m0duspwnens
|
0ddfaf8d74
|
changes for workstation
|
2022-03-28 15:34:15 -04:00 |
|
weslambert
|
fb7160cba5
|
Merge pull request #7644 from Security-Onion-Solutions/fix/syslog_pr_adjustment
Update with changes from Abe's PR and other fixes
|
2022-03-25 13:59:20 -04:00 |
|
weslambert
|
e6599cd10e
|
Update with changes from Abe's PR and other fixes
|
2022-03-25 13:57:44 -04:00 |
|
weslambert
|
c02d7fab50
|
Merge pull request #7636 from Security-Onion-Solutions/feature/rita
Parsing of RITA Logs
|
2022-03-24 13:05:22 -04:00 |
|
weslambert
|
fbc86f43ec
|
Add exclude filter for logs for when there are no results from analysis
|
2022-03-24 13:03:03 -04:00 |
|
weslambert
|
4c93217aac
|
Merge pull request #7635 from Security-Onion-Solutions/fix/process_mappings_keyword
Additional .keyword shims for process mappings
|
2022-03-24 12:53:16 -04:00 |
|
Wes Lambert
|
fe1b72655b
|
Additional .keyword shims for process mappings
|
2022-03-24 16:45:06 +00:00 |
|
m0duspwnens
|
293de159db
|
fix package names
|
2022-03-24 11:33:16 -04:00 |
|
m0duspwnens
|
7cfc52da8a
|
fix include
|
2022-03-24 10:02:25 -04:00 |
|
m0duspwnens
|
a0841ee7a7
|
workstation state
|
2022-03-24 09:57:58 -04:00 |
|
weslambert
|
5160a55dcf
|
Merge pull request #7629 from Security-Onion-Solutions/fix/roles_load_check_cluster_health
Check ES cluster health before trying to load roles
|
2022-03-23 11:07:24 -04:00 |
|
weslambert
|
1f2bca599f
|
Check cluster health before trying to load roles for ES
|
2022-03-23 11:00:26 -04:00 |
|
Wes Lambert
|
8a56c88773
|
Adjust log file paths
|
2022-03-22 17:51:17 +00:00 |
|
Wes Lambert
|
57f01c70ec
|
Remove extra forward slash in log path
|
2022-03-22 17:45:23 +00:00 |
|
Wes Lambert
|
2487d468ab
|
Add RITA Elasticsearch ingest pipeline config
|
2022-03-22 17:38:22 +00:00 |
|
Wes Lambert
|
f613d8ad86
|
Add RITA Logstash config
|
2022-03-22 17:36:18 +00:00 |
|
weslambert
|
bb9d6673ec
|
Fix casing
|
2022-03-21 12:38:50 -04:00 |
|
weslambert
|
9afa949623
|
Don't rotate Filebeat log on startup
|
2022-03-21 12:38:12 -04:00 |
|
weslambert
|
b2c26807a3
|
Add xpack.reporting.kibanaServer.hostname to defaults file
|
2022-03-21 09:30:25 -04:00 |
|
Wes Lambert
|
faeaa948c8
|
Remove extra Salt logic and clean up output format of resultant script
|
2022-03-19 04:31:48 +00:00 |
|
Wes Lambert
|
1a6ef0cc6b
|
Re-enable FB module load
|
2022-03-19 03:55:40 +00:00 |
|
Wes Lambert
|
a18b38de4d
|
Update so-filebeat-module-setup to use new load style to avoid having to explicitly enabled filesets
|
2022-03-19 03:54:41 +00:00 |
|
Wes Lambert
|
2e7d314650
|
Remove Cyberark module
|
2022-03-19 03:43:55 +00:00 |
|
Wes Lambert
|
c97847f0e2
|
Remove Threat Intel Recored Future fileset
|
2022-03-19 03:43:34 +00:00 |
|
Wes Lambert
|
59a2ac38f5
|
Disable FB module load for now
|
2022-03-18 22:12:09 +00:00 |
|
Wes Lambert
|
543bf9a7a7
|
Update Kibana version to 8
|
2022-03-18 22:07:21 +00:00 |
|
Wes Lambert
|
d111c08fb3
|
Update Curator commands with new Filebeat module variables
|
2022-03-18 21:45:33 +00:00 |
|
Doug Burks
