  weslambertandGitHub
|
6dec9b4cf7
|
Merge pull request #12986 from Security-Onion-Solutions/fix/old_strelka
Remove old Strelka configuration for YARA
|
2024-05-14 09:27:19 -04:00 |
|
|
weslambertandGitHub
|
13062099b3
|
Remove YARA script update and reference to exclusions
|
2024-05-13 18:04:16 -04:00 |
|
|
weslambertandGitHub
|
7250fb1188
|
Merge pull request #13004 from Security-Onion-Solutions/fix/detections_alerts_indices
FIX: Detections alerts indices
|
2024-05-13 17:02:52 -04:00 |
|
|
weslambertandGitHub
|
d606f259d1
|
Add detection alerts
|
2024-05-13 14:25:11 -04:00 |
|
|
weslambertandGitHub
|
c8870eae65
|
Add detection alerts template
|
2024-05-13 14:23:47 -04:00 |
|
|
weslambertandGitHub
|
26b5a39912
|
Change index to detections.alerts
|
2024-05-13 12:59:17 -04:00 |
|
|
Wes
|
6ed82d7b29
|
Remove YARA download in setup
|
2024-05-09 17:27:46 +00:00 |
|
|
Wes
|
ea4cf42913
|
Remove old YARA update script
|
2024-05-09 17:26:54 +00:00 |
|
|
Wes
|
8a34f5621c
|
Remove old YARA download script
|
2024-05-09 17:26:45 +00:00 |
|
|
Wes
|
823ff7ce11
|
Remove exclusions and repos
|
2024-05-09 17:03:13 +00:00 |
|
|
weslambertandGitHub
|
cdc47cb1cd
|
Merge pull request #12975 from Security-Onion-Solutions/fix/strelka_watch
Use state
|
2024-05-08 16:39:49 -04:00 |
|
|
weslambertandGitHub
|
01a68568a6
|
Use state
|
2024-05-08 16:37:13 -04:00 |
|
|
weslambertandGitHub
|
b916465b06
|
Merge pull request #12974 from Security-Onion-Solutions/fix/strelka_yara
Account for 0 active rules and change watch
|
2024-05-08 15:59:20 -04:00 |
|
|
weslambertandGitHub
|
0567b93534
|
Remove mode
|
2024-05-08 15:39:59 -04:00 |
|
|
Wes
|
77e2117051
|
Account for 0 active rules and change watch
|
2024-05-08 18:47:52 +00:00 |
|
|
weslambertandGitHub
|
bc24227732
|
Merge pull request #12955 from Security-Onion-Solutions/fix/cef
Add CEF
|
2024-05-07 11:23:53 -04:00 |
|
|
weslambertandGitHub
|
2e70d157e2
|
Add ref
|
2024-05-07 11:13:51 -04:00 |
|
|
weslambertandGitHub
|
23da1f6ee9
|
Merge pull request #12951 from Security-Onion-Solutions/fix/remove_watch
Remove watch
|
2024-05-07 09:23:56 -04:00 |
|
|
Wes
|
bee8c2c1ce
|
Remove watch
|
2024-05-07 13:21:59 +00:00 |
|
|
weslambertandGitHub
|
a5e89c0854
|
Merge pull request #12947 from Security-Onion-Solutions/fix/strelka_yara_distributed
Fix YARA rules for distributed deployments
|
2024-05-06 15:53:08 -04:00 |
|
|
weslambertandGitHub
|
a25e43db8f
|
Merge pull request #12948 from Security-Onion-Solutions/fix/strelka_yara_watch
Restart Strelka backend when YARA rules change
|
2024-05-06 15:52:57 -04:00 |
|
|
Wes
|
1e48955376
|
Restart when rules change
|
2024-05-06 19:39:03 +00:00 |
|
|
Wes
|
5056ec526b
|
Add compiled directory
|
2024-05-06 19:27:38 +00:00 |
|
|
Wes
|
d2fa77ae10
|
Update compile script
|
2024-05-06 19:10:41 +00:00 |
|
|
Wes
|
445fb31634
|
Add manager SLS
|
2024-05-06 19:09:37 +00:00 |
|
|
Wes
|
5aa611302a
|
