b7bc8db3b2
Modify PCAP quick action to work off of network community ID; Add new Correlate quick action
2020-12-01 17:37:44 -05:00
81b86bf7f2
Switch PCAP quick actions to support alternative lookup link when a single event ID is not available
2020-12-01 16:04:50 -05:00
ff6951cd95
Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion into issue/2079
2020-12-01 15:38:15 -05:00
141d7a35c9
if true cluster enabled allow search nodes to talk to each other https://github.com/Security-Onion-Solutions/securityonion/issues/2079
2020-12-01 15:38:09 -05:00
9517cb2a58
Remove ScanMmbot
2020-12-01 11:25:51 -05:00
c303cdff09
Merge pull request #2150 from Security-Onion-Solutions/bugfix/fleet-standalone
...
Fleet Fixes - mysql race condition
2020-11-30 18:06:30 -05:00
e7a927188b
Fleet Fixes - mysql race condition
2020-11-30 17:28:11 -05:00
8e9458ca84
Merge pull request #2149 from Security-Onion-Solutions/bugfix/fleet-standalone
...
Fix Fleet setup errors
2020-11-30 12:06:36 -05:00
5d2acf4011
Fix Fleet setup errors
2020-11-30 12:06:02 -05:00
8964444eeb
[fix] Correct count print in mysql_conn
2020-11-30 11:32:43 -05:00
ec81e8565f
[fix] Add safety logic to retry var in mysql_conn
2020-11-30 11:32:28 -05:00
040b435278
[refactor] Fail mysql_conn if the mainint has > 1 ip address
2020-11-30 11:10:50 -05:00
65d8005629
Fleet standalone - fix event
2020-11-30 10:32:39 -05:00
19b36f0468
Fleet standalone redirect fix
2020-11-27 11:43:51 -05:00
38afd67108
Fleet standalone fix
2020-11-25 14:08:30 -05:00
979f171828
Add missing comma to sensoroni.json
2020-11-25 12:29:45 -05:00
8f9081618f
Add role to sensoroni.json file
2020-11-25 11:11:46 -05:00
7fb264b4fe
Use double quotes around agent key to ensure interpolation
2020-11-24 17:17:50 -05:00
d20560385f
Remove /nsm/wazuh/etc subdir state since confirmed the Wazuh docker container itself
2020-11-24 16:50:46 -05:00
e1147398cc
Ensure /nsm/wazuh is owned by ossec
2020-11-24 15:48:46 -05:00
ea9bbfd1aa
Improve wazuh agent registration with retry logic to wait for manager to become ready
2020-11-24 13:53:20 -05:00
0c4ee94472
Merge pull request #2077 from Security-Onion-Solutions/fix/thehive_upgrade_conf
...
Fix/thehive upgrade conf
2020-11-24 11:52:51 -05:00
39bf60feb7
Add digit
2020-11-24 11:52:20 -05:00
35653d2e66
Changes for ES7
2020-11-24 11:51:19 -05:00
eb2364b926
Changes for ES7
2020-11-24 11:49:08 -05:00
9bb485cdc9
Merge pull request #2074 from Security-Onion-Solutions/issue/2040
...
Issue/2040
2020-11-24 11:45:08 -05:00
995a377432
squigly comma if steno enabled https://github.com/Security-Onion-Solutions/securityonion/issues/2040
2020-11-24 11:31:41 -05:00
e3a41c2a94
Changes for ES7 elasticsearch.yml
2020-11-24 11:20:09 -05:00
ddca9563e5
Merge branch 'mkrmerge' into escluster
2020-11-24 10:29:57 -05:00
e2ee0db727
Ignore failure for rename processor
...
Ignore failure for winlog.event_data.SubjectUserName rename processor.
For some event ids (for example 4688), this field already been added in winlogbeat JS processor.
Therefor, elastic throw [user.name] already exists error.
2020-11-24 17:21:47 +02:00
4dfd49ef39
add vars https://github.com/Security-Onion-Solutions/securityonion/issues/2040
2020-11-24 10:11:28 -05:00
65334d15ea
https://github.com/Security-Onion-Solutions/securityonion/issues/2040
2020-11-24 09:33:38 -05:00
1e32a01657
Create symlink before registration otherwise registration script can't save it's state (.log) file into the conf subdir; add more logging output to track down registration failures
2020-11-23 18:36:19 -05:00
bafefb980b
Update so-elastalert-test script for compatibility with SO 2.3
2020-11-23 10:45:56 -05:00
426769588a
Merge pull request #1739 from jtgreen-cse/patch-2
...
fix for Windows events via osquery
2020-11-21 13:27:05 -05:00
a183be489c
Merge pull request #2030 from Security-Onion-Solutions/master
...
Merge master to dev
2020-11-20 17:00:31 -05:00
78f5727f6f
Improve so-ip-update prompts
2020-11-20 15:16:07 -05:00
0d3754200f
fix issue with proper salt.minion state execution for ubuntu
2020-11-20 14:27:07 -05:00
bc40a2bfc5
Correct so-import-pcap wrapping; add so-pcap-import alias for so-import-pcap; prompt to reboot after changing IP address on manager; ensure all tools have exec bit set
2020-11-20 14:14:03 -05:00
f074179656
Correct so-import-pcap wrapping; add so-pcap-import alias for so-import-pcap; prompt to reboot after changing IP address on manager; ensure all tools have exec bit set
2020-11-20 14:14:03 -05:00
2e6be747d9
[fix] Fixes for quiet flag in so-ssh-harden
2020-11-20 11:18:40 -05:00
1a11c24f03
[fix] Add newline escapes to so-ssh-harden
2020-11-20 11:13:40 -05:00
9d837f7b45
[fix] Reload sshd if config changes are made
...
Fixes #1976
2020-11-20 10:09:14 -05:00
316a1c02f1
Update soup to display what its doing
2020-11-19 15:19:50 -05:00
cdc7a5cc7c
kill salt process with soup and dont restart salt-minion service when salt upgrade
2020-11-19 15:17:11 -05:00
2a3951ab36
change typo on minon to minion
2020-11-19 15:08:08 -05:00
3be1c9ae32
Clean up 2.3.1 dockers
2020-11-19 09:58:08 -05:00
d3065005ca
playbook mysqluser
2020-11-18 20:48:02 -05:00
d68726f6ef
upgrade from salt 3002.1 to salt 3002.2
2020-11-18 18:25:02 -05:00
f81da406da
Merge pull request #1983 from Security-Onion-Solutions/soup-verify-salt
...
dont highstate, just restart salt-minion
2020-11-18 17:40:36 -05:00
Jason Ertel
m0duspwnens
weslambert
Josh Brower
William Wernert
Mike Reeves
OmerTirosh
Mike Reeves