CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-25 05:57:49 +02:00
Code Issues Packages Projects Releases Wiki Activity
10,119 Commits 40 Branches 125 Tags
99864f478766aaf63c461ea31bb6834f4f660ea3
Commit Graph

6020 Commits

Author SHA1 Message Date
weslambert d9c3160fbf Merge pull request #7465 from Security-Onion-Solutions/fix/kibana_saved_objects_load 
Kibana dashboard/saved objects loading improvements
 2022-03-08 12:22:55 -05:00
Wes Lambert d392cb258c Switch Kibana state to kibana.so_savedobjects_defaults in top file 2022-03-08 16:59:48 +00:00
Wes Lambert 86e228b200 Add .template extension for future-proofing config files 2022-03-08 16:58:37 +00:00
Wes Lambert a6fd1023b4 Fix criteria for successful execution 2022-03-08 16:57:26 +00:00
Wes Lambert 3f31f7fd41 Add .template extension to fix script behavior and not modify watched file 2022-03-08 16:43:43 +00:00
Jason Ertel 0cec5879bb Gracefully handle situations when another process is using the Kratos DB 2022-03-08 10:55:26 -05:00
Wes Lambert 28554164cd Remove drop file when securitySolution saved objects change 2022-03-08 14:39:23 +00:00
Wes Lambert 14dddd8649 Remove drop file when config saved objects change 2022-03-08 14:37:15 +00:00
Wes Lambert c0f49f6fb0 Remove drop file when dashbaord saved objects change 2022-03-08 14:35:04 +00:00
Wes Lambert d10d4acf9f Modify Kibana config load script to drop file if successfully executed 2022-03-08 14:33:15 +00:00
Doug Burks 104de2a3c9 Update init.sls to avoid telegraf apparmor issues 
See #2560
 2022-03-07 16:11:22 -05:00
Mike Reeves fb59421f5b Merge pull request #7446 from Security-Onion-Solutions/fixpipelineload 
Only load pipelines on change
 2022-03-07 15:17:32 -05:00
Mike Reeves 4eb37fd5a9 Update init.sls 2022-03-07 15:09:36 -05:00
Wes Lambert fa9be58b23 Specify index templates 2022-03-07 20:04:23 +00:00
Wes Lambert 647b316a96 Remove old ES index templates 
Signed-off-by: Wes Lambert <wlambertts@gmail.com>
 2022-03-07 20:02:45 +00:00
Mike Reeves d33db6fb23 Only load pipelines on change 2022-03-07 14:25:46 -05:00
Wes Lambert c549b20221 Add DTC client mappings 2022-03-07 18:36:26 +00:00
Mike Reeves c67604590d Only load templates on change 2022-03-07 09:52:18 -05:00
Wes Lambert 33ba45472f Replace syslog facility and severity with label fields 2022-03-04 21:40:41 +00:00
weslambert f71ccadb8a Change to label fields for Zeek syslog 2022-03-04 16:29:55 -05:00
weslambert fc3273fa49 Change to label fields to comply with what's defined in Filebeat template 2022-03-04 16:29:01 -05:00
weslambert 254cf53c2f Increase clause count to 3500 2022-03-04 10:36:37 -05:00
Wes Lambert ffae22beef Add DTC syslog mappings for .keyword and add refs to defaults.yml 2022-03-04 13:04:11 +00:00
Wes Lambert 1f71816ad7 Add keyword subfield for DTC winlog mappings 2022-03-03 14:54:30 +00:00
Wes Lambert 1c086e36da Add missing comma for file mappings 2022-03-03 13:49:54 +00:00
Wes Lambert aa8d24b6cd Add DTC destination, source, and winlog mapping references to templates in defaults file 2022-03-03 13:42:20 +00:00
Wes Lambert 85979cbce8 Add file, process, and winlog mapping changes 2022-03-03 13:37:27 +00:00
Wes Lambert 8f97f09c9c Additional .keyword changes for host.hostname client.address, and event.action 2022-03-02 21:54:46 +00:00
Wes Lambert 3ee46e4c29 Add .keyword for destination/source geo.country_name 2022-03-02 21:50:03 +00:00
Wes Lambert c5b16fdf3b Adjust field limit for now 2022-03-02 16:33:39 +00:00
Josh Brower 2ba72791aa Remove sigma regen cron 2022-03-02 10:31:15 -05:00
Wes Lambert ab9b81ea39 Change match_only_text to text for mac in host mappings 2022-03-02 15:01:05 +00:00
Wes Lambert ed620b93b7 Add custom analyzer definition to all SO/DTC mappings 2022-03-02 14:43:19 +00:00
Wes Lambert 27c8eaa630 Update all other mappings for .security where applicable 2022-03-02 14:39:23 +00:00
Wes Lambert e925d435ff Update event, file, and host mappings to include .security 2022-03-02 14:33:52 +00:00
Wes Lambert 496b161253 Update ECS mappings to include .security 2022-03-02 14:27:36 +00:00
Wes Lambert aae2fd1fbb Update DNS mappings to include .security 2022-03-02 14:27:15 +00:00
Wes Lambert 0b45cf7ae1 Update base mappings to include .security 2022-03-02 14:25:57 +00:00
Wes Lambert d89af5f04f Update agent mappings to include .security 2022-03-02 14:25:14 +00:00
Wes Lambert 2d2ec45029 Modify base ECS mappings to include .security where possible, as well as custom analyzer definition 2022-03-02 14:19:36 +00:00
Wes Lambert 5489b8559d Revert "Switch from .security to match_only_text" 
This reverts commit f7862af934.
 2022-03-01 18:44:00 +00:00
Wes Lambert 2a9caccc7c Revert "Add additional .text subfield mappings" 
This reverts commit 61dadc6249.
 2022-03-01 18:43:24 +00:00
Wes Lambert a290602a70 Revert syslog pipeline updates from Abe' PR for now 2022-03-01 15:31:07 +00:00
Wes Lambert 038dc49098 Temporarily increase field limit before trimming efforts 2022-03-01 15:06:28 +00:00
Wes Lambert dc07adca63 Rename ingest.timestamp to event.ingested 2022-03-01 15:05:08 +00:00
Josh Brower e960d99901 Enable state tracking for sigma refresh 2022-02-28 21:18:41 -05:00
Josh Brower 09f1a5025d Merge remote-tracking branch 'remotes/origin/dev' into delta 2022-02-28 21:18:07 -05:00
Josh Brower 41a58b791a Enable state tracking for sigma refresh 2022-02-28 21:17:59 -05:00
Jason Ertel f147bb33ed Upgrade to ES 7.17.1 2022-02-28 18:18:09 -05:00
Josh Patterson 6b3b5e9a1f Merge pull request #7363 from Security-Onion-Solutions/soup_singlenode_30 
allow for check_log_size_limit to work without salt-master running
 2022-02-28 17:13:42 -05:00