CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-29 20:23:28 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,463 Commits 27 Branches 128 Tags
a2680fad0aa1701708f73ce9bbe3cb8ff79994de
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Doug BurksandGitHub 6a2e1df7d4 Merge pull request #5460 from Security-Onion-Solutions/feature/welcome-link-docs 
FEATURE: Add docs link to Setup #5459
 2021-09-10 07:27:48 -04:00
doug db50ef71b4 FEATURE: Add docs link to Setup #5459 2021-09-10 06:19:16 -04:00
Doug BurksandGitHub 39f32a6e13 Merge pull request #5185 from Security-Onion-Solutions/dev 
2.3.70
 2021-08-19 06:22:57 -04:00
Doug BurksandGitHub 478a0b6a3f Merge pull request #5075 from Security-Onion-Solutions/fix/typo 
fix typo
 2021-08-05 07:43:46 -04:00
Doug BurksandGitHub 771688a70f fix typo 2021-08-05 07:34:07 -04:00
dougandJason Ertel 3d3593a1a9 FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770 2021-07-22 09:50:21 -04:00
dougandJason Ertel fa9d7afb46 FIX: Airgap link to Release Notes #4685 2021-07-22 09:42:37 -04:00
doug 7e86681509 FIX: Airgap link to Release Notes #4685 2021-07-16 16:50:49 -04:00
Doug BurksandGitHub 2ea3989497 Merge pull request #4775 from Security-Onion-Solutions/fix/suricata-dns-response-code 
FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770
 2021-07-12 13:40:14 -04:00
doug e6f9592cde FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770 2021-07-12 13:24:21 -04:00
Doug BurksandGitHub 822165f168 Move salt lines after shebang 2021-06-29 13:32:02 -04:00
Doug BurksandGitHub 127afe1582 Merge pull request #4624 from Security-Onion-Solutions/fix/soup-grammar 
fix soup grammar
 2021-06-25 11:19:22 -04:00
doug a3d7f4e35d fix grammar 2021-06-25 11:16:26 -04:00
Doug BurksandGitHub c2f6a6983d Merge pull request #4521 from Security-Onion-Solutions/feature/security-md 
Create SECURITY.md
 2021-06-14 15:51:55 -04:00
Doug BurksandGitHub 20437ef2c7 Create SECURITY.md 2021-06-14 15:42:18 -04:00
doug ada8255af0 bump version to 7.13.0 2021-05-28 08:59:40 -04:00
Doug BurksandGitHub cf3dda6869 Merge pull request #4300 from j-bernal/patch-1 
Update so-whiptail
 2021-05-27 07:58:16 -04:00
doug aeea5701e4 completely disable both alerts.actions.json and hunt.actions.json 2021-05-26 16:34:05 -04:00
doug ee675546ac add menu.actions.json and update soc.json 2021-05-26 14:09:00 -04:00
Doug BurksandGitHub 293fb0a76d FEATURE: Pivot from Alerts/Hunt to CyberChef #4081 2021-05-07 13:23:46 -04:00
Doug BurksandGitHub 2e228c8355 FEATURE: Pivot from Alerts/Hunt to CyberChef #4081 2021-05-07 13:22:03 -04:00
Doug BurksandGitHub 8ca0626387 FIX: Hunt query for HTTP EXE downloads should work for both Zeek and Suricata #3753 2021-04-05 06:55:40 -04:00
Doug BurksandGitHub 2ba130b44c Merge pull request #3487 from Security-Onion-Solutions/issue/3486 
FEATURE: soup should provide some initial information and then prompt…
 2021-03-17 09:02:29 -04:00
Doug BurksandGitHub d32c1de411 FEATURE: soup should provide some initial information and then prompt the user to continue #3486 2021-03-17 09:00:46 -04:00
Doug BurksandGitHub 065f1c2927 Merge pull request #3473 from Security-Onion-Solutions/fix/shorten-elastic-license-url 
Shorten Elastic License URL to avoid line wrap
 2021-03-16 16:43:38 -04:00
Doug BurksandGitHub 388524ec4e Shorten Elastic License URL to avoid line wrap 2021-03-16 16:39:14 -04:00
Doug BurksandGitHub cfdf9703ab Merge pull request #3427 from Security-Onion-Solutions/issue/3340 
FEATURE: soup should output more guidance for distributed deployments at the end #3340
 2021-03-12 15:27:26 -05:00
Doug BurksandGitHub da7adab566 FEATURE: soup should output more guidance for distributed deployments at the end #3340 2021-03-12 12:59:17 -05:00
doug edb88ac09a FIX: Improve Setup verbiage #3422 2021-03-12 10:54:44 -05:00
Doug BurksandGitHub 555f9b5091 Merge pull request #3417 from Security-Onion-Solutions/issue/3413 
