  weslambertandGitHub
|
540ee156db
|
Merge pull request #10469 from Security-Onion-Solutions/fix/elastic_fleet_dynamic_configuration
Use Fleet pillar instead of Zeek
|
2023-05-31 12:36:39 -04:00 |
|
|
Wes
|
344e2bf1d0
|
Update defaults file
|
2023-05-31 15:30:03 +00:00 |
|
|
Wes
|
3441c0684e
|
Create elasticfleet pillar dir
|
2023-05-31 15:10:35 +00:00 |
|
|
Wes
|
ed560f19d3
|
Remove where not applicable
|
2023-05-31 14:28:43 +00:00 |
|
|
Wes
|
b3f6012856
|
Change ordering
|
2023-05-31 14:22:47 +00:00 |
|
|
Wes
|
9ae26ec866
|
Add Fleet to top file
|
2023-05-31 14:21:39 +00:00 |
|
|
Wes
|
20aaa79476
|
Add pillar files for Fleet
|
2023-05-31 13:45:19 +00:00 |
|
|
Wes
|
2bb77251b0
|
Move Elastic Fleet logging exclusions to the Fleet pillar
|
2023-05-31 13:38:58 +00:00 |
|
|
weslambertandGitHub
|
36791665f3
|
Merge pull request #10462 from Security-Onion-Solutions/feature/elastic_agent_zeek_logging
Dynamic integration configuration and Zeek log exclusions for Elastic Agent
|
2023-05-30 19:27:13 -04:00 |
|
|
Wes
|
f3be63051b
|
Remove Fleet configuration
|
2023-05-30 20:48:43 +00:00 |
|
|
Wes
|
e4b4bbcfdc
|
Use ZEEKMERGED from zeek/config.map.jinja
|
2023-05-30 19:51:13 +00:00 |
|
|
Wes
|
b6e090f29f
|
Move Elastic Fleet logic in so-common to so-elastic-fleet-common
|
2023-05-30 18:43:56 +00:00 |
|
|
weslambertandGitHub
|
25006ed20b
|
Merge pull request #10455 from Security-Onion-Solutions/fix/curator_cluster_delete_delete
Update so-elasticsearch-cluster-space-used and so-curator-cluster-delete-delete
|
2023-05-30 14:28:22 -04:00 |
|
|
Wes
|
4469a93a75
|
Fix typo
|
2023-05-30 18:24:30 +00:00 |
|
|
Wes
|
096dadf9bd
|
Change 1024 to 1000 for gigabytes
|
2023-05-30 17:29:42 +00:00 |
|
|
Wes
|
b441fe662f
|
Change 1024 to 1000 for gigabytes
|
2023-05-30 17:28:59 +00:00 |
|
|
Wes
|
e5117a343d
|
Change description
|
2023-05-30 17:10:17 +00:00 |
|
|
Wes
|
b9d692eb0e
|
Remove default value
|
2023-05-30 17:08:52 +00:00 |
|
|
Wes
|
36a7f54160
|
Add extension
|
2023-05-30 16:46:38 +00:00 |
|
|
Wes
|
9035fa3037
|
Don't load Elasticsearch integration
|
2023-05-30 15:46:00 +00:00 |
|
|
Wes
|
b4b87e5620
|
Only provide JSON output
|
2023-05-30 15:43:31 +00:00 |
|
|
Wes
|
97c53d70a4
|
Remove integrations
|
2023-05-30 14:05:40 +00:00 |
|
|
Wes
|
53b4f7bd5c
|
Add spacing
|
2023-05-30 14:05:11 +00:00 |
|
|
Wes
|
79014a53ec
|
Remove extra lines
|
2023-05-30 12:35:32 +00:00 |
|
|
Wes
|
e910f04beb
|
Add default description and Zeek log exclusions for Elastic Fleet
|
2023-05-30 03:10:52 +00:00 |
|
|
Wes
|
ef5b63337b
|
Add check for integration existence and integration update functionality
|
2023-05-30 02:58:00 +00:00 |
|
|
Wes
|
799e92e595
|
Add files
|
2023-05-30 02:56:23 +00:00 |
|
|
Wes
|
c835c523a9
|
Elastic Fleet integration update improvements
|
2023-05-30 02:54:39 +00:00 |
|
|
Wes
|
5af1bfe142
|
Move alert generation outside of the inner loop
|
2023-05-27 21:15:45 +00:00 |
|
|
Wes
|
ce114a2601
|
Fix total space logic and rename TOTAL_AVAILABLE_SPACE to TOTAL_USED_SPACE
|
2023-05-26 13:19:45 +00:00 |
|
|
Wes
|
5de59a879a
|
Break out of index deletion when unable to bring space below the disk space threshold
|
2023-05-26 13:15:27 +00:00 |
|
|
Wes
|
53f258b08f
|
