06-05 21:19:37 +00:00 |
|
|
Wes
|
905bc564fc
|
Change data stream name
|
2023-06-05 21:18:47 +00:00 |
|
|
Wes
|
f6f387428f
|
Update Playbook alerter to write to a data stream
|
2023-06-05 21:17:10 +00:00 |
|
|
weslambertandGitHub
|
236eb0cbcc
|
Merge pull request #10515 from Security-Onion-Solutions/fix/analyzers
Update requests and whoisit
|
2023-06-05 12:12:59 -04:00 |
|
|
Wes
|
841d0b4b1f
|
Update dependencies after git add
|
2023-06-05 15:42:55 +00:00 |
|
|
Wes
|
272f97e2d7
|
Update dependencies
|
2023-06-05 15:42:38 +00:00 |
|
|
Wes
|
eac9a3fc86
|
Update requests and whoisit
|
2023-06-05 15:41:01 +00:00 |
|
|
weslambertandGitHub
|
3a5a59af59
|
Merge pull request #10485 from Security-Onion-Solutions/fix/elastic_fleet_dedicated
Add so-fleet role logic
|
2023-05-31 16:04:40 -04:00 |
|
|
Wes
|
302e580d8f
|
Add so-fleet role logic
|
2023-05-31 19:56:17 +00:00 |
|
|
weslambertandGitHub
|
540ee156db
|
Merge pull request #10469 from Security-Onion-Solutions/fix/elastic_fleet_dynamic_configuration
Use Fleet pillar instead of Zeek
|
2023-05-31 12:36:39 -04:00 |
|
|
Wes
|
344e2bf1d0
|
Update defaults file
|
2023-05-31 15:30:03 +00:00 |
|
|
Wes
|
3441c0684e
|
Create elasticfleet pillar dir
|
2023-05-31 15:10:35 +00:00 |
|
|
Wes
|
ed560f19d3
|
Remove where not applicable
|
2023-05-31 14:28:43 +00:00 |
|
|
Wes
|
b3f6012856
|
Change ordering
|
2023-05-31 14:22:47 +00:00 |
|
|
Wes
|
9ae26ec866
|
Add Fleet to top file
|
2023-05-31 14:21:39 +00:00 |
|
|
Wes
|
20aaa79476
|
Add pillar files for Fleet
|
2023-05-31 13:45:19 +00:00 |
|
|
Wes
|
2bb77251b0
|
Move Elastic Fleet logging exclusions to the Fleet pillar
|
2023-05-31 13:38:58 +00:00 |
|
|
weslambertandGitHub
|
36791665f3
|
Merge pull request #10462 from Security-Onion-Solutions/feature/elastic_agent_zeek_logging
Dynamic integration configuration and Zeek log exclusions for Elastic Agent
|
2023-05-30 19:27:13 -04:00 |
|
|
Wes
|
f3be63051b
|
Remove Fleet configuration
|
2023-05-30 20:48:43 +00:00 |
|
|
Wes
|
e4b4bbcfdc
|
Use ZEEKMERGED from zeek/config.map.jinja
|
2023-05-30 19:51:13 +00:00 |
|
|
Wes
|
b6e090f29f
|
Move Elastic Fleet logic in so-common to so-elastic-fleet-common
|
2023-05-30 18:43:56 +00:00 |
|
|
weslambertandGitHub
|
25006ed20b
|
Merge pull request #10455 from Security-Onion-Solutions/fix/curator_cluster_delete_delete
Update so-elasticsearch-cluster-space-used and so-curator-cluster-delete-delete
|
2023-05-30 14:28:22 -04:00 |
|
|
Wes
|
4469a93a75
|
Fix typo
|
2023-05-30 18:24:30 +00:00 |
|
|
Wes
|
096dadf9bd
|
Change 1024 to 1000 for gigabytes
|
2023-05-30 17:29:42 +00:00 |
|
|
Wes
|
b441fe662f
|
Change 1024 to 1000 for gigabytes
|
2023-05-30 17:28:59 +00:00 |
|
|
Wes
|
e5117a343d
|
Change description
|
2023-05-30 17:10:17 +00:00 |
|
|
Wes
|
b9d692eb0e
|
Remove default value
|
2023-05-30 17:08:52 +00:00 |
|
|
Wes
|
36a7f54160
|
Add extension
|
2023-05-30 16:46:38 +00:00 |
|
|
Wes
|
9035fa3037
|
Don't load Elasticsearch integration
|