Handle YARA rules for distributed deployments
|
2024-05-06 19:08:01 +00:00 |
|
|
weslambertandGitHub
|
956ae7a7ae
|
Merge pull request #12909 from Security-Onion-Solutions/fix/detection_mappings
Update mappings for detection fields
|
2024-05-01 16:15:40 -04:00 |
|
|
Wes
|
3285ae9366
|
Update mappings for detection fields
|
2024-05-01 20:11:56 +00:00 |
|
|
weslambertandGitHub
|
e6f45161c1
|
Merge pull request #12900 from Security-Onion-Solutions/fix/cold_min_age
Cold min_age to 60d
|
2024-05-01 11:24:48 -04:00 |
|
|
weslambertandGitHub
|
fe2edeb2fb
|
30d to 60d
|
2024-05-01 11:01:59 -04:00 |
|
|
weslambertandGitHub
|
6294f751ee
|
Cold min_age to 60d
|
2024-05-01 10:59:41 -04:00 |
|
|
weslambertandGitHub
|
cc17de2184
|
Merge pull request #12864 from Security-Onion-Solutions/fix/exclude_suricata
Exclude suricata from disk space-based index deletion
|
2024-04-25 09:23:38 -04:00 |
|
|
weslambertandGitHub
|
b424426298
|
Exclude suricata
|
2024-04-25 09:14:18 -04:00 |
|
|
weslambertandGitHub
|
983ef362e9
|
Merge pull request #12858 from Security-Onion-Solutions/fix/index_sorting
Change index sorting to account for older so-prefixed indices
|
2024-04-25 08:54:22 -04:00 |
|
|
weslambertandGitHub
|
44afa55274
|
Fix comments about deletion
|
2024-04-24 17:41:37 -04:00 |
|
|
weslambertandGitHub
|
ab832e4bb2
|
Include logstash-prefixed indices
|
2024-04-24 17:17:53 -04:00 |
|
|
weslambertandGitHub
|
59a02635ed
|
Change index sorting
|
2024-04-24 15:18:49 -04:00 |
|
|
weslambertandGitHub
|
428fe787c4
|
Merge pull request #12852 from Security-Onion-Solutions/fix/elastic_max_age
Remove hot max_age
|
2024-04-24 10:15:06 -04:00 |
|
|
weslambertandGitHub
|
1b3a0a3de8
|
Remove hot max_age
|
2024-04-24 10:11:02 -04:00 |
|
|
weslambertandGitHub
|
96ec285241
|
Merge pull request #12848 from Security-Onion-Solutions/fix/elastic_annotation
Fix description, regex, and type for cold, warm, and hot
|
2024-04-24 09:22:05 -04:00 |
|
|
weslambertandGitHub
|
75b5e16696
|
Update description, type, and regex
|
2024-04-24 09:14:39 -04:00 |
|
|
weslambertandGitHub
|
8a0a435700
|
Fix warm description
|
2024-04-24 08:35:19 -04:00 |
|
|
weslambertandGitHub
|
bef408b944
|
Merge pull request #12844 from Security-Onion-Solutions/fix/elastic_annotation
Fix warm description
|
2024-04-23 10:47:04 -04:00 |
|
|
weslambertandGitHub
|
691b02a15e
|
Fix warm description
|
2024-04-23 10:40:09 -04:00 |
|
|
weslambertandGitHub
|
d96d696c35
|
Merge pull request #12735 from Security-Onion-Solutions/feature/cef
Add cef
|
2024-04-03 10:49:44 -04:00 |
|
|
Wes
|
105eadf111
|
Add cef
|
2024-04-03 14:40:41 +00:00 |
|
|
weslambertandGitHub
|
57553bc1e5
|
Merge pull request #12652 from Security-Onion-Solutions/feature/pfsense_suricata
FEATURE: pfSense Suricata logs
|
2024-03-25 10:10:13 -04:00 |
|
|
weslambertandGitHub
|
df058b3f4a
|
Merge branch '2.4/dev' into feature/pfsense_suricata
|
2024-03-25 10:08:03 -04:00 |
|
|
Wes
|
