CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
9,496 Commits 40 Branches 127 Tags
93e9548eaffe4ea662a3dffcccc7935ca73a36ec
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 9e222b1464 Merge pull request #7206 from Security-Onion-Solutions/feature/template-reorg 
Re-organize Elasticsearch Index Templates
 2022-02-15 16:50:14 -05:00
Wes Lambert 4fa3749418 Remove bind or ES templates 2022-02-15 18:08:03 +00:00
Wes Lambert 786a189f65 Merge branch 'feature/template-reorg' of https://github.com/security-onion-solutions/securityonion into feature/template-reorg 2022-02-15 17:06:02 +00:00
Wes Lambert de731fc05d Remove default templates from ES template pillar since they are now managed in the defaults file. 2022-02-15 17:04:57 +00:00
Wes Lambert 3df58eadd1 Modify logic to include custom templates 2022-02-15 17:00:24 +00:00
weslambertandGitHub 1a53ec4372 Fix malformed copy/paste 2022-02-15 11:14:10 -05:00
Wes Lambert dce3b7a874 Update defaults file to include ES index templates 2022-02-15 15:53:07 +00:00
Wes Lambert 8e389bf6e5 Add ES template map file 2022-02-14 15:38:32 +00:00
Wes Lambert ebce67060f Initial template refactor 2022-02-14 15:20:33 +00:00
weslambertandGitHub 380fa7d0c8 Merge pull request #7153 from Security-Onion-Solutions/fix/dtc_event_mappings 
Add 'event.created' and 'event.ingested' keyword mapping
 2022-02-08 16:36:49 -05:00
Wes Lambert 9b841fd872 Add 'event.created' and 'event.ingested' keyword mapping 2022-02-08 21:34:32 +00:00
weslambertandGitHub c216457a3e Merge pull request #7147 from Security-Onion-Solutions/fix/ct_snyk 
Add Snyk component template
 2022-02-08 10:25:27 -05:00
Wes Lambert c2c4e4df17 Add Snyk component template 2022-02-08 15:23:43 +00:00
weslambertandGitHub 7be1549d41 Merge pull request #7146 from Security-Onion-Solutions/feature/additional_dtc_ct 
Additional component templates
 2022-02-08 10:12:31 -05:00
Wes Lambert f9a50d33c3 Add new templates 2022-02-08 13:17:23 +00:00
Wes Lambert 2951e12c96 Remove snyk component template for now and fix folder structure 2022-02-08 13:16:59 +00:00
Wes Lambert 6d0ca6fcbb Fix mangled key name/typo 2022-02-08 12:59:07 +00:00
Wes Lambert 2dd5db15b6 Add component and index template listing scripts 2022-02-08 03:40:42 +00:00
Wes Lambert 5090854d4d Add additional component templates and index template references 2022-02-08 03:03:55 +00:00
weslambertandGitHub b41c5439c6 Merge pull request #7141 from Security-Onion-Solutions/fix/index_template_mapping_reference 
Add mapping references for new component templates to index templates
 2022-02-07 15:06:19 -05:00
Wes Lambert 1366e5288e Add mappings references for new component templates to index templates 2022-02-07 19:54:23 +00:00
weslambertandGitHub f9196a8228 Merge pull request #7140 from Security-Onion-Solutions/feature/dtc_new_mappings 
New DTC/Component Template Mappings
 2022-02-07 14:47:07 -05:00
Wes Lambert 03bfb052ed Add component templates for Elasticsearch, Kibana, Logstash, Netflow, Suricata, and Zeek 2022-02-07 19:42:24 +00:00
weslambertandGitHub c9b40d8569 Merge pull request #7136 from Security-Onion-Solutions/feature/so_es_indices_list_sort 
Sort index listing alphabetically and add header
 2022-02-07 09:34:58 -05:00
Wes Lambert 50215c550b Sort index listing alphabetically and add header (@gebhard73) 2022-02-07 14:31:42 +00:00
weslambertandGitHub d0b54a3a34 Merge pull request #7119 from Security-Onion-Solutions/feature/dtc_additional 
