Mike Reeves
|
63be0734c9
|
More json for soc
|
2020-10-01 17:00:25 -04:00 |
|
Mike Reeves
|
5653828154
|
More json for soc
|
2020-10-01 16:57:04 -04:00 |
|
weslambert
|
2d2f4de337
|
Merge pull request #1437 from Security-Onion-Solutions/fix/kib_scripted_thehive
Update scripted field for TheHive case
|
2020-10-01 16:54:02 -04:00 |
|
Wes Lambert
|
8a81a5148b
|
Update scripted field for TheHive case
|
2020-10-01 20:52:57 +00:00 |
|
weslambert
|
98bef8fb9d
|
Merge pull request #1436 from Security-Onion-Solutions/fix/kibana_soc_thehive_case
Add SOC url for api integration
|
2020-10-01 16:47:11 -04:00 |
|
Wes Lambert
|
eced18c3cc
|
Add SOC url for api integration
|
2020-10-01 20:29:28 +00:00 |
|
Jason Ertel
|
8e15ed56d6
|
'Escalated' filter toggle will auto-enable 'acknowledged' filter toggle
|
2020-10-01 16:23:47 -04:00 |
|
Mike Reeves
|
cc2f2de5b5
|
soc.json stuff
|
2020-10-01 15:23:07 -04:00 |
|
Mike Reeves
|
b423e8d22a
|
soc.json stuff
|
2020-10-01 15:20:13 -04:00 |
|
Mike Reeves
|
1a561f6b12
|
soc.json stuff
|
2020-10-01 15:18:34 -04:00 |
|
William Wernert
|
a5bf4bbb35
|
Fix test for key in global.sls
|
2020-10-01 14:47:18 -04:00 |
|
Doug Burks
|
e836f96c65
|
move rule.uuid after rule.name
|
2020-10-01 12:09:52 -04:00 |
|
Doug Burks
|
4851069a10
|
remove rule.gid from Alerts groupby since Wazuh and Playbook may not have that field
|
2020-10-01 11:51:40 -04:00 |
|
William Wernert
|
040730e8f5
|
Rename script for consistent naming
|
2020-10-01 11:22:11 -04:00 |
|
William Wernert
|
afb777fc8f
|
Add automation user creation to soup when resetting playbook db
|
2020-10-01 11:13:24 -04:00 |
|
Doug Burks
|
bc19cce4c2
|
Acknowledging an alert may acknowledge more alerts than intended #1426
|
2020-10-01 10:00:54 -04:00 |
|
Doug Burks
|
26781de244
|
Add Strelka query to Hunt #1433
|
2020-10-01 06:59:36 -04:00 |
|
William Wernert
|
2264b6e51c
|
Add comments to shell code explaining curl statements
|
2020-09-30 19:54:34 -04:00 |
|
William Wernert
|
03b97cce75
|
Fix comment in new state + remove useless sleep command
|
2020-09-30 19:49:13 -04:00 |
|
William Wernert
|
11ae904100
|
Quiet script output + fix pillar value
|
2020-09-30 19:46:18 -04:00 |
|
weslambert
|
6818de9e64
|
Merge pull request #1431 from Security-Onion-Solutions/fix/elastlert_rules
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:36:11 -04:00 |
|
weslambert
|
887937a75d
|
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:35:35 -04:00 |
|
William Wernert
|
596f2d31e4
|
Automation -> automation
|
2020-09-30 17:04:24 -04:00 |
|
William Wernert
|
3ec255ecee
|
Remove old api token from sql
|
2020-09-30 17:03:35 -04:00 |
|
William Wernert
|
6361c790e9
|
Move automation user create to separate script to run after playbook state
|
2020-09-30 17:02:02 -04:00 |
|
William Wernert
|
8e80b41ca9
|
Remove Automation user from sql, gen user + store api key
|
2020-09-30 16:32:43 -04:00 |
|
Jason Ertel
|
1454201505
|
Disable thehivealerter
|
2020-09-30 15:26:29 -04:00 |