5e21da443f
|
Minor verbiage updates
|
2024-03-25 13:58:32 +00:00 |
|
|
weslambertandGitHub
|
e124791d5d
|
Merge pull request #12650 from Security-Onion-Solutions/fix/soc_template
FIX: http.response.status_code
|
2024-03-25 09:29:19 -04:00 |
|
|
weslambertandGitHub
|
4e1543b6a8
|
Get only code
|
2024-03-22 09:56:21 -04:00 |
|
|
Wes
|
5934829e0d
|
Include pfsense config
|
2024-03-21 20:08:33 +00:00 |
|
|
Wes
|
486a633dfe
|
Add pfsense Suricata config
|
2024-03-21 20:07:59 +00:00 |
|
|
weslambertandGitHub
|
77ac342786
|
Merge pull request #12632 from Security-Onion-Solutions/fix/remove_temp_yara
Remove temp YARA
|
2024-03-21 10:11:32 -04:00 |
|
|
weslambertandGitHub
|
8429a364dc
|
Remove Strelka rules watch
|
2024-03-21 10:09:36 -04:00 |
|
|
weslambertandGitHub
|
1568f57096
|
Remove Strelka config
|
2024-03-21 10:07:27 -04:00 |
|
|
weslambertandGitHub
|
f431e9ae08
|
Remove Strelka config
|
2024-03-21 10:06:25 -04:00 |
|
|
Wes
|
c6df805556
|
Add SOC template
|
2024-03-18 14:53:36 +00:00 |
|
|
weslambertandGitHub
|
34d5954e16
|
Fix indent
|
2024-03-11 09:12:05 -04:00 |
|
|
Wes
|
e8ae609012
|
Add Strelka rules watch back
|
2024-03-08 16:27:17 +00:00 |
|
|
Wes
|
fc66a54902
|
Add Strelka download and update scripts back
|
2024-03-08 16:26:14 +00:00 |
|
|
Wes
|
4e32935991
|
Add Strelka config back
|
2024-03-08 16:24:37 +00:00 |
|
|
weslambertandGitHub
|
1633527695
|
Merge pull request #12519 from Security-Onion-Solutions/fix/error_message_system_syslog
Add error.message mapping for system.syslog
|
2024-03-07 10:47:33 -05:00 |
|
|
Wes
|
005930f7fd
|
Add error.message mapping for system.syslog
|
2024-03-07 15:41:23 +00:00 |
|
|
weslambertandGitHub
|
185a160df0
|
Merge pull request #12500 from Security-Onion-Solutions/feature/additional_integrations_5
Additional Integrations #5
|
2024-03-05 16:12:05 -05:00 |
|
|
weslambertandGitHub
|
b9ebe6c40b
|
Update VERSION
|
2024-03-05 12:58:34 -05:00 |
|
|
weslambertandGitHub
|
bed42208b1
|
Add journald integration
|
2024-03-05 09:49:55 -05:00 |
|
|
weslambertandGitHub
|
2a7e5b096f
|
Change version for foxtrot
|
2024-03-05 09:48:59 -05:00 |
|
|
weslambertandGitHub
|
d8e8933ea0
|
Add AWS Security Hub template
|
2024-03-05 09:25:41 -05:00 |
|
|
weslambertandGitHub
|
d85ac39e28
|
Add AWS Inspector template
|
2024-03-05 09:23:17 -05:00 |
|
|
weslambertandGitHub
|
1514f1291e
|
Add AWS GuardDuty template
|
2024-03-05 09:21:48 -05:00 |
|
|
weslambertandGitHub
|
b64d61065a
|
Add AWS Cloudfront template
|
2024-03-05 09:19:43 -05:00 |
|
|
weslambertandGitHub
|
d1e55d5ab7
|
Merge pull request #12450 from Security-Onion-Solutions/fix/suricata_max_age
Roll Suricata logs daily to prevent alerts from being deleted when not meeting size threshold
|
2024-02-27 17:28:07 -05:00 |
|
|
weslambertandGitHub
|
df3943b465
|
Daily rollover
|
2024-02-27 17:24:27 -05:00 |
|
|
weslambertandGitHub
|
acf7dbdabe
|
Merge pull request #12432 from Security-Onion-Solutions/fix/endpoint_diag_template