Add additional scan and rule fileset mappings
 2022-02-04 14:14:20 -05:00
Wes Lambert 317f6471d8 Add additional scan and rule filset mappings 2022-02-04 19:05:09 +00:00
weslambertandGitHub 08c7181f1a Merge pull request #7118 from Security-Onion-Solutions/fix/dtc_file_mappings 
Fix/dtc file mappings
 2022-02-04 13:22:11 -05:00
Wes Lambert 1ce8bb3523 Fix winlog mapping reference reversion 2022-02-04 18:14:01 +00:00
Wes Lambert 5e03b1a5de Fix reference for file mappings in template 2022-02-04 18:11:03 +00:00
weslambertandGitHub 898db542bf Merge pull request #7117 from Security-Onion-Solutions/feature/winlog_dtc_mappings 
Add winlog mappings
 2022-02-04 12:16:16 -05:00
weslambertandGitHub 66452b14ef Merge pull request #7116 from Security-Onion-Solutions/fix/endgame_mappings 
Fix EG template and mappings
 2022-02-04 12:16:07 -05:00
Wes Lambert 69cb83cac9 Add winlog mappings 2022-02-04 17:08:26 +00:00
Wes Lambert f3902cf77d Fix EG template and mappings 2022-02-04 16:00:16 +00:00
weslambertandGitHub 1af63edc6b Merge pull request #7115 from Security-Onion-Solutions/feature/additional_dtc_mappings 
Additional DTC mapping changes
 2022-02-04 10:46:47 -05:00
Wes Lambert a3031b2b5c Additional DTC mapping changes 2022-02-04 15:38:51 +00:00
weslambertandGitHub 1edc1dd842 Merge pull request #7096 from Security-Onion-Solutions/fix/dtc-ct-keyword-subfield 
Add more DTC transition mappings
 2022-02-03 12:35:34 -05:00
Wes Lambert 1ce386bb7f Add more DTC transition mappings 2022-02-03 17:33:05 +00:00
weslambertandGitHub c7d23df000 Merge pull request #7076 from Security-Onion-Solutions/fix/zeek_dns_answers_name 
Rename dns.answers to prevent field conflict
 2022-02-03 12:22:26 -05:00
weslambertandGitHub c5b5c5858e Rename to prevent field conflict 2022-02-02 14:31:46 -05:00
weslambertandGitHub 5e9e0d971b Merge pull request #7070 from Security-Onion-Solutions/feature/composable_templates 
Initial composable template configuration and base mappings
 2022-02-02 10:25:15 -05:00
Wes Lambert 9db1510b0e Initial composable template configuration and base mappings 2022-02-02 02:08:31 +00:00
weslambertandGitHub 6a2111c2ae Merge pull request #7037 from Security-Onion-Solutions/fix/revert_zeek_dns_answers 
Revert back to dns.answers for now
 2022-01-31 09:55:22 -05:00
weslambertandGitHub 367b59188b Revert back to dns.answers for now 2022-01-31 09:54:39 -05:00
weslambertandGitHub 4ecf4ab253 Merge pull request #7020 from Security-Onion-Solutions/feature/dash_updates 
EG and HL Dashboard Updates
 2022-01-28 13:19:02 -05:00
weslambertandGitHub 5142e6ccc7 Update so-kibana-config-load 2022-01-28 13:01:33 -05:00
Wes Lambert 3b76c2421c Update to allow for passing HL saved objects 2022-01-28 17:59:34 +00:00
weslambertandGitHub 69689b470b Merge pull request #7005 from Security-Onion-Solutions/fix/revert_cases_field_limit 
Revert field limit from testing
 2022-01-27 11:33:31 -05:00
weslambertandGitHub fc0a5bce86 Revert field limit from testing 2022-01-27 11:18:35 -05:00
weslambertandGitHub 39257df396 Merge pull request #7004 from Security-Onion-Solutions/fix/revert_dtc 
Revert changes to common template
 2022-01-27 11:15:50 -05:00
weslambertandGitHub 60a0204975 Revert changes to common template 2022-01-27 11:02:47 -05:00
weslambertandGitHub e303fb12cf Merge pull request #7000 from Security-Onion-Solutions/fix/zeek_dns_answers_pipeline 
