CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity
9,677 Commits 24 Branches 119 Tags
a290602a70d7e388c490204d1919c5bf47b92137
Commit Graph

630 Commits

Author SHA1 Message Date
Wes Lambert
a290602a70 Revert syslog pipeline updates from Abe' PR for now 2022-03-01 15:31:07 +00:00
Wes Lambert
038dc49098 Temporarily increase field limit before trimming efforts 2022-03-01 15:06:28 +00:00
Wes Lambert
dc07adca63 Rename ingest.timestamp to event.ingested 2022-03-01 15:05:08 +00:00
weslambert
414b9dcd59 Run template load first to prevent issues with pipeline changes that generate new indices 2022-02-28 12:33:18 -05:00
Doug Burks
32b71fdcac Avoid changing _index for imported logs 2022-02-26 10:36:09 -05:00
weslambert
e942d81433 Ensure correct formatting for source override 2022-02-25 19:14:58 -05:00
weslambert
a511fd33e9 Ensure correct formatting for destination override 2022-02-25 19:14:21 -05:00
Wes Lambert
a8bdff89ae Move files into SO component template directory 2022-02-25 18:00:16 +00:00
Wes Lambert
08097fe9ec Add Playbook override mappings 2022-02-25 17:58:51 +00:00
Wes Lambert
61dadc6249 Add additional .text subfield mappings 2022-02-25 16:27:37 +00:00
Wes Lambert
0f8a39002f Add .text subfield mappings for DTC where fields are defined 2022-02-24 19:39:52 +00:00
weslambert
23fb62c0d6 Split Zeek DNS records into a separate index 2022-02-24 12:52:25 -05:00
weslambert
bc2c1b4ccc Merge pull request #6935 from abesinger/issue/6912 
Updated syslog pipeline, resolves #6912.
 2022-02-24 08:33:55 -05:00
weslambert
6a0ecb9e9c Add IDH and Kratos index templates 2022-02-23 12:13:46 -05:00
Wes Lambert
f7862af934 Switch from .security to match_only_text 2022-02-22 20:33:49 +00:00
Wes Lambert
4d1533537b Remove old index templates 2022-02-18 20:08:13 +00:00
m0duspwnens
cb55af4c1c dont allow $ to be used for elasticsearch:auth or kibana:secrets - https://github.com/Security-Onion-Solutions/securityonion/issues/7233 2022-02-18 13:13:56 -05:00
weslambert
87a5e64f12 Merge pull request #7249 from Security-Onion-Solutions/fix/component_index_association 
Update component -> index association for file/scan mappings for Strelka
 2022-02-18 12:19:41 -05:00
Mike Reeves
9341669a15 Merge pull request #7244 from christopherwoodall/patch-6 
Update config.map.jinja
 2022-02-18 09:57:33 -05:00
Christopher Woodall
eaff6a12de Update config.map.jinja 
Extend the array instead of appending.
 2022-02-18 08:50:28 -05:00
weslambert
6ee3287d2d Update component -> index association for file/scan mappings for Strelka 2022-02-18 08:12:34 -05:00
weslambert
185ea2fd99 Fix indent for so-netflow component template references 2022-02-16 14:46:12 -05:00
Wes Lambert
786a189f65 Merge branch 'feature/template-reorg' of https://github.com/security-onion-solutions/securityonion into feature/template-reorg 2022-02-15 17:06:02 +00:00
Wes Lambert
3df58eadd1 Modify logic to include custom templates 2022-02-15 17:00:24 +00:00
weslambert
1a53ec4372 Fix malformed copy/paste 2022-02-15 11:14:10 -05:00
Wes Lambert
dce3b7a874 Update defaults file to include ES index templates 2022-02-15 15:53:07 +00:00
Wes Lambert
8e389bf6e5 Add ES template map file 2022-02-14 15:38:32 +00:00
Wes Lambert
ebce67060f Initial template refactor 2022-02-14 15:20:33 +00:00
Wes Lambert
9b841fd872 Add 'event.created' and 'event.ingested' keyword mapping 2022-02-08 21:34:32 +00:00
Wes Lambert
c2c4e4df17 Add Snyk component template 2022-02-08 15:23:43 +00:00
Wes Lambert
f9a50d33c3 Add new templates 2022-02-08 13:17:23 +00:00
Wes Lambert
2951e12c96 Remove snyk component template for now and fix folder structure 2022-02-08 13:16:59 +00:00
Wes Lambert
6d0ca6fcbb Fix mangled key name/typo 2022-02-08 12:59:07 +00:00
Wes Lambert
5090854d4d Add additional component templates and index template references 2022-02-08 03:03:55 +00:00
Wes Lambert
1366e5288e Add mappings references for new component templates to index templates 2022-02-07 19:54:23 +00:00
Wes Lambert
03bfb052ed Add component templates for Elasticsearch, Kibana, Logstash, Netflow, Suricata, and Zeek 2022-02-07 19:42:24 +00:00
Wes Lambert
317f6471d8 Add additional scan and rule filset mappings 2022-02-04 19:05:09 +00:00
Wes Lambert
1ce8bb3523 Fix winlog mapping reference reversion 2022-02-04 18:14:01 +00:00
Wes Lambert
5e03b1a5de Fix reference for file mappings in template 2022-02-04 18:11:03 +00:00
weslambert
898db542bf Merge pull request #7117 from Security-Onion-Solutions/feature/winlog_dtc_mappings 
Add winlog mappings
 2022-02-04 12:16:16 -05:00
Wes Lambert
69cb83cac9 Add winlog mappings 2022-02-04 17:08:26 +00:00
Wes Lambert
f3902cf77d Fix EG template and mappings 2022-02-04 16:00:16 +00:00
Wes Lambert
a3031b2b5c Additional DTC mapping changes 2022-02-04 15:38:51 +00:00
Wes Lambert
1ce386bb7f Add more DTC transition mappings 2022-02-03 17:33:05 +00:00
weslambert
c5b5c5858e Rename to prevent field conflict 2022-02-02 14:31:46 -05:00
Wes Lambert
9db1510b0e Initial composable template configuration and base mappings 2022-02-02 02:08:31 +00:00
weslambert
367b59188b Revert back to dns.answers for now 2022-01-31 09:54:39 -05:00
weslambert
fc0a5bce86 Revert field limit from testing 2022-01-27 11:18:35 -05:00
weslambert
60a0204975 Revert changes to common template 2022-01-27 11:02:47 -05:00
weslambert
8f0a327cb5 Fix Zeek field name so it doesn't conflict with mapping of other dns.answers fields 2022-01-26 15:02:59 -05:00