2023-05-30 15:46:00 +00:00 |
|
|
Wes
|
b4b87e5620
|
Only provide JSON output
|
2023-05-30 15:43:31 +00:00 |
|
|
Wes
|
97c53d70a4
|
Remove integrations
|
2023-05-30 14:05:40 +00:00 |
|
|
Wes
|
53b4f7bd5c
|
Add spacing
|
2023-05-30 14:05:11 +00:00 |
|
|
Wes
|
79014a53ec
|
Remove extra lines
|
2023-05-30 12:35:32 +00:00 |
|
|
Wes
|
e910f04beb
|
Add default description and Zeek log exclusions for Elastic Fleet
|
2023-05-30 03:10:52 +00:00 |
|
|
Wes
|
ef5b63337b
|
Add check for integration existence and integration update functionality
|
2023-05-30 02:58:00 +00:00 |
|
|
Wes
|
799e92e595
|
Add files
|
2023-05-30 02:56:23 +00:00 |
|
|
Wes
|
c835c523a9
|
Elastic Fleet integration update improvements
|
2023-05-30 02:54:39 +00:00 |
|
|
Wes
|
5af1bfe142
|
Move alert generation outside of the inner loop
|
2023-05-27 21:15:45 +00:00 |
|
|
Wes
|
ce114a2601
|
Fix total space logic and rename TOTAL_AVAILABLE_SPACE to TOTAL_USED_SPACE
|
2023-05-26 13:19:45 +00:00 |
|
|
Wes
|
5de59a879a
|
Break out of index deletion when unable to bring space below the disk space threshold
|
2023-05-26 13:15:27 +00:00 |
|
|
Wes
|
53f258b08f
|
Add eligible_indices to index deletion requirements
|
2023-05-24 17:02:11 +00:00 |
|
|
Wes
|
a308a39bbe
|
Use disk space taken up by indices if the script is not running on a manager
|
2023-05-24 16:48:45 +00:00 |
|
|
weslambertandGitHub
|
79182cecfd
|
Merge pull request #10397 from Security-Onion-Solutions/fix/elastic_exclude_zeek_reporter_log
Exclude Zeek's reporter.log from being picked up by Elastic Agent
|
2023-05-22 07:56:54 -04:00 |
|
|
weslambertandGitHub
|
8cf82c4b6a
|
Merge pull request #10398 from Security-Onion-Solutions/fix/elasticsearch_ingest_dns_query
Check if 'dns.query' is null
|
2023-05-22 07:56:44 -04:00 |
|
|
weslambertandGitHub
|
78d4586033
|
Merge pull request #10399 from Security-Onion-Solutions/fix/elastalert_playbook_alerter
Update 'url' to use 'es_hosts'
|
2023-05-22 07:56:31 -04:00 |
|
|
weslambertandGitHub
|
00bd93c026
|
Update 'url' to use 'es_hosts'
|
2023-05-19 17:14:13 -04:00 |
|
|
weslambertandGitHub
|
2c10ad7eec
|
Check if 'dns.query' is null
|
2023-05-19 15:50:33 -04:00 |
|
|
weslambertandGitHub
|
167051af28
|
Exclude Zeek's reporter.log from being picked up by Elastic Agent
|
2023-05-19 15:44:09 -04:00 |
|
|
weslambertandGitHub
|
eb9c5e9af0
|
Merge pull request #10307 from Security-Onion-Solutions/fix/elastic_fleet_ignore_zeek_logs
Don't read from 'known_hosts.log', 'known_services.log', or 'ntp.log'
|
2023-05-19 15:09:15 -04:00 |
|
|
weslambertandGitHub
|
c6a962a46b
|
Merge pull request #10392 from Security-Onion-Solutions/fix/elastalert_index
Change Elastalert writeback index name from 'elastalert_status' to 'elastalert'
|
2023-05-19 13:31:29 -04:00 |
|
|
weslambertandGitHub
|
1ddf45bbbe
|
Change Elastalert writeback index name from 'elastalert_status' to 'elastalert'
|
2023-05-19 12:39:27 -04:00 |
|
|
weslambertandGitHub
|
c192ec9109
|