Fix Zeek field name so it doesn't conflict with mapping of other dns.…
 2022-01-26 15:04:12 -05:00
weslambertandGitHub 8f0a327cb5 Fix Zeek field name so it doesn't conflict with mapping of other dns.answers fields 2022-01-26 15:02:59 -05:00
weslambertandGitHub bdc5e89822 Merge pull request #6999 from Security-Onion-Solutions/fix/case_mapping_changes_temp 
Mapping changes for case index
 2022-01-26 14:59:45 -05:00
weslambertandGitHub 1b3e7f9d79 Temp changes while adjusting mapping 2022-01-26 14:57:16 -05:00
weslambertandGitHub e77648c475 Merge pull request #6994 from Security-Onion-Solutions/feature/dtc 
Additional DTC changes
 2022-01-26 12:22:48 -05:00
Wes Lambert e10749a495 Additional changes to template to accomodate default fields and keyword subfield 2022-01-26 17:16:29 +00:00
weslambertandGitHub ba52bd3835 Update template with syntax fixes 2022-01-25 08:56:03 -05:00
weslambertandGitHub f7a4cc20f2 Update so-common-template.json.jinja 2022-01-21 12:36:38 -05:00
weslambertandGitHub 1b860e11e7 Merge pull request #6936 from Security-Onion-Solutions/fix/field_conflicts 
Remove dynamic keyword template to prevent field conflicts with mappi…
 2022-01-20 12:48:15 -05:00
weslambertandGitHub d1efa71c57 Remove dynamic keyword template to prevent field conflicts with mappings defined in common template 2022-01-20 12:34:32 -05:00
weslambertandGitHub d0c8dd0626 Merge pull request #6931 from Security-Onion-Solutions/fix/cases_dynamic_disable 
Disable dynamic mapping and increase order to reduce potential field …
 2022-01-20 09:48:01 -05:00
weslambertandGitHub e137ad60c5 Disable dynamic mapping and increase order to reduce potential field conflicts 2022-01-20 09:44:41 -05:00
weslambertandGitHub c512351dd6 Add mapping for scan.exiftool and scan.pe.sections.entropy 2022-01-14 17:01:13 -05:00
weslambertandGitHub a90bc9dba9 Add mapping for scan.pe.sections.entropy 2022-01-14 16:58:53 -05:00
weslambertandGitHub 17509a9231 Merge pull request #6822 from Security-Onion-Solutions/fix/event_fields 
Add event.acknowledged and event.escalated mappings
 2022-01-10 16:14:45 -05:00
weslambertandGitHub 84f7c6b13b Add event.acknowledged and event.escalated mappings 2022-01-10 16:08:35 -05:00
weslambertandGitHub 1dc363138a Merge pull request #6814 from Security-Onion-Solutions/fix/template_typo 
Fix typo -- replace period with comma
 2022-01-10 13:30:13 -05:00
weslambertandGitHub 1c3eeb5a34 Fix typo -- replace period with comma 2022-01-10 13:29:06 -05:00
weslambertandGitHub 218f7f3a13 Merge pull request #6790 from Security-Onion-Solutions/fix/dtc_severity_label 
Add event.severity_label
 2022-01-07 11:44:30 -05:00
weslambertandGitHub 770e53d914 Add keyword subfield for event.severity_label 2022-01-07 11:21:57 -05:00
weslambertandGitHub c69e1353d9 Add event.severity_label 2022-01-07 11:19:54 -05:00
weslambertandGitHub a7e7566532 Merge pull request #6780 from Security-Onion-Solutions/feature/datatype_compliance 
Initial commit for data type compliance
 2022-01-06 16:38:17 -05:00
weslambertandGitHub 3f02003ea2 Merge pull request #6777 from Security-Onion-Solutions/fix/deprecation_ecs_compatibility_logstash 
Add config option for ECS compatibility (default of disabled)
 2022-01-06 11:31:51 -05:00
weslambertandGitHub 8e2f500b9c Add config option for ECS compatibility (default of disabled) 2022-01-06 11:24:04 -05:00
