CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
10,086 Commits 40 Branches 127 Tags
91a7f25d3ac2e4f4e00a2d978c3084e90be9d8d8
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 34d57c386b Update analyzer docs with information about analyzers that require authentication 2022-05-10 09:32:18 -04:00
weslambertandGitHub 000e813fbb Merge pull request #7921 from Security-Onion-Solutions/fix/analyzer-packages 
Update analyzer packages to those downloaded by Alpine and add additional build script option
 2022-05-09 16:43:31 -04:00
Wes Lambert 555ca2e277 Update analyzer build/testing script to download necessary Python packages 2022-05-09 20:06:39 +00:00
Wes Lambert 32adba6141 Update analyzer packages with those built from native (Alpine) Docker image 2022-05-09 20:04:41 +00:00
weslambertandGitHub 9800f59ed7 Add Urlscan to observable support matrix 2022-05-06 13:11:43 -04:00
Wes Lambert ccac71f649 Fix formatting/whitespace 2022-05-06 17:08:40 +00:00
Wes Lambert 1990ba0cf0 Fix formatting/whitespace 2022-05-06 17:08:33 +00:00
Wes Lambert 8ff5778569 Add Urlscan analyzer and tests 2022-05-06 17:01:06 +00:00
weslambertandGitHub a96c665d04 Change test name for EmailRep 2022-05-03 14:13:25 -04:00
weslambertandGitHub f3a91d9fcd Add EmailRep analyzer to observable support matrix 2022-05-03 10:10:57 -04:00
Wes Lambert 5a9acb3857 Add EmailRep analyzer and tests 2022-05-03 14:06:32 +00:00
Wes Lambert 8b5666b238 Ensure API key is used 2022-05-03 12:48:06 +00:00
weslambertandGitHub efb229cfcb Update to match configuration in analyzer dir 2022-05-02 16:35:21 -04:00
weslambertandGitHub 2fcb2b081d Update allowed complexity to 12 2022-05-02 16:14:43 -04:00
weslambertandGitHub 25f17a5efd Update allowed complexity to 11 2022-04-29 09:42:57 -04:00
weslambertandGitHub 66b4fe9f58 Add additional information around URI and User Agent 2022-04-28 17:14:36 -04:00
Wes Lambert c001708707 Add Pulsedive analyzer and tests 2022-04-28 20:56:03 +00:00
weslambertandGitHub 4edd729596 Add initial supported observable matrix/table 2022-04-27 08:58:34 -04:00
Wes Lambert 76f183b112 Add Greynoise analyzer and tests 2022-04-26 17:25:35 +00:00
Wes Lambert bd63753d80 Update analyzer name/description 2022-04-25 19:27:10 +00:00
Wes Lambert 15fcaa7030 Add localfile analyzer and tests 2022-04-25 19:23:35 +00:00
Wes Lambert fbf6e64e67 Add initial OTX analyzer and tests 2022-04-22 17:13:40 +00:00
weslambertandGitHub 677db7c563 Merge pull request #7841 from Security-Onion-Solutions/weslambert-patch-2 
Update shard count for Zeek in setup
 2022-04-21 17:27:57 -04:00
weslambertandGitHub 1bb216954c Merge pull request #7840 from Security-Onion-Solutions/weslambert-patch-1 
Update shards for Zeek
 2022-04-21 17:26:57 -04:00
weslambertandGitHub c81988ab00 Update shard count for Zeek in setup 2022-04-21 17:26:30 -04:00
weslambertandGitHub 542db5b7f5 Update defaults.yaml 2022-04-21 17:24:24 -04:00
Wes Lambert b2db32a2c7 Add function/test for non-existent VT api_key 2022-04-21 17:33:24 +00:00
Wes Lambert 9287d6adf7 Reduce size of test output for test 2022-04-21 16:56:22 +00:00
Wes Lambert c8e189f35a Add source-packages for JA3er 2022-04-21 16:46:45 +00:00
Wes Lambert 5afcc8de4f Add JA3er analyzer and associated test 2022-04-21 16:42:46 +00:00
weslambertandGitHub d7eed52fae Change -f to -r 2022-04-21 09:46:44 -04:00
Wes Lambert 07cf3469a0 Remove pyyaml for requirements file 2022-04-04 11:40:02 +00:00
Wes Lambert 39101cafd1 Add UrlHaus analyzer and helpers script 2022-04-01 21:11:57 +00:00
weslambertandGitHub 7f7eaf173b Merge pull request #7663 from Security-Onion-Solutions/fix/strelka_fw 
Add strelka_frontend to heavynode, sensor, and standalone role FW por…
 2022-03-28 16:14:25 -04:00
weslambertandGitHub 6004dde54a Add strelka_frontend to heavynode, sensor, and standalone role FW portgroups 2022-03-28 16:05:07 -04:00
weslambertandGitHub fb7160cba5 Merge pull request #7644 from Security-Onion-Solutions/fix/syslog_pr_adjustment 
Update with changes from Abe's PR and other fixes
