CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-07 17:52:46 +01:00
Code Issues Packages Projects Releases Wiki Activity
5,922 Commits 24 Branches 119 Tags
9fd2ab530e8b298df63bbf59b09eb381232ffbed
Commit Graph

143 Commits

Author SHA1 Message Date
Doug Burks
7a314b5935 Prevent Wazuh "last -n 20" logs from going to Alerts queue #2321 2020-12-12 11:35:29 -05:00
Doug Burks
61ae187d03 revert previous commit #2321 2020-12-12 10:12:23 -05:00
Mike Reeves
b5ed973abd Merge pull request #2138 from OmerTirosh/OmerTirosh-fix-win.eventlog 
Fix Error: SO elasticsearch ingest failed to convert 'winlog.event_data.SubjectUserName' to 'user.name'
 2020-12-12 10:00:27 -05:00
Doug Burks
85aac4ad75 Prevent Wazuh "last -n 20" logs from going to Alerts queue #2321 2020-12-12 09:22:08 -05:00
Wes Lambert
f689722559 Add initial suricata.ftp_data pipeline 2020-12-10 14:14:50 +00:00
OmerTirosh
e2ee0db727 Ignore failure for rename processor 
Ignore failure for winlog.event_data.SubjectUserName rename processor.
For some event ids (for example 4688), this field already been added in winlogbeat JS processor.
Therefor, elastic throw [user.name] already exists error.
 2020-11-24 17:21:47 +02:00
Mike Reeves
426769588a Merge pull request #1739 from jtgreen-cse/patch-2 
fix for Windows events via osquery
 2020-11-21 13:27:05 -05:00
Josh Brower
1908a68330 Cleanup & fix sysmon pid ingest 2020-11-14 16:19:23 -05:00
Wes Lambert
fddfb8eb92 Syslog updates 2020-11-13 16:06:22 +00:00
Wes Lambert
8258b782fc Update syslog pipeline to allow for initial CEF parsing and pipeline targeting 2020-11-11 21:39:40 +00:00
weslambert
ea1f53b40c Add check for field 2020-11-11 10:29:58 -05:00
Wes Lambert
7e578d2ce0 Pull out additional fields from Exif info 2020-11-09 16:53:53 +00:00
Wes Lambert
6420ee0310 Update parsing for scan.exiftool 2020-11-02 19:28:12 +00:00
jtgreen-cse
6359e03ba6 fix for Windows events via osquery 
This change was required to properly let Windows events flow through their specific pipelines. Otherwise, the `temp` field stays around and gets ingested in ES.
 2020-10-29 15:03:13 -04:00
weslambert
4765ef5f5c Change rule_ruleset to rule.ruleset 2020-10-20 22:14:23 -04:00
Wes Lambert
54c4ee796f Rename file.flavors.mime to file.mime_type 2020-10-14 18:56:44 +00:00
Wes Lambert
3c820365ab Fix common pipeline field removal so won't fail for missing fields 2020-10-14 13:55:24 +00:00
Wes Lambert
14559b081d Ensure Zeek logs without ts field have an @timestamp field associated 2020-10-12 17:19:23 +00:00
Doug Burks
87574181d5 Add Community ID to pfsense filterlog #1501 2020-10-10 08:11:51 -04:00
Doug Burks
8d1ba1f4db fix pfsense firewall udp parsing 2020-10-10 07:38:47 -04:00
Doug Burks
9aa4112de1 Remove extra comma 2020-10-10 06:10:10 -04:00
Wes Lambert
28a1f7f88a Remove pfsense tag 2020-10-10 00:03:51 +00:00
Wes Lambert
b55ffa44f8 Fix module,dataset rename 2020-10-10 00:01:37 +00:00
Wes Lambert
69a04dedd3 Filterlog config changes 2020-10-09 23:56:52 +00:00
Wes Lambert
a6d3dcf398 More fixes for rule field 2020-10-08 13:36:47 +00:00
Wes Lambert
a2e2f23a8d Add null safe check for rule 2020-10-08 13:14:39 +00:00
weslambert
5ada85942b Lowercase network.transport 2020-10-08 07:59:57 -04:00
Wes Lambert
7543144afe Don't use regex for determining rule type 2020-10-07 16:15:43 +00:00
Wes Lambert
015a441e79 Change rule.signature_info to rule.reference and ensure common.nids exists 2020-10-07 15:20:26 +00:00
Wes Lambert
f0a1457ffd Update common.nids 2020-10-07 15:14:08 +00:00
Wes Lambert
8c07c098f6 Pipeline cleanup 2020-10-06 20:14:15 +00:00
Wes Lambert
350cc41740 Let zeek.common handle common fields for zeek.tunnels 2020-10-06 20:12:23 +00:00
Wes Lambert
019bec992d Add Strelka YARA matches as alerts 2020-10-06 12:19:44 +00:00
weslambert
bc31e19e37 Put back rule.category for Wazuh alerts 2020-10-05 11:34:29 -04:00
Wes Lambert
77d31cb289 Add event.severity and event.severity_label config for Wazuh alerts 2020-10-05 12:50:29 +00:00
Wes Lambert
02d2e5e2c6 Fix isue with null Zeek server IP 2020-09-30 17:53:30 +00:00
Wes Lambert
869767d9d9 Add initial parsing for Wazuh WEL/Sysmon 2020-09-28 19:04:21 +00:00
Doug Burks
24c325e9a1 Fix Elasticsearch parsing for Zeek Intel Indicator #1309 2020-09-10 06:41:19 -04:00
Josh Brower
c3b2d98ffb Add event.category to WEL 2020-09-10 06:15:30 -04:00
Josh Brower
a79d0319cd Initial support for evtx import 2020-09-01 13:47:27 -04:00
Josh Brower
b7dd14b8f0 Set event.code to string for WEL 2020-08-28 13:40:04 -04:00
Josh Brower
d4f7a07f85 Osquery Parsing fix 2020-08-18 15:54:11 -04:00
Josh Brower
928e5ed832 Playbook/Nav Fixes - Issue #1064 2020-08-07 17:02:48 -04:00
Josh Brower
ff209cfd65 Merge pull request #1149 from Security-Onion-Solutions/feature/wlb-parsing 
Ingest Parsing Update for Sysmon/WEL
 2020-08-07 13:37:22 -04:00
Josh Brower
a8b980b6a7 More Playbook Fixes - Issue #1064 2020-08-07 13:35:43 -04:00
Josh Brower
15efe77e06 Ingest Parsing Update for Sysmon/WEL 2020-08-06 13:11:47 -04:00
Josh Brower
d971d07720 Osquery & WLB Parsing Update for WEL & Sysmon 2020-07-31 16:06:15 -04:00
Josh Brower
55e60cb749 initial refactor - beats/sysmon parsing 2020-07-28 11:03:33 -04:00
Josh Patterson
549916306c Merge pull request #1008 from Security-Onion-Solutions/quickfix/lstoes 
Quickfix/lstoes
 2020-07-14 17:37:19 -04:00
m0duspwnens
5cf71596b2 add curlys 2020-07-14 17:36:52 -04:00