|
a3f8a10eb9
|
Merge pull request #7608 from Security-Onion-Solutions/fix/telegraf-non-root
FIX: Run telegraf as non-root #7468
|
2022-03-18 15:17:28 -04:00 |
|
weslambert
|
a9ea99daa8
|
Switch from so_elastic user to so_kibana user for Elastic 8
|
2022-03-18 15:09:50 -04:00 |
|
weslambert
|
cb0d4acd57
|
Remove X-Pack ML entry for Elastic 8
|
2022-03-18 14:46:28 -04:00 |
|
Doug Burks
|
eda7a8d7ea
|
FIX: Update telegraf influxdbsize.sh to collect influxdb size from influxdb_size.log #7468
|
2022-03-18 13:15:43 -04:00 |
|
Doug Burks
|
f7dc5588ae
|
FIX: Update common init.sls to create cron job to write influxdb size for telegraf #7468
|
2022-03-18 13:13:46 -04:00 |
|
Doug Burks
|
c13994994b
|
FIX: Update telegraf init.sls to run telegraf as non-root #7468
|
2022-03-18 13:11:56 -04:00 |
|
weslambert
|
e0374be4aa
|
Update version from 7.16.2 to 8.1.0 for Kibana config
|
2022-03-18 11:57:33 -04:00 |
|
weslambert
|
6f294cc0c2
|
Change Kibana user role from superuser to kibana_system for Elastic 8
|
2022-03-18 11:54:08 -04:00 |
|
weslambert
|
5ec5b9a2ee
|
Remove older module config files
|
2022-03-18 10:14:13 -04:00 |
|
weslambert
|
c659a443b0
|
Update from search.remote to cluster.remote for Elastic 8
|
2022-03-17 21:25:10 -04:00 |
|
weslambert
|
99430fddeb
|
Update from search.remote to cluster.remote for Elastic 8
|
2022-03-17 21:24:39 -04:00 |
|
weslambert
|
7128b04636
|
Remove indices.query.bool.max_clause_count because it is dynamically allocated in Elastic 8
|
2022-03-17 21:20:41 -04:00 |
|
weslambert
|
712a92aa39
|
Switch from log input to filestream input
|
2022-03-17 21:18:03 -04:00 |
|
Wes Lambert
|
6e2aaa0098
|
Clean up original map file
|
2022-03-17 21:08:57 +00:00 |
|
Wes Lambert
|
09892a815b
|
Add back bind mounts and remove THIRDPARTY
|
2022-03-17 21:06:07 +00:00 |
|
Wes Lambert
|
a60ef33930
|
Reorganize FB module management
|
2022-03-17 21:01:03 +00:00 |
|
Josh Patterson
|
949365c636
|
Merge pull request #7602 from Security-Onion-Solutions/issue/7601
prevent so-setup iso from running on ubuntu
|
2022-03-17 11:37:53 -04:00 |
|
m0duspwnens
|
a896348743
|
prevent so-setup iso from running on ubuntu - https://github.com/Security-Onion-Solutions/securityonion/issues/7601
|
2022-03-17 11:31:16 -04:00 |
|
Josh Brower
|
5b9c82a434
|
Merge pull request #7494 from Security-Onion-Solutions/fix/fleetdm-custom-hostname
Force regen of ssl cert
|
2022-03-16 15:17:05 -04:00 |
|
Doug Burks
|
50477071b8
|
Merge pull request #7588 from Security-Onion-Solutions/fix/prevent-multiple-instances
FIX: Prevent multiple instances of so-sensor-clean and so-playbook-sync #6622
|
2022-03-16 13:54:00 -04:00 |
|
Doug Burks
|
e65f2a5513
|
FIX: Prevent multiple instances of so-sensor-clean #6622
|
2022-03-16 13:28:39 -04:00 |
|
Doug Burks
|
e56f90d83c
|
FIX: Prevent multiple instances of so-playbook-sync #6622
|
2022-03-16 13:27:37 -04:00 |
|
weslambert
|
aaded58131
|
Merge pull request #7565 from Security-Onion-Solutions/fix/es_template_fix
Custom ES template fixes
|
2022-03-15 11:09:46 -04:00 |
|