Add eligible_indices to index deletion requirements
|
2023-05-24 17:02:11 +00:00 |
|
|
Wes
|
a308a39bbe
|
Use disk space taken up by indices if the script is not running on a manager
|
2023-05-24 16:48:45 +00:00 |
|
|
weslambertandGitHub
|
79182cecfd
|
Merge pull request #10397 from Security-Onion-Solutions/fix/elastic_exclude_zeek_reporter_log
Exclude Zeek's reporter.log from being picked up by Elastic Agent
|
2023-05-22 07:56:54 -04:00 |
|
|
weslambertandGitHub
|
8cf82c4b6a
|
Merge pull request #10398 from Security-Onion-Solutions/fix/elasticsearch_ingest_dns_query
Check if 'dns.query' is null
|
2023-05-22 07:56:44 -04:00 |
|
|
weslambertandGitHub
|
78d4586033
|
Merge pull request #10399 from Security-Onion-Solutions/fix/elastalert_playbook_alerter
Update 'url' to use 'es_hosts'
|
2023-05-22 07:56:31 -04:00 |
|
|
weslambertandGitHub
|
00bd93c026
|
Update 'url' to use 'es_hosts'
|
2023-05-19 17:14:13 -04:00 |
|
|
weslambertandGitHub
|
2c10ad7eec
|
Check if 'dns.query' is null
|
2023-05-19 15:50:33 -04:00 |
|
|
weslambertandGitHub
|
167051af28
|
Exclude Zeek's reporter.log from being picked up by Elastic Agent
|
2023-05-19 15:44:09 -04:00 |
|
|
weslambertandGitHub
|
eb9c5e9af0
|
Merge pull request #10307 from Security-Onion-Solutions/fix/elastic_fleet_ignore_zeek_logs
Don't read from 'known_hosts.log', 'known_services.log', or 'ntp.log'
|
2023-05-19 15:09:15 -04:00 |
|
|
weslambertandGitHub
|
c6a962a46b
|
Merge pull request #10392 from Security-Onion-Solutions/fix/elastalert_index
Change Elastalert writeback index name from 'elastalert_status' to 'elastalert'
|
2023-05-19 13:31:29 -04:00 |
|
|
weslambertandGitHub
|
1ddf45bbbe
|
Change Elastalert writeback index name from 'elastalert_status' to 'elastalert'
|
2023-05-19 12:39:27 -04:00 |
|
|
weslambertandGitHub
|
c192ec9109
|
Merge pull request #10385 from Security-Onion-Solutions/feature/elastalert_eql
Add initial support for EQL queries for Elastalert
|
2023-05-18 15:36:28 -04:00 |
|
|
Wes
|
d3c7ea4805
|
Add EQL option
|
2023-05-18 16:55:26 +00:00 |
|
|
Wes
|
82c3d78672
|
Change Elasticsearch host syntax
|
2023-05-18 16:52:27 +00:00 |
|
|
weslambertandGitHub
|
a13e6257c3
|
Don't read from 'known_hosts.log', 'known_services.log', or 'ntp.log'
|
2023-05-08 14:38:55 -04:00 |
|
|
weslambertandGitHub
|
a1e0041b14
|
Merge pull request #10287 from Security-Onion-Solutions/fix/strelka_ignore_yara_rules_2.4
Ignore "expl_outlook_cve_2023_23397.yar" and "gen_mal_3cx_compromise_mar23.yar" since they are causing problems with YARA compilation
|
2023-05-08 11:58:17 -04:00 |
|
|
weslambertandGitHub
|
7483dbf442
|
Merge pull request #10304 from Security-Onion-Solutions/fix/kibana_pivot_to_pcap_url_2.4
Surround _id field in double quotes to prevent errors associated with values beginning with a hyphen
|
2023-05-08 11:55:35 -04:00 |
|
|
Wes
|
0f30e787b3
|
Surround _id field in double quotes to prevent errors associated with values beginning with a hyphen
|
2023-05-08 15:34:35 +00:00 |
|
|
weslambertandGitHub
|
c7ed29dfa8
|
Ignore "expl_outlook_cve_2023_23397.yar" and "gen_mal_3cx_compromise_mar23.yar" since they are causing problems with YARA compilation
|
2023-05-04 16:16:06 -04:00 |
|
|
weslambertandGitHub
|
32874d2e9d
|
