132 Commits

Author	SHA1	Message	Date
Wes Lambert	206261fbe6	rename id to log.id.fuid for X509	2020-06-15 16:55:14 +00:00
Wes Lambert	18547e8ea8	enforce field types	2020-06-15 16:54:33 +00:00
Mike Reeves	6058d438bf	Fix Protocol	2020-06-12 12:28:29 -04:00
Mike Reeves	42938a4e67	Add the makor Suricata parsers	2020-06-12 12:14:48 -04:00
Mike Reeves	c0d24d942c	Merge remote-tracking branch 'remotes/origin/dev' into feature/metasuri	2020-06-09 13:31:31 -04:00
Mike Reeves	4b6af0cd81	Suricata DHCP	2020-06-08 08:58:35 -04:00
Josh Brower	4e4eeedb41	Initial support - external beats	2020-06-04 22:41:35 -04:00
Mike Reeves	33712a3409	Suricata HTTP parser	2020-06-04 16:19:22 -04:00
Mike Reeves	5c62fedd12	Suricata DNS parser	2020-06-04 15:42:51 -04:00
Mike Reeves	7043bbae9d	Merge remote-tracking branch 'remotes/origin/dev' into feature/metasuri	2020-06-04 09:10:54 -04:00
TOoSmOotH	702a14e90c	DNS Suricata parser	2020-06-03 20:40:10 -04:00
Mike Reeves	3211a8a5e0	SMTP from fix	2020-06-03 11:52:24 -04:00
Mike Reeves	c5d6381933	SMTP for suricata	2020-06-03 11:16:43 -04:00
Mike Reeves	126d1598ee	SNMP for suricata	2020-06-03 11:03:23 -04:00
weslambert	c91bc0e681	Clean up some stuff	2020-06-02 15:31:48 -04:00
Mike Reeves	25aae21cf6	Trying to get decoded packet	2020-06-02 15:06:39 -04:00
Mike Reeves	b507b87871	Trying to get decoded packet	2020-06-02 14:49:07 -04:00
Mike Reeves	fb68506418	Add mor suricata ingest parser types	2020-06-02 14:42:15 -04:00
Mike Reeves	3096d8d988	Add mor suricata ingest parser types	2020-06-02 14:34:38 -04:00
Mike Reeves	0ea2252b5b	Add Suricata Flow pipeline	2020-06-02 13:40:46 -04:00
Mike Reeves	617f60d472	Fix Syntax	2020-06-02 12:01:26 -04:00
Mike Reeves	e63f39a9c4	Rename dataset	2020-06-02 11:58:14 -04:00
Mike Reeves	d47acd1d80	Change suricata to hit suricata.common	2020-06-02 11:41:13 -04:00
Wes Lambert	51f5d64ef6	Rename tunnel_parents	2020-06-01 13:51:32 +00:00
Wes Lambert	d7ce3d4719	fix naming of uid field for tunnel	2020-06-01 12:52:57 +00:00
Wes Lambert	4059121dd6	fix framed_addr field	2020-05-29 11:55:18 +00:00
Wes Lambert	d2b93d531e	Basic syslog config	2020-05-28 12:36:29 +00:00
Josh Brower	8723f8785e	osquery pipeline fix and fail state if errors	2020-05-26 13:05:56 -04:00
Wes Lambert	0e51ab41cf	Update ES watermark settings	2020-05-26 14:18:58 +00:00
Josh Brower	56f5fbdf6b	Ingest pipeline commid fix for conn logs	2020-05-22 17:11:08 -04:00
Josh Brower	bff86ea802	zeek.common ingest parser fix	2020-05-21 14:35:25 -04:00
Josh Brower	c74ace89ba	Initial support - Ingest community_id	2020-05-21 14:34:00 -04:00
Doug Burks	29420da565	Only process zeek.dns.tld if dns.query.name contains a dot #734 ... https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/734	2020-05-19 10:08:30 -04:00
Doug Burks	9cc750a90f	fix dns tld failures	2020-05-18 08:32:37 -04:00
Mike Reeves	329a030585	Merge remote-tracking branch 'remotes/origin/dev' into issue/140	2020-05-17 09:38:30 -04:00
Wes Lambert	4b91ade2e8	fix message_types one more time :)	2020-05-16 15:03:27 +00:00
Wes Lambert	9845ee189c	fix message_types for real	2020-05-16 15:02:41 +00:00
Wes Lambert	6a2ddd4ef6	move to DNS	2020-05-16 14:58:51 +00:00
Wes Lambert	66c89abbc6	Fix DHCP message types	2020-05-16 14:58:06 +00:00
m0duspwnens	6c7f487a3e	Merge remote-tracking branch 'remotes/origin/dev' into issue/140	2020-05-15 19:43:18 -04:00
Doug Burks	cc7a244d0b	Create zeek.dns.tld ... https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/599	2020-05-15 15:32:25 -04:00
Doug Burks	60d2a0818b	Add to zeek.dns and have it send to zeek.dns.tld ... https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/599	2020-05-15 15:31:17 -04:00
m0duspwnens	4e63477b98	Merge remote-tracking branch 'remotes/origin/dev' into issue/140	2020-05-15 15:21:03 -04:00
Josh Brower	e02bf2ebb5	Merge branch 'dev' of https://github.com/Security-Onion-Solutions/securityonion-saltstack into dev	2020-05-15 15:05:47 -04:00
Josh Brower	9d4536dcbe	osquery ingest parsing update	2020-05-15 15:05:21 -04:00
Doug Burks	fc883745e5	add fields to conn log ... https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/599	2020-05-15 15:02:02 -04:00
Doug Burks	58d59c6844	use null safe operator for source.port and destination.port ... https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/594	2020-05-15 14:58:21 -04:00
Wes Lambert	03805bd6e2	remove type field	2020-05-15 18:29:49 +00:00
Wes Lambert	5d5f5cf105	update DCE/RPC parsing	2020-05-15 18:19:05 +00:00
m0duspwnens	f4db261baf	change elif - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/140	2020-05-15 10:57:25 -04:00