Jason Ertel
45fd07cdf8
Merge pull request #12987 from Security-Onion-Solutions/jertel/testcy
...
Add quick action to find related alerts for a detection
2024-05-09 18:08:08 -04:00
Jason Ertel
fecd674fdb
Add quick action to find related alerts for a detection
2024-05-09 17:55:41 -04:00
Mike Reeves
ad9fdf064b
Update config.sls
2024-05-08 15:24:29 -04:00
Corey Ogburn
1da88b70ac
Specify Error Retry Wait and Error Limit for All Detection Engines
...
If a sync errors out, the engine will wait `communityRulesImportErrorSeconds` seconds instead of the usual `communityRulesImportFrequencySeconds` seconds wait.
If `failAfterConsecutiveErrorCount` errors happen in a row when syncing detections to ElasticSearch then the sync is considered a failure and will give up and try again later. This assumes ElasticSearch is the source of the errors and backs of in hopes it'll be able to fix itself.
2024-05-07 10:34:50 -06:00
Jason Ertel
b4817fa062
Merge pull request #12956 from Security-Onion-Solutions/jertel/testcy
...
test regexes for detections
2024-05-07 08:45:38 -07:00
Jason Ertel
4ebe070cd8
test regexes for detections
2024-05-06 19:03:12 -04:00
Josh Brower
b997e44715
Merge pull request #12939 from Security-Onion-Solutions/2.4/detections-airgap
...
Initial airgap support for detections
2024-05-06 15:46:29 -04:00
m0duspwnens
2431d7b028
Merge branch '2.4/detections-airgap' of https://github.com/Security-Onion-Solutions/securityonion into 2.4/detections-airgap
2024-05-06 15:27:27 -04:00
m0duspwnens
554a203541
update airgapEnabled in map file
2024-05-06 12:59:45 -04:00
DefensiveDepth
be1758aea7
Fix license and folder
2024-05-06 12:22:44 -04:00
m0duspwnens
38f74d2e9e
change quotes
2024-05-06 11:38:30 -04:00
m0duspwnens
5b966b83a9
change rulesRepos for airgap or not
2024-05-06 09:26:52 -04:00
Doug Burks
3f73b14a6a
FEATURE: Add event.dataset to all Events table layouts #12641
2024-05-06 09:20:47 -04:00
Doug Burks
f689cfcd0a
FEATURE: Add Events table columns for stun logs #12940
2024-05-06 08:52:43 -04:00
DefensiveDepth
26c6a98b45
Initial airgap support for detections
2024-05-06 08:43:01 -04:00
Doug Burks
7b905f5a94
FEATURE: Add Events table columns for tunnel logs #12937
2024-05-06 08:22:08 -04:00
Doug Burks
0822a46e94
FIX: Improve File dashboard #12914
2024-05-02 10:42:34 -04:00
Doug Burks
1be3e6204d
FIX: Improve File dashboard #12914
2024-05-02 10:38:56 -04:00
Josh Patterson
72b2503b49
Merge pull request #12906 from Security-Onion-Solutions/det_easr
...
Apply autoEnabledSigmaRules based on role if defined and default if not
2024-05-01 13:05:36 -04:00
m0duspwnens
47ba4c0f57
add new annotation for soc autoEnabledSigmaRules
2024-05-01 12:55:29 -04:00
Mike Reeves
10c8e4203c
Update config.sls
2024-05-01 12:54:21 -04:00
m0duspwnens
7122709bbf
set Sigma rules based on role if defined and default if not
2024-05-01 12:25:34 -04:00
Mike Reeves
f7223f132a
Update config.sls
2024-05-01 12:00:39 -04:00
Mike Reeves
8cd75902f2
Update config.sls
2024-05-01 11:47:51 -04:00
Corey Ogburn
ddf662bdb4
Mark Repos as Community
...
Indicate that detection rules pulled from configured repos should be marked as Community rules.
2024-04-29 16:22:30 -06:00
DefensiveDepth
f2c3c928fc
Sigma pivot fix and cleanup
2024-04-29 08:49:05 -04:00
DefensiveDepth
3c3ed8b5c5
Add runtime status logs
2024-04-24 16:33:47 -04:00
Jorge Reyes
d402943403
Merge pull request #12773 from Security-Onion-Solutions/reyesj2/kismet
...
Kismet integration for WiFi devices
2024-04-22 15:59:22 -04:00
DefensiveDepth
a237ef5d96
Update default queries
2024-04-19 16:33:35 -04:00
DefensiveDepth
ff28476191
Fix compile_yara path
2024-04-16 13:10:17 -04:00
DefensiveDepth
8cc4d2668e
Move compile_yara
2024-04-16 12:52:14 -04:00
DefensiveDepth
dbfb178556
Add test
2024-04-16 12:22:53 -04:00
DefensiveDepth
f5e42e73af
Add docs for ruleset change
2024-04-12 13:30:20 -04:00
DefensiveDepth
49ccd86c39
Fix fingerprint paths
2024-04-12 08:35:44 -04:00
reyesj2
55cf90f477
merge 2.4/dev
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:44:59 -04:00
reyesj2
c269fb90ac
Added a Kismet Wifi devices dashboard for an overview of kismet data
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:41:54 -04:00
DefensiveDepth
1c5f02ade2
Update annotations
2024-04-11 09:21:08 -04:00
DefensiveDepth
ed97aa4e78
Enable Detections Adv by default
2024-04-11 08:21:20 -04:00
DefensiveDepth
376efab40c
Ship Defender logs
2024-04-08 14:01:38 -04:00
Josh Brower
8e38c3763e
Merge pull request #12756 from Security-Onion-Solutions/2.4/detections-defaults
...
Use list not string
2024-04-04 17:00:38 -04:00
DefensiveDepth
ca807bd6bd
Use list not string
2024-04-04 16:58:39 -04:00
Josh Brower
f72cbd5f23
Merge pull request #12755 from Security-Onion-Solutions/2.4/detections-defaults
...
2.4/detections defaults
2024-04-04 11:33:59 -04:00
DefensiveDepth
49d5fa95a2
Detections tweaks
2024-04-04 11:26:44 -04:00
Doug Burks
d8ac3f1292
FEATURE: Add dashboards specific to Elastic Agent #12746
2024-04-04 09:30:05 -04:00
Doug Burks
5ec3b834fb
FEATURE: Add Events table columns for event.module sigma #12743
2024-04-04 09:11:41 -04:00
Jason Ertel
a7fab380b4
clarify telemetry annotation
2024-04-04 07:51:23 -04:00
Jason Ertel
a9517e1291
clarify telemetry annotation
2024-04-04 07:49:30 -04:00
DefensiveDepth
f66cca96ce
YARA casing
2024-04-03 16:17:29 -04:00
Corey Ogburn
0f50a265cf
Update SOC Config with State File Paths
...
Each detection engine is getting a state file to help manage the timer over restarts. By default, the files will go in soc's config folder inside a fingerprints folder.
2024-04-03 13:12:18 -06:00
Jason Ertel
3e05c04aa1
Merge pull request #12731 from Security-Onion-Solutions/jertel/ana
...
SOC Telemetry
2024-04-03 14:51:41 -04:00