weslambertandGitHub 099e3e1ceb Merge pull request #6775 from Security-Onion-Solutions/fix/deprecation_warning_suppress 
Add logger stanza to suppress ES deprecation warning messages
 2022-01-06 10:45:37 -05:00
weslambertandGitHub 900d12b556 Add logger stanza to suppress deprecation warning messages for now due to current system index access warning messages flooding the ES log 2022-01-06 10:35:50 -05:00
weslambertandGitHub 2fb488f768 Merge pull request #6769 from Security-Onion-Solutions/fix/id_fielddata_deprecation 
Fix issue with _id field fielddata/deprecation
 2022-01-05 15:40:25 -05:00
Wes Lambert 1cafacfa51 Update saved objects to reflect removal of TheHive scripted field and replacement of PCAP pivot with Hunt pivot 2022-01-05 20:36:23 +00:00
weslambertandGitHub c1a88977cf Disable fielddata for _id field by default (since it is deprecated and can be memory-intensive) 2022-01-05 15:23:52 -05:00
Wes Lambert b60837e71a Initial commit for data type compliance 2022-01-05 16:38:56 +00:00
weslambertandGitHub 2f9672d3ea Merge pull request #6764 from Security-Onion-Solutions/feature/soup_branch 
Denote which branch is being used in SOUP if BRANCH is specified
 2022-01-05 10:54:29 -05:00
weslambertandGitHub db43e21378 Fix indentation 2022-01-05 10:46:41 -05:00
weslambertandGitHub 4d8b417fc9 Denote which branch is being used in SOUP if BRANCH is specified 2022-01-05 10:41:27 -05:00
weslambertandGitHub ff25d6f80b Merge pull request #6447 from Security-Onion-Solutions/eg_dashes 
Add initial EG dashboards
 2021-12-03 18:05:22 -05:00
Wes Lambert 0571612ea1 Add initial EG dashes 2021-12-03 22:38:30 +00:00
weslambertandGitHub 92131d4bb7 Merge pull request #6215 from Security-Onion-Solutions/fix/eg_spelling 
Fix spelling
 2021-11-12 21:13:28 -05:00
weslambertandGitHub 9ac1cb0e76 Fix spelling 2021-11-12 21:12:09 -05:00
weslambertandGitHub 8c46a2d1db Merge pull request #6210 from Security-Onion-Solutions/fix/soc_pillar_soup 
Add SOC pillar entry
 2021-11-12 13:35:46 -05:00
Wes Lambert 2fb9196604 Move logic above version declaration 2021-11-12 18:26:21 +00:00
Wes Lambert 48c71c8b12 Add soc pillar entry 2021-11-12 18:23:09 +00:00
weslambertandGitHub 8d185ced61 Merge pull request #6209 from Security-Onion-Solutions/fix/endgame_setup 
Adjust manager pillar config for Endgame and defaults
 2021-11-12 12:27:55 -05:00
weslambertandGitHub bc2e470da9 Fix indentation 2021-11-12 12:20:00 -05:00
weslambertandGitHub 0f817cd735 Merge pull request #6208 from Security-Onion-Solutions/fix/endgame_pivot 
Make Endgame pivot independent
 2021-11-12 12:17:24 -05:00
weslambertandGitHub df5901a65d Adjust how manager pillar is populated for ENDGAME and default SOC config 2021-11-12 12:16:26 -05:00
weslambertandGitHub 3cd1b5687e Make pivot condition independent for ENDGAMEHOST 2021-11-12 12:06:39 -05:00
weslambertandGitHub 6eb1a0b0ae Merge pull request #6169 from Security-Onion-Solutions/fix/ingest_dynamic_ref 
Add dynamic conf to config change check
 2021-11-09 16:11:38 -05:00
weslambertandGitHub 9301b8f5b9 Add dynamic conf to config change check 2021-11-09 15:56:52 -05:00
weslambertandGitHub 9597373e4a Merge pull request #6167 from Security-Onion-Solutions/ecs_pipeline_common 
Add config for dynamically formatted ingest pipelines
 2021-11-09 15:41:43 -05:00
Wes Lambert f80b70e008 Add config for dynamically formatted ingest pipelines 2021-11-09 20:07:53 +00:00