CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,037 Commits 40 Branches 127 Tags
a562d70fe205aa3d487e5a3c17841c3593384a49
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 0f6ecdf38a Merge pull request #1104 from Security-Onion-Solutions/feature/cortex_orguser 
Create default orguser if empty
 2020-07-27 09:50:23 -04:00
Wes Lambert e81fd7464b Create default orguser if empty 2020-07-27 13:49:17 +00:00
weslambertandGitHub ced51761fa Merge pull request #1103 from Security-Onion-Solutions/feature/wazuh_version 
Bump Wazuh version
 2020-07-27 09:46:27 -04:00
Wes Lambert ac5aeb4801 Bump Wazuh version 2020-07-27 13:45:34 +00:00
weslambertandGitHub 88ffd0c17c Merge pull request #1101 from Security-Onion-Solutions/feature/wazuh_symlinks 
Add Wazuh Wazuh symlinks for config/rules
 2020-07-27 08:15:58 -04:00
Wes Lambert 51e27cadc8 Add Wazuh Wazuh symlinks for cpnfig/rules 2020-07-27 12:14:43 +00:00
weslambertandGitHub 2d2bebdd9c Merge pull request #1100 from Security-Onion-Solutions/feature/wazuh_nsm 
Move Wazuh from /opt/so/ to /nsm/wazuh
 2020-07-27 07:59:39 -04:00
Wes Lambert 958ee25f6d Move Wazuh from /opt/so/ to /nsm/wazuh 2020-07-27 11:58:12 +00:00
weslambertandGitHub 2d096ddd66 Merge pull request #1096 from Security-Onion-Solutions/fix/elastalert_thehive 
Make sure we are searching all clusters when running rules
 2020-07-24 18:05:46 -04:00
Wes Lambert 3ac9f1800b Make sure we are searching all clusters when running rules 2020-07-24 22:04:30 +00:00
weslambertandGitHub 2341d9592e Merge pull request #1025 from Security-Onion-Solutions/fix/wazuh_cleanup 
Change verbiage
 2020-07-17 09:39:21 -04:00
weslambertandGitHub e91aa751a7 Change verbiage 2020-07-17 09:38:43 -04:00
weslambertandGitHub f8bb094546 Merge pull request #1014 from Security-Onion-Solutions/fix/strelka_standalone 
Fix module eval
 2020-07-16 09:32:06 -04:00
Wes Lambert 8275f458a1 Fix module eval 2020-07-16 13:30:38 +00:00
weslambertandGitHub 7fecfdab32 Update README.md 2020-07-16 08:14:47 -04:00
weslambertandGitHub f7d527bb90 Update README.md 2020-07-16 08:14:23 -04:00
weslambertandGitHub 7a36803e2c Merge pull request #1002 from Security-Onion-Solutions/fix/strelka_observer 
Add observer name for Strelka events
 2020-07-14 13:39:52 -04:00
Wes Lambert f9df39977b Add observer name for Strelka events 2020-07-14 17:38:43 +00:00
weslambertandGitHub 7ed902c0ae Merge pull request #1001 from Security-Onion-Solutions/fix/suricata_timestamp 
Convert message timestamp to @timestamp
 2020-07-14 13:34:58 -04:00
Wes Lambert d6afde90b0 Convert message timestamp to @timestamp 2020-07-14 13:37:00 +00:00
weslambertandGitHub ef64048fc6 Merge pull request #978 from Security-Onion-Solutions/fix/sensor-clean 
Fix value
 2020-07-10 17:17:57 -04:00
weslambertandGitHub eb2dc0be4c Fix value 2020-07-10 17:17:33 -04:00
weslambertandGitHub 9b079df9f5 Merge pull request #974 from Security-Onion-Solutions/fix/sensor_clean 
Fix/sensor clean
 2020-07-10 15:35:57 -04:00
Wes Lambert d7f7fb801c Set role 2020-07-10 19:35:27 +00:00
Wes Lambert 37ab252e01 Add sensor proc eval 2020-07-10 19:30:08 +00:00
weslambertandGitHub 33375a0809 Merge pull request #973 from Security-Onion-Solutions/fix/curator_logsizelimit 
Move zeek_clean to so-sensor-clean
 2020-07-10 13:57:58 -04:00
Wes Lambert 6e99ca600f Move zeek_clean to so-sensor-clean 2020-07-10 17:56:40 +00:00
weslambertandGitHub 818f7f56b2 Merge pull request #965 from Security-Onion-Solutions/feature/add_gcp_check 
Add GCP and make cloud check more generic
 2020-07-08 23:31:37 -04:00
weslambertandGitHub c01047fad2 Add /dev/null 2020-07-08 23:30:50 -04:00
weslambertandGitHub 889ba67d85 Move EC2 to more generic cloud verbiage 2020-07-08 23:27:46 -04:00
weslambertandGitHub ce00d829e1 Move EC2 to more generic cloud verbiage and check for GCP 2020-07-08 23:26:48 -04:00
weslambertandGitHub 67fb46f519 Merge pull request #963 from Security-Onion-Solutions/fix/curator_logsizelimit 
Add standalone evaluation for log_size_limit
 2020-07-08 15:40:54 -04:00