Merge pull request #10385 from Security-Onion-Solutions/feature/elastalert_eql
Add initial support for EQL queries for Elastalert
|
2023-05-18 15:36:28 -04:00 |
|
|
Wes
|
d3c7ea4805
|
Add EQL option
|
2023-05-18 16:55:26 +00:00 |
|
|
Wes
|
82c3d78672
|
Change Elasticsearch host syntax
|
2023-05-18 16:52:27 +00:00 |
|
|
weslambertandGitHub
|
a13e6257c3
|
Don't read from 'known_hosts.log', 'known_services.log', or 'ntp.log'
|
2023-05-08 14:38:55 -04:00 |
|
|
weslambertandGitHub
|
a1e0041b14
|
Merge pull request #10287 from Security-Onion-Solutions/fix/strelka_ignore_yara_rules_2.4
Ignore "expl_outlook_cve_2023_23397.yar" and "gen_mal_3cx_compromise_mar23.yar" since they are causing problems with YARA compilation
|
2023-05-08 11:58:17 -04:00 |
|
|
weslambertandGitHub
|
7483dbf442
|
Merge pull request #10304 from Security-Onion-Solutions/fix/kibana_pivot_to_pcap_url_2.4
Surround _id field in double quotes to prevent errors associated with values beginning with a hyphen
|
2023-05-08 11:55:35 -04:00 |
|
|
Wes
|
0f30e787b3
|
Surround _id field in double quotes to prevent errors associated with values beginning with a hyphen
|
2023-05-08 15:34:35 +00:00 |
|
|
weslambertandGitHub
|
c7ed29dfa8
|
Ignore "expl_outlook_cve_2023_23397.yar" and "gen_mal_3cx_compromise_mar23.yar" since they are causing problems with YARA compilation
|
2023-05-04 16:16:06 -04:00 |
|
|
weslambertandGitHub
|
32874d2e9d
|
Merge pull request #10175 from Security-Onion-Solutions/fix/setup_docker_image_display_and_log
Display output and write to a log for Docker image operations during setup
|
2023-04-20 17:15:09 -04:00 |
|
|
Wes
|
fca7753f73
|
Display output and write to log for Docker image downloads
|
2023-04-20 20:56:04 +00:00 |
|
|
weslambertandGitHub
|
6c7b4e5492
|
Merge pull request #10166 from Security-Onion-Solutions/fix/elasticsearch_curl_config
Don't distribute curl configuration to nodes that don't need it
|
2023-04-20 08:47:47 -04:00 |
|
|
Wes
|
a341f1b7b7
|
Don't distribute curl configuration to nodes that don't need it
|
2023-04-20 12:31:50 +00:00 |
|
|
weslambertandGitHub
|
01bd3545d0
|
Merge pull request #10162 from Security-Onion-Solutions/fix/elastic_agent_metadata
Rename @metadata to metadata to ensure it's not lost between Logstash pipelines
|
2023-04-19 16:25:01 -04:00 |
|
|
Wes
|
d823d5dcc9
|
Rename @metadata to metadata to ensure it's not lost between Logstash pipelines
|
2023-04-19 20:17:10 +00:00 |
|
|
weslambertandGitHub
|
f3b4ee6a0b
|
Merge pull request #10121 from Security-Onion-Solutions/fix/elasticsearch_deletion_improvements
Simplify deletion logic and add stderr and stdout logging within script
|
2023-04-13 11:10:50 -04:00 |
|
|
Wes
|
d6421ee7cc
|
Simplify deletion logic and add stderr and stdout logging within script
|
2023-04-13 15:04:16 +00:00 |
|
|
weslambertandGitHub
|
2c44c8e468
|
Merge pull request #10108 from Security-Onion-Solutions/fix/elastic_clear
Update Elastic clear utility script
|
2023-04-11 17:24:21 -04:00 |
|