Merge pull request #10175 from Security-Onion-Solutions/fix/setup_docker_image_display_and_log
Display output and write to a log for Docker image operations during setup
|
2023-04-20 17:15:09 -04:00 |
|
|
Wes
|
fca7753f73
|
Display output and write to log for Docker image downloads
|
2023-04-20 20:56:04 +00:00 |
|
|
weslambertandGitHub
|
6c7b4e5492
|
Merge pull request #10166 from Security-Onion-Solutions/fix/elasticsearch_curl_config
Don't distribute curl configuration to nodes that don't need it
|
2023-04-20 08:47:47 -04:00 |
|
|
Wes
|
a341f1b7b7
|
Don't distribute curl configuration to nodes that don't need it
|
2023-04-20 12:31:50 +00:00 |
|
|
weslambertandGitHub
|
01bd3545d0
|
Merge pull request #10162 from Security-Onion-Solutions/fix/elastic_agent_metadata
Rename @metadata to metadata to ensure it's not lost between Logstash pipelines
|
2023-04-19 16:25:01 -04:00 |
|
|
Wes
|
d823d5dcc9
|
Rename @metadata to metadata to ensure it's not lost between Logstash pipelines
|
2023-04-19 20:17:10 +00:00 |
|
|
weslambertandGitHub
|
f3b4ee6a0b
|
Merge pull request #10121 from Security-Onion-Solutions/fix/elasticsearch_deletion_improvements
Simplify deletion logic and add stderr and stdout logging within script
|
2023-04-13 11:10:50 -04:00 |
|
|
Wes
|
d6421ee7cc
|
Simplify deletion logic and add stderr and stdout logging within script
|
2023-04-13 15:04:16 +00:00 |
|
|
weslambertandGitHub
|
2c44c8e468
|
Merge pull request #10108 from Security-Onion-Solutions/fix/elastic_clear
Update Elastic clear utility script
|
2023-04-11 17:24:21 -04:00 |
|
|
Wes
|
06b60ca96b
|
Don't stop Elastic Fleet for now
|
2023-04-11 21:11:12 +00:00 |
|
|
Wes
|
4d64a9777e
|
Update Elastic clear utility script
|
2023-04-11 21:06:20 +00:00 |
|
|
weslambertandGitHub
|
43447e5df5
|
Merge pull request #10106 from Security-Onion-Solutions/fix/kibana_16.04_dashboards_remove
Remove Security Onion 16.04 dashboards
|
2023-04-11 14:41:12 -04:00 |
|
|
Wes
|
c6be0a48a1
|
Remove Security Onion 16.04 dashboards
|
2023-04-11 15:05:41 +00:00 |
|
|
weslambertandGitHub
|
5eb0364a98
|
Merge pull request #10105 from Security-Onion-Solutions/fix/elasticsearch_template_loading_so-searchnode
Only load pipelines and templates if the node role is not 'so-searchnode'
|
2023-04-11 10:45:52 -04:00 |
|
|
Wes
|
8d0074c712
|
Only load pipelines and tempaltes if the node role is not 'so-searchnode'
|
2023-04-11 14:15:21 +00:00 |
|
|
weslambertandGitHub
|
2cfbf30f05
|
Merge pull request #10070 from Security-Onion-Solutions/fix/cloud_test
Fix cloud sniffing interface configuration
|
2023-03-30 14:41:59 -04:00 |
|
|
weslambertandGitHub
|
3e08506c4e
|
Fix syntax for $is_cloud test
|
2023-03-30 13:26:36 -04:00 |
|
|
Wes
|
d4cba6908e
|
Use dynamic interface value instead of explicitly setting it to 'bond0'
|
2023-03-30 16:17:34 +00:00 |
|
|
Wes
|
dfd3456343
|
Add logging for cloud detection and interface settings
|
2023-03-30 16:15:41 +00:00 |
|
|
Wes
|
3cd1598067
|
Only perform bond interface operations if it is not a cloud installation
|
2023-03-30 16:11:50 +00:00 |
|
|
weslambertandGitHub
|
de902ebd02
|
Merge pull request #10024 from Security-Onion-Solutions/esspace
Manage disk-based index deletion via so-curator-cluster-delete
|
2023-03-28 12:25:19 -04:00 |