FIX: SMTP shoud read SNMP on Kibana SNMP view #3413
 2021-03-12 06:52:21 -05:00
doug a5779a520c FIX: SMTP shoud read SNMP on Kibana SNMP view #3413 2021-03-12 06:48:57 -05:00
Doug BurksandGitHub ab1c84afca Merge pull request #3409 from Security-Onion-Solutions/issue/3408 
FIX: Populate http.status_message field #3408
 2021-03-11 16:45:53 -05:00
doug adbc7436b6 FIX: Populate http.status_message field #3408 2021-03-11 16:42:20 -05:00
doug b4ad7e7359 FIX: Improve Suricata DHCP logging and parsing #3397 2021-03-11 11:01:51 -05:00
Doug BurksandGitHub adb25d63d2 Merge pull request #3396 from Security-Onion-Solutions/issue/3295 
FIX: Improve DHCP leases query in Hunt #3395
 2021-03-11 08:22:48 -05:00
Doug BurksandGitHub 85aaa71006 FIX: Improve DHCP leases query in Hunt #3395 2021-03-11 08:01:27 -05:00
doug d39b3280c8 FIX: Custom Kibana settings are not being applied properly on upgrades #3254 2021-03-03 14:04:32 -05:00
Doug BurksandGitHub 79fefd83ef Merge pull request #3134 from Security-Onion-Solutions/issue/3128 
Improve Hunt queries for ssh and tunnel #3128
 2021-02-25 07:11:20 -08:00
Doug BurksandGitHub c18c865764 Improve Hunt queries for ssh and tunnel #3128 2021-02-25 09:23:19 -05:00
Doug BurksandGitHub ef1e296415 Improve Hunt queries for ssh and tunnel #3128 2021-02-25 08:52:34 -05:00
Doug BurksandGitHub 84f138772f Merge pull request #3072 from Security-Onion-Solutions/kilo 
Additional fine tuning of Suricata metadata support
 2021-02-22 10:57:02 -08:00
doug 71c7ffae3e Improve support for Suricata metadata #2200 2021-02-22 13:49:29 -05:00
doug bcce205430 Improve support for Suricata metadata #2200 2021-02-22 13:00:14 -05:00
doug 3467f30603 Improve support for Suricata metadata #2200 2021-02-22 10:27:24 -05:00
Doug BurksandGitHub d4ee2b86e6 Merge pull request #3070 from Security-Onion-Solutions/dev 
Dev to Kilo
 2021-02-22 07:22:49 -08:00
Doug BurksandGitHub 85b9cac110 Merge pull request #3063 from Security-Onion-Solutions/dev 
Dev to kilo
 2021-02-21 03:40:05 -08:00
Doug BurksandGitHub 3ea1ec99d5 Merge pull request #3048 from Security-Onion-Solutions/kilo 
Update syslog ingest parser to accomodate pfSense filterlog changes #3033
 2021-02-19 11:02:56 -08:00
doug 88eb5b1d61 Update syslog ingest parser to accomodate pfSense filterlog changes #3033 2021-02-19 08:02:32 -05:00
Doug BurksandGitHub 5493b3ef91 Merge pull request #3032 from Security-Onion-Solutions/dev 
Update kilo to latest dev
 2021-02-19 04:53:23 -08:00
Doug BurksandGitHub 8016511414 Merge pull request #2981 from Security-Onion-Solutions/kilo 
Hunt: improve Wazuh queries #2383
 2021-02-16 10:38:53 -08:00
doug fabe3c87f2 Hunt: improve Wazuh queries #2383 2021-02-16 11:56:14 -05:00
Doug BurksandGitHub d6fa54b606 Merge pull request #2975 from Security-Onion-Solutions/kilo 
Issues 2954 and 2361 - Kibana config
 2021-02-16 08:30:46 -08:00
doug 397d8d0964 Kibana 7.10.2 config changes #2954 2021-02-14 07:04:51 -05:00
doug 3248edea8b Update Kibana dashboard hyperlinks to new url format #2361 2021-02-12 17:25:42 -05:00
doug 31a0c2bc82 Update Kibana dashboard hyperlinks to new url format #2361 2021-02-12 15:37:25 -05:00
doug 797d2c4dba Kibana 7.10.2 config changes #2954 2021-02-12 15:35:06 -05:00
Doug BurksandGitHub fd4cb0b7a8 Kibana 7.10.2 config changes #2954 2021-02-12 14:05:29 -05:00
Doug BurksandGitHub c717773fc3 Kibana 7.10.2 config changes #2954 2021-02-12 14:04:00 -05:00
Doug BurksandGitHub 7a314b5935 Prevent Wazuh "last -n 20" logs from going to Alerts queue #2321 2020-12-12 11:35:29 -05:00
Doug BurksandGitHub 61ae187d03 revert previous commit #2321 2020-12-12 10:12:23 -05:00
Doug BurksandGitHub 85aac4ad75 Prevent Wazuh "last -n 20" logs from going to Alerts queue #2321 2020-12-12 09:22:08 -05:00
Doug BurksandGitHub c61199618a Update so-curator-closed-delete-delete 2020-10-24 07:15:43 -04:00
