a37f0fd0c0
rename sosbridge to sobridge
2023-02-03 10:07:07 -05:00
6033e9a0de
use port_bindings from docker defaults in docker states
2023-01-13 10:15:10 -05:00
c313b19b50
Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/firewall
2023-01-09 11:18:08 -05:00
c1dfb9f935
Add missing Zeek log to filebeat defaults.yaml
2023-01-06 14:27:40 -05:00
24876eecd9
change refs from sosnet to sosbridge
2022-12-22 14:02:40 -05:00
accc293c8a
2.4 firewall changes
2022-12-21 15:03:45 -05:00
5c00ab7b7f
correct order in defaults.yaml
2022-12-08 16:50:34 -05:00
7cfb688890
update defaults.yaml
2022-12-08 16:32:04 -05:00
def0c85349
Disable Filebeat input for 'ecat_arp_info' Zeek logs
2022-12-07 08:00:21 -05:00
be5775e4a0
Ensure Filebeat defaults file is updated with ICS/SCADA log references
2022-12-06 16:15:09 +00:00
499b5d95f2
Add 'ics' tag for 'bsap'-prefixed events/logs
2022-12-06 16:01:57 +00:00
b95a83b016
Merge remote-tracking branch 'remotes/origin/2.4/dev' into dockerips
2022-11-22 14:17:19 -05:00
d2bc1a5523
Fix syntax error for 'ics' tag logic
2022-11-22 07:24:54 -05:00
fe180d5657
Fix indentation
2022-11-21 17:02:17 -05:00
9994d47a43
Add 'ics' tag to events generated from ICS protocol logs
2022-11-21 16:46:47 -05:00
febb781428
Add ICS/SCADA logs to filebeat defaults.yaml
2022-11-21 12:10:55 -05:00
591616fe5b
Add statics to all containers
2022-11-15 11:05:17 -05:00
b526532ab6
use global vars in states
2022-10-11 11:57:15 -04:00
37c98c14cd
Fix zeek logs in filebeat
2022-09-26 17:11:10 -04:00
aa7dd47b00
Fix zeek logs in filebeat
2022-09-26 17:01:44 -04:00
21c7f940d7
Update copyrights
2022-09-13 11:48:25 -04:00
2254512a2a
Add more logging to setup process
2022-09-12 12:48:02 -04:00
2bd9dd80e2
Move In Day
2022-09-07 09:06:25 -04:00
ec451c19f8
move port bindings back under port bindings
2022-07-12 15:17:25 -04:00
11d3ed36b7
Specify outputs for Elasticsearch and Kibana for Eval and Import Mode
...
Add outputs for Elasticsearch and Kibana for Eval/Import Mode, since Logstash is not used in Eval Mode or Import Mode. Otherwise, logs from these inputs end up in a filebeat-prefixed index.
2022-07-11 17:22:09 -04:00
764e8688b1
Modify Kratos input to use dedicated index and add filestream ID for all applicable inputs
2022-07-08 15:53:55 +00:00
85f790b28a
Change type from 'log' to 'filestream' to ensure compatibility with Elastic 8
2022-06-27 10:39:58 -04:00
adeccd0e7f
Merge pull request #8097 from Security-Onion-Solutions/dev
...
Merge latest dev into foxtrot
2022-06-08 15:01:09 -04:00
e5c9b91529
Merge pull request #8054 from Security-Onion-Solutions/dmz_receiver
...
Dmz receiver
2022-06-01 15:31:42 -04:00
44622350ea
Add ID for RITA filestream inputs
2022-05-25 10:09:01 -04:00
d8abc0a195
if in dmz_nodes dont add to filebeta
2022-05-11 11:51:18 -04:00
8e368bdebe
Merge in upstream dev
2022-05-06 20:01:07 -04:00
fbc86f43ec
Add exclude filter for logs for when there are no results from analysis
2022-03-24 13:03:03 -04:00
8a56c88773
Adjust log file paths
2022-03-22 17:51:17 +00:00
57f01c70ec
Remove extra forward slash in log path
2022-03-22 17:45:23 +00:00
f613d8ad86
Add RITA Logstash config
2022-03-22 17:36:18 +00:00
bb9d6673ec
Fix casing
2022-03-21 12:38:50 -04:00
9afa949623
Don't rotate Filebeat log on startup
2022-03-21 12:38:12 -04:00
1a6ef0cc6b
Re-enable FB module load
2022-03-19 03:55:40 +00:00
2e7d314650
Remove Cyberark module
2022-03-19 03:43:55 +00:00
c97847f0e2
Remove Threat Intel Recored Future fileset
2022-03-19 03:43:34 +00:00
59a2ac38f5
Disable FB module load for now
2022-03-18 22:12:09 +00:00
5ec5b9a2ee
Remove older module config files
2022-03-18 10:14:13 -04:00
712a92aa39
Switch from log input to filestream input
2022-03-17 21:18:03 -04:00
6e2aaa0098
Clean up original map file
2022-03-17 21:08:57 +00:00
09892a815b
Add back bind mounts and remove THIRDPARTY
2022-03-17 21:06:07 +00:00
a60ef33930
Reorganize FB module management
2022-03-17 21:01:03 +00:00
d76facb1bb
add extra hosts for idh node
2022-02-25 12:21:43 -05:00
df9fc807a3
IDH - restart scripts, filebeat fix
2022-02-22 08:05:53 -05:00
3610b0cd30
merge in dev
2022-02-21 16:52:53 -05:00
m0duspwnens
Doug Burks
weslambert
Mike Reeves
Jason Ertel
Josh Brower