  weslambertandGitHub
|
defe832121
|
Merge pull request #1427 from Security-Onion-Solutions/fix/wazuh_filebeat
Fix Filebeat config for Wazuh
|
2020-09-30 10:59:01 -04:00 |
|
|
Wes Lambert
|
d8f70397f7
|
Fix Filebeat config for Wazuh
|
2020-09-30 14:57:56 +00:00 |
|
|
weslambertandGitHub
|
dac2ad5dbf
|
Merge pull request #1425 from Security-Onion-Solutions/feature/soctopus_pillar
Add initial implementation of SOCtopus pillar
|
2020-09-30 10:25:26 -04:00 |
|
|
Wes Lambert
|
c62acf5e4e
|
Add initial implmentation of SOCtopus pillar
|
2020-09-30 14:24:15 +00:00 |
|
|
weslambertandGitHub
|
401764437f
|
Merge pull request #1421 from Security-Onion-Solutions/fix/ip_type
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 14:21:25 -04:00 |
|
|
Wes Lambert
|
36019727b3
|
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 18:20:15 +00:00 |
|
|
weslambertandGitHub
|
3d6c956e02
|
Merge pull request #1409 from Security-Onion-Solutions/feature/wazuh_wel
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 15:07:15 -04:00 |
|
|
Wes Lambert
|
869767d9d9
|
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 19:04:21 +00:00 |
|
|
weslambertandGitHub
|
6bfef773f2
|
Merge pull request #1392 from Security-Onion-Solutions/bugfix/config_dev_nullify
dev nullify so-config-backup cron job
|
2020-09-24 21:00:18 -04:00 |
|
|
weslambertandGitHub
|
b3f9ee3b34
|
dev nullify so-config-backup cron job
|
2020-09-24 20:59:42 -04:00 |
|
|
weslambertandGitHub
|
a09002edae
|
Merge pull request #1384 from Security-Onion-Solutions/bugfix/config_backup
Add back missing # sign
|
2020-09-23 21:34:52 -04:00 |
|
|
weslambertandGitHub
|
5b93c40ce4
|
Add back missing # sign
|
2020-09-23 21:34:10 -04:00 |
|
|
weslambertandGitHub
|
4f228c1b7c
|
Merge pull request #1379 from Security-Onion-Solutions/feature/config_backup
Feature/config backup
|
2020-09-23 09:58:05 -04:00 |
|
|
Wes Lambert
|
71734ddc0a
|
Add cron job to common state for daily config backup
|
2020-09-23 13:55:32 +00:00 |
|
|
Wes Lambert
|
57732b360e
|
Add config backup script
|
2020-09-23 13:47:14 +00:00 |
|
|
Wes Lambert
|
4d42d04cc3
|
Fix backup pillar definition
|
2020-09-23 13:45:42 +00:00 |
|
|
Wes Lambert
|
d02c440934
|
Add backup params to global.sls
|
2020-09-22 21:05:57 +00:00 |
|
|
weslambertandGitHub
|
74e4adda11
|
Merge pull request #1357 from Security-Onion-Solutions/feature/dashboard_updates_2
Add All Logs for Connections dashboard
|
2020-09-16 11:56:38 -04:00 |
|
|
Wes Lambert
|
44ef935d65
|
Add All Logs for Connections dashboard
|
2020-09-16 15:55:28 +00:00 |
|
|
weslambertandGitHub
|
6325b30a21
|
Merge pull request #1356 from Security-Onion-Solutions/feature/dashboard_updates
Kibana dashboard updates
|
2020-09-16 11:19:27 -04:00 |
|
|
Wes Lambert
|
bd8d2fc271
|
Kibana dashboard updates
|
2020-09-16 15:17:26 +00:00 |
|
|
weslambertandGitHub
|
6806bd2461
|
Merge pull request #1348 from Security-Onion-Solutions/bugfix/es_template_load
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:15:56 -04:00 |
|
|
weslambertandGitHub
|
fbf037f460
|
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:14:06 -04:00 |
|
|
weslambertandGitHub
|
b6b52671e2
|
Merge pull request #1294 from Security-Onion-Solutions/fix/wazuh_agent_name
Fix typo
|
2020-09-05 08:17:09 -04:00 |
|
|
Wes Lambert
|
f9884606df
|
Fix typo
|
2020-09-05 12:15:55 +00:00 |
|
|
weslambertandGitHub
|
b10dd40376
|
