9ac05a6ad1
Merge pull request #15895 from Security-Onion-Solutions/reyesj2/agentinstall
...
use -verify flag during grid agent install to ensure agent health
2026-05-15 12:58:09 -05:00
24ee3318bc
Merge pull request #15898 from Security-Onion-Solutions/jertel/logcheck
...
exclude fps
2026-05-15 11:38:20 -04:00
ce566ba174
exclude fps
2026-05-15 11:36:46 -04:00
2635a60a8c
Merge pull request #15896 from Security-Onion-Solutions/quickfixes2
...
Make so-postgres-backup fail-safe against silent corruption
2026-05-15 09:32:15 -04:00
244a73b7a2
Make so-postgres-backup fail-safe against silent corruption
...
The dump pipeline returned gzip's exit status, so a pg_dumpall that
died mid-stream still produced a valid .gz holding a truncated dump,
written straight to the final filename. The idempotency check then
blocked retries for the day and the corrupt file counted toward
retention, evicting a good backup each day until none remained.
- set -o pipefail so a failed pg_dumpall fails the pipeline
- dump to a .tmp file and atomically rename only after success, so
the final filename appears only for a complete backup
- gzip -t integrity check before publishing
- trap-based cleanup of the temp file; sweep stale temps at startup
- run retention only after a successful backup, with a glob
restricted to finished backups
- log timestamped OK/ERROR outcomes to /opt/so/log/postgres/backup.log
2026-05-15 08:48:54 -04:00
1189621ec5
Merge pull request #15893 from Security-Onion-Solutions/quickfixes2
2026-05-14 18:21:30 -04:00
d2524a593f
use -verify flag during grid agent install to ensure agent health
2026-05-14 17:12:02 -05:00
f2ab2354fd
Merge pull request #15894 from Security-Onion-Solutions/3/nginx-fix
...
Tweak for nginx upgrade
2026-05-14 23:20:57 +02:00
64731c73ba
Fix psql :var substitution in telegraf role and retention SQL
...
psql does not substitute :var references inside dollar-quoted strings,
so the DO blocks in the user and retention subcommands were receiving
literal colons and failing (silently for user, via hide_output: True).
Rewrite the conditional CREATE/ALTER ROLE with SELECT format(...) \\gexec
and guard the retention UPDATE with \\gset + \\if.
2026-05-14 17:17:49 -04:00
024fece607
Tweak for nginx upgrade
2026-05-14 17:08:57 -04:00
249b126312
Quote telegraf role env vars to survive YAML-special chars in passwords
2026-05-14 17:08:51 -04:00
8e38bff0c3
Rename telegraf_postgres.sh to so-telegraf-postgres
2026-05-14 16:55:53 -04:00
b9f2d56932
Consolidate telegraf postgres SQL into multi-mode script
...
Replace inline psql heredocs in telegraf_users.sls with subcommand
dispatcher telegraf_postgres.sh: create_db, group_role, user, retention.
2026-05-14 16:37:08 -04:00
03fa01a705
Move telegraf_role.sh to postgres tools/sbin
2026-05-14 16:18:01 -04:00
450eacca41
Move telegraf role provisioning to external script with env vars
2026-05-14 16:15:54 -04:00
b7a13899f7
Suppress output logging for postgres telegraf role provisioning
2026-05-14 15:56:04 -04:00
6f273d7d97
Rename init-users.sh to init-db.sh and update all references
2026-05-14 15:53:00 -04:00
b328820c01
Merge pull request #15792 from Security-Onion-Solutions/3/strelkalnk
...
Fix module name
2026-05-14 13:06:26 +02:00
638aca97c8
Merge pull request #15877 from Security-Onion-Solutions/reyesj2-patch-1
...
update redis index template
2026-05-13 13:44:04 -05:00
74a5c895e8
Merge pull request #15889 from Security-Onion-Solutions/reyesj2/zeek-ja4d
...
add zeek.ja4d ingest pipeline
2026-05-13 13:43:56 -05:00
d56bf01823
add zeek.ja4d ingest pipeline
2026-05-13 12:32:54 -05:00
d29267d9c2
Merge pull request #15888 from Security-Onion-Solutions/TOoSmOotH-patch-1
...