 2022-03-25 13:59:20 -04:00
weslambertandGitHub e6599cd10e Update with changes from Abe's PR and other fixes 2022-03-25 13:57:44 -04:00
weslambertandGitHub c02d7fab50 Merge pull request #7636 from Security-Onion-Solutions/feature/rita 
Parsing of RITA Logs
 2022-03-24 13:05:22 -04:00
weslambertandGitHub fbc86f43ec Add exclude filter for logs for when there are no results from analysis 2022-03-24 13:03:03 -04:00
weslambertandGitHub 4c93217aac Merge pull request #7635 from Security-Onion-Solutions/fix/process_mappings_keyword 
Additional .keyword shims for process mappings
 2022-03-24 12:53:16 -04:00
Wes Lambert fe1b72655b Additional .keyword shims for process mappings 2022-03-24 16:45:06 +00:00
weslambertandGitHub 5160a55dcf Merge pull request #7629 from Security-Onion-Solutions/fix/roles_load_check_cluster_health 
Check ES cluster health before trying to load roles
 2022-03-23 11:07:24 -04:00
weslambertandGitHub 1f2bca599f Check cluster health before trying to load roles for ES 2022-03-23 11:00:26 -04:00
Wes Lambert 8a56c88773 Adjust log file paths 2022-03-22 17:51:17 +00:00
Wes Lambert 57f01c70ec Remove extra forward slash in log path 2022-03-22 17:45:23 +00:00
Wes Lambert 2487d468ab Add RITA Elasticsearch ingest pipeline config 2022-03-22 17:38:22 +00:00
Wes Lambert f613d8ad86 Add RITA Logstash config 2022-03-22 17:36:18 +00:00
weslambertandGitHub aaded58131 Merge pull request #7565 from Security-Onion-Solutions/fix/es_template_fix 
Custom ES template fixes
 2022-03-15 11:09:46 -04:00
Wes Lambert 42d6c3a956 Replace Elastic connection check using ELASTICCURL with so-elasticsearch-query 2022-03-15 14:55:04 +00:00
Wes Lambert 5f56c7a261 Replace ELASTICCURL with so-elasticsearch-query 2022-03-15 14:32:00 +00:00
weslambertandGitHub d46620ea2a Merge pull request #7561 from Security-Onion-Solutions/es_template_map_fix 
Custom ES Template Fixes
 2022-03-15 10:01:42 -04:00
Wes Lambert ba24f75893 Fix index typo 2022-03-11 18:11:16 +00:00
Wes Lambert 70ed20f691 Add new sls file for custom ES index templates 2022-03-11 18:07:23 +00:00
Wes Lambert d12ff503c2 Chage role loading verbiage 2022-03-11 16:23:19 +00:00
Wes Lambert dc258cf043 Load custom component templates in so-elasticsearch-templates-load 2022-03-11 16:22:55 +00:00
Wes Lambert 8e43a6e571 Don't generate index template if index_template definition is not present in pillar 2022-03-11 16:22:06 +00:00
weslambertandGitHub 262e68cb75 Merge pull request #7469 from Security-Onion-Solutions/fix/kibana_config_load_template 
Add .template extension to ensure we are loading the template and not the resultant file
 2022-03-08 21:12:29 -05:00
weslambertandGitHub c83b63d0d8 Add .template extension to load template file 2022-03-08 20:53:16 -05:00
weslambertandGitHub 8d9ddf5f1b Add .template extension to load template 2022-03-08 20:52:13 -05:00
weslambertandGitHub 8115da358f Add .template extension to load template file 2022-03-08 20:51:50 -05:00
weslambertandGitHub 5f3c29b7f8 Merge pull request #7466 from Security-Onion-Solutions/fix/process_name_keyword 
Add process.name.keyword
 2022-03-08 12:47:31 -05:00
weslambertandGitHub 65f998d6f7 Remove process.name.keyword for future-proofing 2022-03-08 12:44:51 -05:00
weslambertandGitHub 406267a892 Add process.name.keyword 2022-03-08 12:42:34 -05:00
weslambertandGitHub d9c3160fbf Merge pull request #7465 from Security-Onion-Solutions/fix/kibana_saved_objects_load 
Kibana dashboard/saved objects loading improvements
 2022-03-08 12:22:55 -05:00
Wes Lambert d392cb258c Switch Kibana state to kibana.so_savedobjects_defaults in top file 2022-03-08 16:59:48 +00:00
Wes Lambert 86e228b200 Add .template extension for future-proofing config files 2022-03-08 16:58:37 +00:00
Wes Lambert a6fd1023b4 Fix criteria for successful execution 2022-03-08 16:57:26 +00:00
Wes Lambert 3f31f7fd41 Add .template extension to fix script behavior and not modify watched file 2022-03-08 16:43:43 +00:00