Merge pull request #1287 from Security-Onion-Solutions/fix/suri_home_net
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:51 -04:00 |
|
|
weslambertandGitHub
|
8db8dcb71a
|
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:14 -04:00 |
|
|
weslambertandGitHub
|
870e042c4c
|
Merge pull request #1285 from Security-Onion-Solutions/fix/so_stop_start_restart
Require at least one arg for start/stop/restart scripts
|
2020-09-02 14:58:19 -04:00 |
|
|
Wes Lambert
|
770aaf415c
|
Require at least on arg for start/stop/restart scripts
|
2020-09-02 18:55:59 +00:00 |
|
|
weslambertandGitHub
|
d35cca7fc5
|
Merge pull request #1278 from Security-Onion-Solutions/fix/elastalert_extra_hosts
Add manager to hosts file
|
2020-09-02 07:44:49 -04:00 |
|
|
weslambertandGitHub
|
5d920885e0
|
Add manager to hosts file
|
2020-09-02 07:43:55 -04:00 |
|
|
weslambertandGitHub
|
011958a2f3
|
Merge pull request #1274 from Security-Onion-Solutions/fix/zeek_syslog
Ensure Zeek syslog log is enabled for Import node
|
2020-08-31 13:08:44 -04:00 |
|
|
Wes Lambert
|
ae3fe9e892
|
Ensure Zeek syslog log is enabled for Import node
|
2020-08-31 17:07:16 +00:00 |
|
|
weslambertandGitHub
|
96f25914db
|
Merge pull request #1273 from Security-Onion-Solutions/fix/zeek_syslog_default
Fix/zeek syslog default
|
2020-08-31 12:32:52 -04:00 |
|
|
Wes Lambert
|
5ed5e6603d
|
Fix space
|
2020-08-31 16:32:12 +00:00 |
|
|
Wes Lambert
|
26ffc44fd1
|
Only enable syslog log by default in Eval mode
|
2020-08-31 16:30:32 +00:00 |
|
|
weslambertandGitHub
|
6350c83e05
|
Merge pull request #1272 from Security-Onion-Solutions/feature/wazuh_mgmt_wrappers
Add Wazuh mgmt wrappers for manage_agents and upgrade
|
2020-08-31 10:55:25 -04:00 |
|
|
Wes Lambert
|
46e7e121e3
|
Add Wazuh mgmt wrappers for manage_agents and upgrade
|
2020-08-31 14:54:24 +00:00 |
|
|
weslambertandGitHub
|
5db70cbd59
|
Merge pull request #1271 from Security-Onion-Solutions/fix/remove_minio
Remove minio for now
|
2020-08-31 10:29:30 -04:00 |
|
|
Wes Lambert
|
6d14f2af96
|
Remove minio for now
|
2020-08-31 14:07:47 +00:00 |
|
|
weslambertandGitHub
|
42bd75a1cc
|
Merge pull request #1270 from Security-Onion-Solutions/fix/elastalert_startup
Wait for Elasticsearch indices to be queryable before starting Elasta…
|
2020-08-31 09:56:18 -04:00 |
|
|
Wes Lambert
|
9abbda8e04
|
Wait for Elasticsearch indices to be queryable before starting Elastalert container
|
2020-08-31 13:54:49 +00:00 |
|
|
weslambertandGitHub
|
509985ed07
|
Merge pull request #1254 from Security-Onion-Solutions/fix/sensor_clean
Cron updates
|
2020-08-26 11:03:03 -04:00 |
|
|
weslambertandGitHub
|
000c2abb33
|
Update timing for so-yara-update
|
2020-08-26 11:02:33 -04:00 |
|
|
weslambertandGitHub
|
ce49e050bc
|
Update timing for sensor clean cron
|
2020-08-25 12:14:43 -04:00 |
|
|
weslambertandGitHub
|
61cc5b9712
|
Merge pull request #1246 from Security-Onion-Solutions/fix/sensor_clean_log
Fix/sensor clean log
|
2020-08-25 11:36:10 -04:00 |
|
|
Wes Lambert
|
c03812f7ab
|
Add rotation for sensor_clean log
|
2020-08-25 15:34:30 +00:00 |
|
|
weslambertandGitHub
|
a8f727ad40
|
Don't write to log if not past CRIT_DISK_USAGE
|
2020-08-25 11:19:36 -04:00 |
|
|
weslambertandGitHub
|
12a9d26231
|
Merge pull request #1223 from Security-Onion-Solutions/fix/aws_fwd_defaults
Add defaults file for fwdnode
|
2020-08-20 10:17:21 -04:00 |
|
|
Wes Lambert
|
3f04e566f2
|