|
|
Wes
|
6099a04e41
|
Change how the size is determined, in case there a decimal value is provided
|
2023-03-28 16:04:54 +00:00 |
|
|
Wes
|
ed8f944638
|
Fix typo in GLOBALS reference
|
2023-03-28 15:55:33 +00:00 |
|
|
weslambertandGitHub
|
942182e826
|
Remove additional copyright in so-curator-cluster-delete-delete
|
2023-03-28 11:00:14 -04:00 |
|
|
weslambertandGitHub
|
303fec6302
|
Fix verbiage for so-curator-cluster-delete-delete
|
2023-03-28 10:59:39 -04:00 |
|
|
weslambertandGitHub
|
9411f5ca79
|
Fix closed index function and check
|
2023-03-28 10:54:21 -04:00 |
|
|
Wes
|
d494381e9d
|
Update verbiage for so-curator-cluster-delete
|
2023-03-28 14:18:49 +00:00 |
|
|
Wes
|
e1bda5acfd
|
Update verbiage for so-curator-cluster-delete-delete
|
2023-03-28 14:18:27 +00:00 |
|
|
Wes
|
138b312705
|
Fix script name
|
2023-03-28 13:52:59 +00:00 |
|
|
Wes
|
82efce0b31
|
Ensure so-curator-cluster-delete is run to manage so-curator-cluster-delete-delete
|
2023-03-28 13:23:23 +00:00 |
|
|
Wes
|
1ab253b8c3
|
Use explicit path to so-elasticsearch-query
|
2023-03-28 13:18:14 +00:00 |
|
|
Wes
|
a1394b9102
|
Use explicit path to so-elasticsearch-query
|
2023-03-28 13:18:00 +00:00 |
|
|
Wes
|
b3b030958c
|
Use explicit path to so-elasticsearch-query
|
2023-03-28 13:17:23 +00:00 |
|
|
Wes
|
adbc9df222
|
Changes for LOG_SIZE_LIMIT
|
2023-03-28 12:54:32 +00:00 |
|
|
Wes
|
f854d92cab
|
Remove the cluster space configuration script reference from the Elasticsearch state
|
2023-03-28 12:27:45 +00:00 |
|
|
Wes
|
22e8e3be28
|
Remove the cluster space configuration script
|
2023-03-28 12:27:12 +00:00 |
|
|
Wes
|
4352825ceb
|
Calculate log size limit every time so-curator-cluster-delete-delete runs
|
2023-03-28 12:25:49 +00:00 |
|
|
Wes
|
e2290d8a8e
|
Remove unncessary Salt logic for Elasticsearch
|
2023-03-28 12:19:36 +00:00 |
|
|
Wes
|
c68235c169
|
Fix Curator script name
|
2023-03-28 02:27:27 +00:00 |
|
|
Wes
|
a38aa903ac
|
Configure cluster space settings
|
2023-03-28 01:36:52 +00:00 |
|
|
Wes
|
fc0b9fa47c
|
Remove Curator closed index deletion scripts
|
2023-03-28 00:57:45 +00:00 |
|
|
Wes
|
32e92d10ad
|
Add new cluster space management scripts
|
2023-03-28 00:55:56 +00:00 |
|
|
Wes
|
7030f35561
|
Update Curator state
|
2023-03-28 00:54:36 +00:00 |
|
|
Wes
|
934b8894e2
|
Update Curator scripts
|
2023-03-28 00:54:04 +00:00 |
|
|
weslambertandGitHub
|
0f66645a89
|
Merge pull request #9990 from Security-Onion-Solutions/fix/elasticsearch_node_attrs_remove
Remove node attrs configuration since node roles will be used
|
2023-03-23 13:48:00 -04:00 |
|
|
weslambertandGitHub
|
0a9a064648
|
Remove node attrs configuration since node roles will be used
|
2023-03-23 13:45:51 -04:00 |
|
|
weslambertandGitHub
|
d6bc20a2b8
|
Merge pull request #9986 from Security-Onion-Solutions/fix/elastic_agent_template_changes
Elastic Agent template changes
|
2023-03-23 13:07:22 -04:00 |
|
|
Wes
|
84360aa9bf
|
Set replicas for Osquery manager indices to 0
|
2023-03-22 21:47:49 +00:00 |
|
|
Wes
|
3fba27a0d4
|
Ensure component template files are in the correct directory
|
2023-03-22 20:45:33 +00:00 |
|
|
Wes
|
28f5dcd43b
|
Add managed generic Elastic Agent log component templates
|
2023-03-22 19:57:46 +00:00 |
|