Update pattern for endpoint diagnostic template
|
2024-02-26 12:01:29 -05:00 |
|
|
weslambertandGitHub
|
1d099f97d2
|
Update pattern for endpoint diagnostic template
|
2024-02-26 11:27:56 -05:00 |
|
|
weslambertandGitHub
|
91c1e595ef
|
Merge pull request #12297 from Security-Onion-Solutions/feature/pipeline_config_ui
Manage custom Elasticsearch and Logstash pipelines in UI
|
2024-02-01 09:18:30 -05:00 |
|
|
Wes
|
1818e134ca
|
Change numbers for Logstash
|
2024-02-01 14:01:55 +00:00 |
|
|
Wes
|
182667bafb
|
Change numbers for Elasticsearch
|
2024-02-01 13:59:23 +00:00 |
|
|
Wes
|
136097f981
|
Custom Logstash pipeline annotations
|
2024-01-31 21:47:09 +00:00 |
|
|
Wes
|
bc502cc065
|
Custom Elasticserach pipeline annotations
|
2024-01-31 21:46:33 +00:00 |
|
|
Wes
|
4672a5b8eb
|
Custom pipeline configuration in UI
|
2024-01-31 20:18:17 +00:00 |
|
|
Wes
|
1853dc398b
|
Custom pipeline configuration
|
2024-01-31 20:17:33 +00:00 |
|
|
Wes
|
bc75be9402
|
Custom pipelines in UI
|
2024-01-31 20:16:48 +00:00 |
|
|
Wes
|
cd4bd6460a
|
Custom pipelines
|
2024-01-31 20:16:18 +00:00 |
|
|
weslambertandGitHub
|
dc5ea89255
|
Merge pull request #12260 from Security-Onion-Solutions/fix/endpoint_diagnostic
Add template for endpoint.diagnostic.collection
|
2024-01-26 16:13:30 -05:00 |
|
|
Wes
|
12ab6338db
|
Add diagnostic
|
2024-01-25 20:16:52 +00:00 |
|
|
weslambertandGitHub
|
cd54d4becb
|
Fix indent
|
2024-01-25 13:57:02 -05:00 |
|
|
weslambertandGitHub
|
5f1c76f6ec
|
endpoint.diagnostic.collection
|
2024-01-25 09:46:25 -05:00 |
|
|
weslambertandGitHub
|
d2d70d1c5b
|
Merge pull request #12250 from Security-Onion-Solutions/fix/scan_pe_flags
Fix PE Flags
|
2024-01-24 14:29:23 -05:00 |
|
|
Wes
|
8426aad56d
|
Text mapping for scan.pe.flags
|
2024-01-24 15:10:42 +00:00 |
|
|
Wes
|
d23d367058
|
Make scan.pe.flags a string
|
2024-01-24 15:08:38 +00:00 |
|
|
weslambertandGitHub
|
cbdaf2e9a1
|
Merge pull request #12242 from Security-Onion-Solutions/upgrade/strelka_0.24.01.18
Fix quote
|
2024-01-23 14:02:35 -05:00 |
|
|
weslambertandGitHub
|
4d7af21dd5
|
Fix quote
|
2024-01-23 13:55:37 -05:00 |
|
|
weslambertandGitHub
|
8348506acc
|
Merge pull request #12240 from Security-Onion-Solutions/upgrade/strelka_0.24.01.18
UPGRADE: Strelka 0.24.01.18
|
2024-01-23 13:50:15 -05:00 |
|
|
weslambertandGitHub
|
1698d95efe
|
Use PLACEHOLDER for key values
|
2024-01-23 13:45:26 -05:00 |
|
|
weslambertandGitHub
|
b1052ddcce
|
Merge pull request #12241 from Security-Onion-Solutions/fix/leak_test
Exclude specific Strelka key values
|
2024-01-23 13:43:18 -05:00 |
|
|
weslambertandGitHub
|
0cb36bb0aa
|
Exclude StrelkaHexDump and PLACEHOLDER values
|
2024-01-23 13:39:59 -05:00 |
|
|
weslambertandGitHub
|
0ccdfcb07c
|
Exclude only offset_meta_key
|
2024-01-23 13:11:43 -05:00 |
|
|
weslambertandGitHub
|
63ba97306c
|
Exclude Strelka defaults
|
2024-01-23 13:05:58 -05:00 |
|