Add defaults file for fwdnode
|
2020-08-20 14:16:05 +00:00 |
|
|
weslambertandGitHub
|
d80156505c
|
Merge pull request #1217 from Security-Onion-Solutions/fix/aws_automation
Add defaults file for search node
|
2020-08-19 15:09:00 -04:00 |
|
|
Wes Lambert
|
ed1e346789
|
Add defaults file for search node
|
2020-08-19 19:07:24 +00:00 |
|
|
weslambertandGitHub
|
d25afe4aa5
|
Merge pull request #1216 from Security-Onion-Solutions/fix/logstash_hosts
Add manager IP to container hosts file
|
2020-08-19 14:39:04 -04:00 |
|
|
weslambertandGitHub
|
b5dd868d1b
|
Add manager IP to container hosts file
|
2020-08-19 14:34:28 -04:00 |
|
|
weslambertandGitHub
|
ca84ae43ef
|
Merge pull request #1208 from Security-Onion-Solutions/fix/remove_pillar_from_setup
Don't echo pillar to setup log
|
2020-08-18 15:44:20 -04:00 |
|
|
weslambertandGitHub
|
a4e986ea37
|
Don't echo pillar to setup log
|
2020-08-18 15:43:43 -04:00 |
|
|
weslambertandGitHub
|
82bfa567d0
|
Merge pull request #1204 from Security-Onion-Solutions/fix/enable_strelka_default
Enable YARA rules by default
|
2020-08-18 14:54:46 -04:00 |
|
|
weslambertandGitHub
|
eaad0487b5
|
Enable YARA rules by default
|
2020-08-18 14:54:11 -04:00 |
|
|
weslambertandGitHub
|
945bc5c6de
|
Merge pull request #1184 from Security-Onion-Solutions/fix/automate_ssh
Don't copy SSH key if automated install
|
2020-08-14 14:42:44 -04:00 |
|
|
weslambertandGitHub
|
c9d6293f8f
|
Don't copy SSH key if automated install
|
2020-08-14 14:41:35 -04:00 |
|
|
Wes Lambert
|
7686a05f42
|
Set Strelka rules enabled by default for Eval Mode
|
2020-08-14 15:33:38 +00:00 |
|
|
weslambertandGitHub
|
b662f9354f
|
Merge pull request #1180 from Security-Onion-Solutions/fix/thehive_global
Only copy TheHive details to global pillar if enabled
|
2020-08-14 11:23:16 -04:00 |
|
|
Wes Lambert
|
ab4285aaaf
|
Only copy TheHive details to global pillar if enabled
|
2020-08-14 15:21:56 +00:00 |
|
|
weslambertandGitHub
|
796551d71b
|
Merge pull request #1161 from Security-Onion-Solutions/fix/redisconf
Update Redis maxmemory settings
|
2020-08-11 13:27:28 -04:00 |
|
|
weslambertandGitHub
|
b95f8a9314
|
Update Redis maxmemory settings
|
2020-08-11 12:57:57 -04:00 |
|
|
weslambertandGitHub
|
e9af032c28
|
Merge pull request #1143 from Security-Onion-Solutions/feature/aws_mgr_defaults
Add AWS defaults file for manager
|
2020-08-04 10:13:07 -04:00 |
|
|
Wes Lambert
|
46f70c254c
|
Add AWS defaults file for manager
|
2020-08-04 14:11:50 +00:00 |
|
|
weslambertandGitHub
|
f7425b14e3
|
Merge pull request #1142 from Security-Onion-Solutions/feature/aws_eval_defaults
AWS defaults modifications
|
2020-08-03 23:51:32 -04:00 |
|
|
Wes Lambert
|
2290c28a07
|
AWS defaults modifications
|
2020-08-04 03:49:59 +00:00 |
|
|
weslambertandGitHub
|
12f53ce9d9
|
Merge pull request #1134 from Security-Onion-Solutions/fix/aws_auto_reboot
Reboot after finished with setup
|
2020-08-03 10:31:24 -04:00 |
|
|
weslambertandGitHub
|
7e2917fc99
|
Reboot after finished with setup
|
2020-08-03 10:31:03 -04:00 |
|
|
weslambertandGitHub
|
9255e77263
|
Merge pull request #1129 from Security-Onion-Solutions/feature/aws_standalone_defaults
Add AWS Standalone Defaults
|
2020-07-31 16:15:12 -04:00 |
|
|
Wes Lambert
|
ecafbc6014
|
Add AWS Standalone Defaults
|
2020-07-31 20:12:25 +00:00 |
|
|
weslambertandGitHub
|
00ba4ca6c0
|
Merge pull request #1121 from Security-Onion-Solutions/fix/thehive_static