Change Telegraf output from BOTH to INFLUXDB
2026-05-13 12:47:55 -04:00
72327285b2
Change Telegraf output from BOTH to INFLUXDB
2026-05-13 11:58:21 -04:00
cc7a237457
Merge pull request #15887 from Security-Onion-Solutions/m0duspwnens-patch-1
...
remove stig from hypervisor and managerhype
2026-05-13 10:57:58 -04:00
b068ad2b35
remove stig from hypervisor and managerhype
2026-05-13 10:53:11 -04:00
b103f412b5
Merge pull request #15884 from Security-Onion-Solutions/reyesj2/strelkalnk
...
rename strelka ScanLNK - ScanLnk
2026-05-13 09:46:52 -05:00
ef79c63858
Merge branch '3/dev' of github.com:Security-Onion-Solutions/securityonion into reyesj2/strelkalnk
2026-05-12 15:20:09 -05:00
01fb1aa156
check pillars for ScanLNK and rename to ScanLnk
2026-05-12 15:19:44 -05:00
f19bdd7aae
Merge pull request #15883 from Security-Onion-Solutions/reyesj2/transformhealth
...
use temp files to prevent jq arg too long
2026-05-12 15:36:12 -04:00
f637dc62d1
use temp files to prevent jq arg too long
2026-05-12 13:29:32 -05:00
081f6fa1fb
Merge pull request #15878 from Security-Onion-Solutions/reyesj2/es-ingest-lag
...
add ingest latency metrics
2026-05-12 10:21:04 -05:00
d6d90d84cd
Merge pull request #15880 from Security-Onion-Solutions/feature/import-overrides
...
Initial commit
2026-05-12 17:00:44 +02:00
125610ed42
Additional test coverage
2026-05-12 10:11:22 -04:00
306b0af4d0
Initial commit
2026-05-12 09:55:06 -04:00
492ae80da7
add ingest latency metrics
2026-05-11 16:51:38 -05:00
4a2177c827
update redis index template
...
missing redis integration component templates
2026-05-11 16:15:56 -05:00
006ac31109
Merge pull request #15579 from marcopedrinazzi/3/dev
...
New Sigma rules pipeline mapping for M365 and Fortigate
2026-05-11 21:03:53 +02:00
49a643fff4
Merge pull request #15875 from Security-Onion-Solutions/3/sigma-fp-os
...
proc_creation per OS type
2026-05-08 15:13:14 +02:00
e1d830da76
proc_creation per OS type
2026-05-08 09:11:24 -04:00
e847c46129
Merge pull request #15872 from Security-Onion-Solutions/3/soc-logs
...
cleanup status code
2026-05-07 19:01:24 +02:00
499f7102bd
cleanup status code
2026-05-07 11:27:49 -04:00
4bc19f91ce
Merge pull request #15867 from Security-Onion-Solutions/fixhype
...
sanitize minion ids for hypervisor reactors / orchestration
2026-05-06 09:46:01 -04:00
4990d0ddea
Merge pull request #15866 from Security-Onion-Solutions/management-bond1
...
Management bond1
2026-05-05 17:17:58 -04:00
3e49322220
Allow preconfigured management bond in requirements
2026-05-05 15:35:12 -04:00
ecb92d43fc
Limit management bond setup to ISO installs
2026-05-05 15:30:09 -04:00
3b714db0bf
Show management bond option consistently
2026-05-05 15:22:40 -04:00
f17da4e68b
Add management bond setup option
2026-05-05 15:13:24 -04:00
04cfc22e3f
Merge pull request #15864 from Security-Onion-Solutions/reyesj2/patch-2
...
update grok type conversion to convert processor
2026-05-05 13:58:39 -05:00
dceed421ae
update grok type conversion to convert processor
2026-05-05 13:41:00 -05:00
652ac5d61f
fix regex
2026-05-05 14:26:04 -04:00
Jorge Reyes
Jason Ertel
Jason Ertel
Mike Reeves
Mike Reeves
Josh Brower
Josh Patterson
Doug Burks