|
Jason Ertel
|
3af6e9e1fe
|
Remove mount point for SOCtopus generated playbook rules to avoid them activating and sending alerts to TheHive
|
2020-09-30 15:14:45 -04:00 |
|
Mike Reeves
|
8b5ff31351
|
Merge pull request #1430 from Security-Onion-Solutions/redis
Add Redis pillar and fix idstools
|
2020-09-30 15:09:59 -04:00 |
|
Mike Reeves
|
7314e2dea8
|
Add Redis pillar and fix idstools
|
2020-09-30 15:08:44 -04:00 |
|
Jason Ertel
|
ff04bb507a
|
Remove default Elastalert rules to stop automated alerts from being sent to thehive
|
2020-09-30 15:06:54 -04:00 |
|
weslambert
|
5b16a65422
|
Merge pull request #1429 from Security-Onion-Solutions/fix/zeek_server_ip
Fix issue with null Zeek server IP
|
2020-09-30 13:54:50 -04:00 |
|
Wes Lambert
|
02d2e5e2c6
|
Fix isue with null Zeek server IP
|
2020-09-30 17:53:30 +00:00 |
|
William Wernert
|
f3b8da1f9d
|
Fix Engrish (can causing -> can cause)
|
2020-09-30 13:40:57 -04:00 |
|
William Wernert
|
25d4bde33b
|
Merge pull request #1428 from Security-Onion-Solutions/feature/warn-dhcp
Add warning about IP address changing for network/DHCP iso installs
|
2020-09-30 13:13:40 -04:00 |
|
William Wernert
|
1ff20f7e27
|
Add warning about IP address changing for network/DHCP iso installs
|
2020-09-30 13:11:33 -04:00 |
|
weslambert
|
defe832121
|
Merge pull request #1427 from Security-Onion-Solutions/fix/wazuh_filebeat
Fix Filebeat config for Wazuh
|
2020-09-30 10:59:01 -04:00 |
|
Wes Lambert
|
d8f70397f7
|
Fix Filebeat config for Wazuh
|
2020-09-30 14:57:56 +00:00 |
|
weslambert
|
dac2ad5dbf
|
Merge pull request #1425 from Security-Onion-Solutions/feature/soctopus_pillar
Add initial implementation of SOCtopus pillar
|
2020-09-30 10:25:26 -04:00 |
|
Wes Lambert
|
c62acf5e4e
|
Add initial implmentation of SOCtopus pillar
|
2020-09-30 14:24:15 +00:00 |
|
Josh Patterson
|
10f4e09b70
|
Merge pull request #1424 from Security-Onion-Solutions/issue/1070
Issue/1070
|
2020-09-30 10:11:37 -04:00 |
|
William Wernert
|
00785c6ba5
|
Merge pull request #1418 from Security-Onion-Solutions/feature/replace-hardcoded-pass
Feature/replace hardcoded pass
|
2020-09-30 08:56:35 -04:00 |
|
Doug Burks
|
0a995f4a7a
|
Update README.md
|
2020-09-30 07:43:20 -04:00 |
|
m0duspwnens
|
85969dc16d
|
add quotes and remove quotes
|
2020-09-29 16:29:05 -04:00 |
|
m0duspwnens
|
bf99bab6c0
|
add quotes and remove quotes
|
2020-09-29 16:26:45 -04:00 |
|
weslambert
|
401764437f
|
Merge pull request #1421 from Security-Onion-Solutions/fix/ip_type
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 14:21:25 -04:00 |
|
Wes Lambert
|
36019727b3
|
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 18:20:15 +00:00 |
|
m0duspwnens
|
547c3ff52c
|
single quote inputs to yaml files
|
2020-09-29 13:59:16 -04:00 |
|
William Wernert
|
7d43d48aca
|
Remove bad line in playbook_db_init.sh
|
2020-09-29 11:13:09 -04:00 |
|
William Wernert
|
55058a11aa
|
Generate passwords for Grafana + Playbook default users
|
2020-09-29 11:12:09 -04:00 |
|