Wes Lambert 28554164cd Remove drop file when securitySolution saved objects change 2022-03-08 14:39:23 +00:00
Wes Lambert 14dddd8649 Remove drop file when config saved objects change 2022-03-08 14:37:15 +00:00
Wes Lambert c0f49f6fb0 Remove drop file when dashbaord saved objects change 2022-03-08 14:35:04 +00:00
Wes Lambert d10d4acf9f Modify Kibana config load script to drop file if successfully executed 2022-03-08 14:33:15 +00:00
weslambertandGitHub e2bda255cc Merge pull request #7447 from Security-Onion-Solutions/fix/es_templates_soup 
Remove old Elasticsearch index templates during SOUP
 2022-03-07 15:10:44 -05:00
Wes Lambert fa9be58b23 Specify index templates 2022-03-07 20:04:23 +00:00
Wes Lambert 647b316a96 Remove old ES index templates 
Signed-off-by: Wes Lambert <wlambertts@gmail.com>
 2022-03-07 20:02:45 +00:00
weslambertandGitHub eac120f4c2 Merge pull request #7444 from Security-Onion-Solutions/fix/dtc_client_override 
Add DTC client mappings
 2022-03-07 13:38:19 -05:00
Wes Lambert c549b20221 Add DTC client mappings 2022-03-07 18:36:26 +00:00
weslambertandGitHub 5600b55f05 Merge pull request #7427 from Security-Onion-Solutions/fix/syslog_kibana_viz 
Replace syslog facility and severity with label fields in Kibana syslog dashboard
 2022-03-07 08:14:35 -05:00
Wes Lambert 33ba45472f Replace syslog facility and severity with label fields 2022-03-04 21:40:41 +00:00
weslambertandGitHub ee4035f022 Merge pull request #7426 from Security-Onion-Solutions/fix/syslog_zeek 
Change to label fields for syslog facility and severity
 2022-03-04 16:31:45 -05:00
weslambertandGitHub f71ccadb8a Change to label fields for Zeek syslog 2022-03-04 16:29:55 -05:00
weslambertandGitHub fc3273fa49 Change to label fields to comply with what's defined in Filebeat template 2022-03-04 16:29:01 -05:00
weslambertandGitHub 3148fa0e06 Merge pull request #7422 from Security-Onion-Solutions/fix/syslog_dot_keyword 
.keyword additions and increase max_clause_count
 2022-03-04 15:32:29 -05:00
weslambertandGitHub 254cf53c2f Increase clause count to 3500 2022-03-04 10:36:37 -05:00
Wes Lambert ffae22beef Add DTC syslog mappings for .keyword and add refs to defaults.yml 2022-03-04 13:04:11 +00:00
weslambertandGitHub 93c2f82345 Merge pull request #7413 from Security-Onion-Solutions/fix/add_keyword_subfield 
Add .keyword subfield for more mappings
 2022-03-03 10:42:38 -05:00
Wes Lambert 1f71816ad7 Add keyword subfield for DTC winlog mappings 2022-03-03 14:54:30 +00:00
Wes Lambert 1c086e36da Add missing comma for file mappings 2022-03-03 13:49:54 +00:00
Wes Lambert aa8d24b6cd Add DTC destination, source, and winlog mapping references to templates in defaults file 2022-03-03 13:42:20 +00:00
Wes Lambert 85979cbce8 Add file, process, and winlog mapping changes 2022-03-03 13:37:27 +00:00
Wes Lambert 8f97f09c9c Additional .keyword changes for host.hostname client.address, and event.action 2022-03-02 21:54:46 +00:00
Wes Lambert 3ee46e4c29 Add .keyword for destination/source geo.country_name 2022-03-02 21:50:03 +00:00
weslambertandGitHub a21060306c Merge pull request #7404 from Security-Onion-Solutions/fix/field_limit_adjustment 
Adjust field limit for now due to component template errors
 2022-03-02 11:41:35 -05:00
Wes Lambert c5b16fdf3b Adjust field limit for now 2022-03-02 16:33:39 +00:00
weslambertandGitHub b80e82aaf6 Merge pull request #7396 from Security-Onion-Solutions/fix/dot_security 
Revert back to usage of .security field
 2022-03-02 10:42:29 -05:00
Wes Lambert ab9b81ea39 Change match_only_text to text for mac in host mappings 2022-03-02 15:01:05 +00:00
Wes Lambert ed620b93b7 Add custom analyzer definition to all SO/DTC mappings 2022-03-02 14:43:19 +00:00
Wes Lambert 27c8eaa630 Update all other mappings for .security where applicable 2022-03-02 14:39:23 +00:00
Wes Lambert e925d435ff Update event, file, and host mappings to include .security 2022-03-02 14:33:52 +00:00
Wes Lambert 496b161253 Update ECS mappings to include .security 2022-03-02 14:27:36 +00:00