reyesj2
|
a6ff92b099
|
Note to remove so-kafka-clusterid. Update soup and setup to generate needed kafka pillar values
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-12 12:11:18 -04:00 |
|
m0duspwnens
|
d73ba7dd3e
|
order kafka pillar assignment
|
2024-04-12 11:55:26 -04:00 |
|
m0duspwnens
|
04ddcd5c93
|
add receiver managersearch and standalone to kafka.nodes pillar
|
2024-04-12 11:52:57 -04:00 |
|
reyesj2
|
af29ae1968
|
Merge kaffytaffy
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-12 11:43:46 -04:00 |
|
reyesj2
|
fbd3cff90d
|
Make global.pipeline use GLOBALMERGED value
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-12 11:21:19 -04:00 |
|
m0duspwnens
|
0ed9894b7e
|
create kratos local pillar dirs during setup
|
2024-04-12 11:19:46 -04:00 |
|
m0duspwnens
|
a54a72c269
|
move kafka_cluster_id to kafka:cluster_id
|
2024-04-12 11:19:20 -04:00 |
|
Josh Brower
|
5b81a73e58
|
Merge pull request #12791 from Security-Onion-Solutions/2.4/detectiondefaults
Fix fingerprint paths
|
2024-04-12 09:01:38 -04:00 |
|
DefensiveDepth
|
49ccd86c39
|
Fix fingerprint paths
|
2024-04-12 08:35:44 -04:00 |
|
m0duspwnens
|
f514e5e9bb
|
add kafka to receiver
|
2024-04-11 16:23:05 -04:00 |
|
reyesj2
|
3955587372
|
Use global.pipeline for redis / kafka states
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 16:20:09 -04:00 |
|
reyesj2
|
6b28dc72e8
|
Update annotation for global.pipeline
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 15:38:33 -04:00 |
|
reyesj2
|
ca7253a589
|
Run kafka-clusterid script when pillar values are missing
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 15:38:03 -04:00 |
|
reyesj2
|
af53dcda1b
|
Remove references to kafkanode
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 15:32:00 -04:00 |
|
reyesj2
|
55cf90f477
|
merge 2.4/dev
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 14:44:59 -04:00 |
|
reyesj2
|
c269fb90ac
|
Added a Kismet Wifi devices dashboard for an overview of kismet data
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 14:41:54 -04:00 |
|
Mike Reeves
|
1250a728ac
|
Merge pull request #12769 from Security-Onion-Solutions/TOoSmOotH-patch-3
Update analyst.json
|
2024-04-11 14:30:17 -04:00 |
|
reyesj2
|
68e016090b
|
Fix network.wireless.ssid not parsing
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 13:21:54 -04:00 |
|
reyesj2
|
fd689a4607
|
Fix typo in ingest pipeline
Test to fix duplicate events in SOC, by removing conflicting field event.created
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-11 11:18:04 -04:00 |
|
Josh Brower
|
ae09869417
|
Merge pull request #12780 from Security-Onion-Solutions/2.4/detectiondefaults
Enable Detections Adv by default
|
2024-04-11 09:32:34 -04:00 |
|
DefensiveDepth
|
1c5f02ade2
|
Update annotations
|
2024-04-11 09:21:08 -04:00 |
|
DefensiveDepth
|
ed97aa4e78
|
Enable Detections Adv by default
|
2024-04-11 08:21:20 -04:00 |
|
reyesj2
|
7124f04138
|
Update ingest pipelines to match updated mappings
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-10 16:13:06 -04:00 |
|
reyesj2
|
2ab9cbba61
|
Update wording for Kismet poll interval annotation
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-10 16:12:22 -04:00 |
|
reyesj2
|
4097e1d81a
|
Create mappings for Kismet integration