Fix/thehive static
|
2020-07-30 10:27:43 -04:00 |
|
|
weslambertandGitHub
|
4282930f08
|
Update cortex-application.conf
|
2020-07-30 10:26:49 -04:00 |
|
|
weslambertandGitHub
|
c58ee8a37d
|
Add Cortex play secret
|
2020-07-30 10:25:53 -04:00 |
|
|
weslambertandGitHub
|
b6a053070f
|
Change TheHive play secret
|
2020-07-30 10:25:07 -04:00 |
|
|
weslambertandGitHub
|
2fab00458b
|
Add randomized play secrets for Cortex + TheHive
|
2020-07-30 10:23:00 -04:00 |
|
|
weslambertandGitHub
|
646bf1cb4d
|
Merge pull request #1118 from Security-Onion-Solutions/fix/wazuh_register_to
Fix/wazuh registration timeout
|
2020-07-29 13:53:45 -04:00 |
|
|
weslambertandGitHub
|
c48ba8abaf
|
Re-arrange config
|
2020-07-29 13:52:12 -04:00 |
|
|
weslambertandGitHub
|
9db390023b
|
Increase timeout from 10s to 30s
|
2020-07-29 13:51:46 -04:00 |
|
|
weslambertandGitHub
|
4b36c4a809
|
Merge pull request #1115 from Security-Onion-Solutions/fix/remove_ls_syslog
Remove LS syslog port binding
|
2020-07-29 08:35:41 -04:00 |
|
|
weslambertandGitHub
|
7d432091e2
|
Remove LS syslog port binding
|
2020-07-29 08:35:07 -04:00 |
|
|
weslambertandGitHub
|
0f6ecdf38a
|
Merge pull request #1104 from Security-Onion-Solutions/feature/cortex_orguser
Create default orguser if empty
|
2020-07-27 09:50:23 -04:00 |
|
|
Wes Lambert
|
e81fd7464b
|
Create default orguser if empty
|
2020-07-27 13:49:17 +00:00 |
|
|
weslambertandGitHub
|
ced51761fa
|
Merge pull request #1103 from Security-Onion-Solutions/feature/wazuh_version
Bump Wazuh version
|
2020-07-27 09:46:27 -04:00 |
|
|
Wes Lambert
|
ac5aeb4801
|
Bump Wazuh version
|
2020-07-27 13:45:34 +00:00 |
|
|
weslambertandGitHub
|
88ffd0c17c
|
Merge pull request #1101 from Security-Onion-Solutions/feature/wazuh_symlinks
Add Wazuh Wazuh symlinks for config/rules
|
2020-07-27 08:15:58 -04:00 |
|
|
Wes Lambert
|
51e27cadc8
|
Add Wazuh Wazuh symlinks for cpnfig/rules
|
2020-07-27 12:14:43 +00:00 |
|
|
weslambertandGitHub
|
2d2bebdd9c
|
Merge pull request #1100 from Security-Onion-Solutions/feature/wazuh_nsm
Move Wazuh from /opt/so/ to /nsm/wazuh
|
2020-07-27 07:59:39 -04:00 |
|
|
Wes Lambert
|
958ee25f6d
|
Move Wazuh from /opt/so/ to /nsm/wazuh
|
2020-07-27 11:58:12 +00:00 |
|
|
weslambertandGitHub
|
2d096ddd66
|
Merge pull request #1096 from Security-Onion-Solutions/fix/elastalert_thehive
Make sure we are searching all clusters when running rules
|
2020-07-24 18:05:46 -04:00 |
|
|
Wes Lambert
|
3ac9f1800b
|
Make sure we are searching all clusters when running rules
|
2020-07-24 22:04:30 +00:00 |
|
|
weslambertandGitHub
|
2341d9592e
|
Merge pull request #1025 from Security-Onion-Solutions/fix/wazuh_cleanup
Change verbiage
|
2020-07-17 09:39:21 -04:00 |
|
|
weslambertandGitHub
|
e91aa751a7
|
Change verbiage
|
2020-07-17 09:38:43 -04:00 |
|
|
weslambertandGitHub
|
f8bb094546
|
Merge pull request #1014 from Security-Onion-Solutions/fix/strelka_standalone
Fix module eval
|
2020-07-16 09:32:06 -04:00 |
|
|
Wes Lambert
|
8275f458a1
|
Fix module eval
|
2020-07-16 13:30:38 +00:00 |
|
|
weslambertandGitHub
|
7fecfdab32
|
Update README.md
|
2020-07-16 08:14:47 -04:00 |
|
|
weslambertandGitHub
|
f7d527bb90
|
Update README.md
|
2020-07-16 08:14:23 -04:00 |
|
|
weslambertandGitHub
|
7a36803e2c
|
Merge pull request #1002 from Security-Onion-Solutions/fix/strelka_observer
Add observer name for Strelka events
|
2020-07-14 13:39:52 -04:00 |
|