Doug BurksandGitHub a106913d1a Heavy node filebeat needs extra_hosts for the heavy node itself #1521 2020-10-14 09:51:59 -04:00
Doug BurksandGitHub f88403e83e use ssl on nodes that support it 2020-10-14 05:50:29 -04:00
Doug BurksandGitHub 190869a1f2 enable https on elasticsearch nodes that support it 2020-10-13 16:04:55 -04:00
Doug BurksandGitHub 0f68a53af4 Update so-curator-closed-delete-delete 2020-10-13 13:22:35 -04:00
Doug BurksandGitHub b004a9149e Update so-index-list 2020-10-13 12:40:45 -04:00
Doug BurksandGitHub e5ece6cd50 Update so-index-list 2020-10-13 12:34:49 -04:00
Doug BurksandGitHub a75e986836 Update so-elastic-clear 2020-10-13 12:18:27 -04:00
Doug BurksandGitHub ad50b5d640 elasticsearch _cat/indices output has changed between 6 and 7 2020-10-13 06:33:40 -04:00
Doug BurksandGitHub 21b1becd7e Update so-elasticsearch-pipelines-list 2020-10-12 16:34:30 -04:00
Doug BurksandGitHub 5458c57cc9 Update so-elasticsearch-pipeline-stats 2020-10-12 16:32:11 -04:00
Doug BurksandGitHub 68e34b781a Update so-elasticsearch-templates-load 2020-10-12 16:10:38 -04:00
Doug BurksandGitHub 4c43262610 Update so-elasticsearch-templates-list 2020-10-12 16:08:06 -04:00
Doug BurksandGitHub 553ce3e363 only include extra_hosts if nodestab exists 2020-10-12 10:13:05 -04:00
Doug BurksandGitHub 3cfee82b59 Update Hunt fields for firewall #1500 2020-10-10 08:18:00 -04:00
Doug BurksandGitHub 87574181d5 Add Community ID to pfsense filterlog #1501 2020-10-10 08:11:51 -04:00
Doug BurksandGitHub 5f15320b9d Update Hunt fields for firewall #1500 2020-10-10 07:54:48 -04:00
Doug BurksandGitHub 8d1ba1f4db fix pfsense firewall udp parsing 2020-10-10 07:38:47 -04:00
Doug BurksandGitHub 8cfabf101c Update Hunt query for firewall #1499 2020-10-10 07:17:49 -04:00
Doug BurksandGitHub 9aa4112de1 Remove extra comma 2020-10-10 06:10:10 -04:00
Doug BurksandGitHub 2489ca608a Improve Hunt FTP queries #1479 2020-10-08 05:30:17 -04:00
Doug BurksandGitHub a686704d37 remove rule.uuid now that underlying issue has been resolved 2020-10-06 09:39:57 -04:00
Doug BurksandGitHub a45aa43f41 Add trailing comma to "thehive" stanza 2020-10-05 12:35:33 -04:00
Doug BurksandGitHub e7cba6ba1d Change SOC Alerts eventFetchLimit from 5000 to 500 #1447 2020-10-05 09:29:01 -04:00
Doug BurksandGitHub 948e0c4c61 Add rule.name to Hunt Wazuh Alerts query #1442 2020-10-05 09:26:13 -04:00
Doug BurksandGitHub e836f96c65 move rule.uuid after rule.name 2020-10-01 12:09:52 -04:00
Doug BurksandGitHub 4851069a10 remove rule.gid from Alerts groupby since Wazuh and Playbook may not have that field 2020-10-01 11:51:40 -04:00
Doug BurksandGitHub bc19cce4c2 Acknowledging an alert may acknowledge more alerts than intended #1426 2020-10-01 10:00:54 -04:00
Doug BurksandGitHub 26781de244 Add Strelka query to Hunt #1433 2020-10-01 06:59:36 -04:00
Doug BurksandGitHub 0a995f4a7a Update README.md 2020-09-30 07:43:20 -04:00
Doug BurksandGitHub 60134829d5 Alerts - Drilldown should display rule.uuid #1416 2020-09-29 07:51:45 -04:00
Doug BurksandGitHub c7b43ac220 Update soc.json 2020-09-29 07:41:49 -04:00
Doug BurksandGitHub a7f24b62e6 Hunt - improve NIDS query and eventFields #1415 2020-09-29 07:34:44 -04:00
Doug BurksandGitHub 6e9e4dc99c Hunt third magnifying glass should group output by event.module and event.dataset #1407 2020-09-28 14:19:55 -04:00
Doug BurksandGitHub 0516a9ddd5 Alerts page "Hunt for this field" action should quote field and group output #1406 2020-09-28 12:35:08 -04:00
Doug BurksandGitHub 3904295137 Hunt - improve HTTP queries #1401 2020-09-27 08:04:28 -04:00
Doug BurksandGitHub aa7f927ffd Hunt - improve x509 queries #1400 2020-09-27 07:17:46 -04:00
Doug BurksandGitHub 11b200e9c0 Hunt - remove SMTP fields #1397 2020-09-25 14:17:14 -04:00
Doug BurksandGitHub 20a56d0831 Hunt - add network.community_id column to Events table for more data types #1396 2020-09-25 13:18:28 -04:00