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-10 16:10:27 -04:00 |
|
m0duspwnens
|
d3bd56b131
|
disable logstash and redis if kafka enabled
|
2024-04-10 14:13:27 -04:00 |
|
m0duspwnens
|
e9e61ea2d8
|
Merge remote-tracking branch 'origin/2.4/dev' into kaffytaffy
|
2024-04-10 13:14:13 -04:00 |
|
m0duspwnens
|
86b984001d
|
annotations and enable/disable from ui
|
2024-04-10 10:39:06 -04:00 |
|
Mike Reeves
|
2206553e03
|
Update analyst.json
|
2024-04-10 09:49:21 -04:00 |
|
m0duspwnens
|
fa7f8104c8
|
Merge remote-tracking branch 'origin/reyesj2/kafka' into kaffytaffy
|
2024-04-09 11:13:02 -04:00 |
|
m0duspwnens
|
bd5fe43285
|
jinja config files
|
2024-04-09 11:07:53 -04:00 |
|
m0duspwnens
|
d38051e806
|
fix client and server properties formatting
|
2024-04-09 10:36:37 -04:00 |
|
m0duspwnens
|
daa5342986
|
items not keys in for loop
|
2024-04-09 10:22:05 -04:00 |
|
m0duspwnens
|
c48436ccbf
|
fix dict update
|
2024-04-09 10:19:17 -04:00 |
|
m0duspwnens
|
7aa00faa6c
|
fix var
|
2024-04-09 09:31:54 -04:00 |
|
m0duspwnens
|
6217a7b9a9
|
add defaults and jijafy kafka config
|
2024-04-09 09:27:21 -04:00 |
|
reyesj2
|
d67ebabc95
|
Remove logstash output to kafka pipeline. Add additional topics for searchnodes to ingest and add partition/offset info to event
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-08 16:38:03 -04:00 |
|
Josh Brower
|
b9474b9352
|
Merge pull request #12766 from Security-Onion-Solutions/2.4/sigma-pipeline
Ship Defender logs + more
|
2024-04-08 16:35:24 -04:00 |
|
DefensiveDepth
|
376efab40c
|
Ship Defender logs
|
2024-04-08 14:01:38 -04:00 |
|
reyesj2
|
65274e89d7
|
Add client_id to logstash pipeline. To identify which searchnode is pulling messages
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-05 15:38:00 -04:00 |
|
coreyogburn
|
acf29a6c9c
|
Merge pull request #12760 from Security-Onion-Solutions/cogburn/detection-author-remap
Detection Author as a Keyword instead of Text
|
2024-04-05 11:39:53 -06:00 |
|
reyesj2
|
721e04f793
|
initial logstash input from kafka over ssl
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-05 13:37:14 -04:00 |
|
Corey Ogburn
|
00cea6fb80
|
Detection Author as a Keyword instead of Text
With Quick Actions added to Detections, as many fields should be usable as possible.
|
2024-04-05 11:22:47 -06:00 |
|
reyesj2
|
433309ef1a
|
Generate kafka cluster id if it doesn't exist
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-05 09:35:12 -04:00 |
|
Mike Reeves
|
cbc95d0b30
|
Merge pull request #12759 from Security-Onion-Solutions/TOoSmOotH-patch-2
Update so-log-check
|
2024-04-05 08:17:50 -04:00 |
|
Mike Reeves
|
21f86be8ee
|
Update so-log-check
|
2024-04-05 08:03:42 -04:00 |
|
Josh Brower
|
8e38c3763e
|
Merge pull request #12756 from Security-Onion-Solutions/2.4/detections-defaults
Use list not string
|
2024-04-04 17:00:38 -04:00 |
|
DefensiveDepth
|
ca807bd6bd
|
Use list not string
|
2024-04-04 16:58:39 -04:00 |
|
reyesj2
|
735cfb4c29
|
Autogenerate kafka topics when a message it sent to non-existing topic
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
|
2024-04-04 16:45:58 -04:00 |
|
reyesj2
|
6202090836
|
Merge remote-tracking branch 'origin/kaffytaffy' into reyesj2/kafka
|
2024-04-04 16:27:06 -04:00 |
|