Wes Lambert f2cea273b6 Add standalone evaluation for log_size_limit 2020-07-08 19:39:14 +00:00
weslambertandGitHub beda67d2a9 Merge pull request #955 from Security-Onion-Solutions/fix/strelka_message_drop 
Drop message field and original exiftool keys
 2020-07-08 10:56:06 -04:00
weslambertandGitHub 4cf31e1ee7 Drop message field and original exiftool keys 2020-07-08 10:55:40 -04:00
weslambertandGitHub 9c11de5455 Merge pull request #953 from Security-Onion-Solutions/fix/zeek_files_uid 
Rename uids to uid
 2020-07-08 09:40:04 -04:00
weslambertandGitHub b25a3b6986 Rename uids to uid 2020-07-08 09:39:37 -04:00
weslambertandGitHub 88b7a31195 Merge pull request #952 from Security-Onion-Solutions/fix/wazuh_authdport 
Add Wazuh Authd Port
 2020-07-08 09:26:28 -04:00
weslambertandGitHub 987acaeb7b Add Wazuh Authd Port 2020-07-08 09:26:04 -04:00
weslambertandGitHub 2992938596 Merge pull request #947 from Security-Onion-Solutions/fix/strelka_exiftool 
Add fields for exiftool keys
 2020-07-07 17:13:57 -04:00
Wes Lambert 3b50ce032a Add fields for exiftool keys 2020-07-07 20:02:09 +00:00
weslambertandGitHub 34e06ecde1 Merge pull request #940 from Security-Onion-Solutions/feature/strelka_fuid 
Add Zeek FUID for Strelka records
 2020-07-07 11:01:09 -04:00
Wes Lambert e0570e1db7 Add Zeek FUID for Strelka records 2020-07-07 15:00:01 +00:00
weslambertandGitHub d334d5ab83 Merge pull request #938 from Security-Onion-Solutions/fix/strelka_filebeat 
Fix pillar reference for Strelka/FB
 2020-07-07 09:48:19 -04:00
Wes Lambert 2fdd5fd77b Fix pillar reference for Strelka/FB 2020-07-07 13:46:57 +00:00
weslambertandGitHub 0bfa3d486e Merge pull request #923 from Security-Onion-Solutions/fix/es-allow 
Fix my typo
 2020-07-02 13:32:45 -04:00
weslambertandGitHub bbc752b6d9 Fix my typo 2020-07-02 13:32:19 -04:00
Wes Lambert 26b0daf2da Add other setup-related items for EC2 interface 2020-07-01 17:42:51 +00:00
Wes Lambert 3cf79995a2 Modify Whiptail menu for EC2 NIC 2020-07-01 17:32:43 +00:00
weslambertandGitHub 0b7026a11e Merge pull request #906 from Security-Onion-Solutions/fix/ingest_parsing 
Fix/ingest parsing
 2020-06-29 23:07:22 -04:00
Wes Lambert 84e2965fef Addl krb fix 2020-06-30 03:06:01 +00:00
Wes Lambert bf8798f1d1 Fix krb client/server cert subject parsing 2020-06-30 03:04:01 +00:00
Wes Lambert 8f5da66335 Add null safe operator for query name 2020-06-30 03:02:38 +00:00
weslambertandGitHub b398d58dc9 Merge pull request #902 from Security-Onion-Solutions/feature/es_allow 
Add ES REST API option for so-allow
 2020-06-29 14:51:09 -04:00
Wes Lambert ed60d48c81 Add ES REST API option for so-allow 2020-06-29 18:49:16 +00:00
weslambertandGitHub b99b19ce58 Merge pull request #898 from Security-Onion-Solutions/feature/strelka_scripts 
Add Strelka mgmt scripts
 2020-06-29 09:11:16 -04:00
Wes Lambert 9ac85cf674 Add Stelka mgmt scripts 2020-06-29 13:09:14 +00:00
weslambertandGitHub 6f6e8a8853 Merge pull request #897 from Security-Onion-Solutions/fix/strelka_rules 
Fix/strelka rules
 2020-06-26 16:43:21 -04:00
weslambertandGitHub c421bd464a Remove Strelka function (in favor of direct script execution in so-setup) 2020-06-26 16:42:44 -04:00
weslambertandGitHub 8c47723bc9 Run YARA update script after applying state 2020-06-26 15:45:52 -04:00
weslambertandGitHub 813c243d3d Update so-yara-update 2020-06-26 13:26:08 -04:00
weslambertandGitHub 5e41bba6db Merge pull request #892 from Security-Onion-Solutions/feature/more_strelka_rules 
Feature/more strelka rules
 2020-06-25 12:33:36 -04:00
Wes Lambert a24402de99 More Strelka rule config 2020-06-25 16:31:04 +00:00
Wes Lambert 63c45be388 Update Strelka init for rules 2020-06-25 15:49:58 +00:00
Wes Lambert 6487fdf5e6 Add Strelka YARA function 2020-06-25 15:46:37 +00:00
weslambertandGitHub 83ed21314a Merge pull request #888 from Security-Onion-Solutions/feature/strelka_rules 
Feature/strelka rules
 2020-06-24 13:28:52 -04:00
Wes Lambert f5bb831edf Fix comment 2020-06-24 17:27:59 +00:00
Wes Lambert a01339039a Update Setup for Strelka rules 2020-06-24 17:22:55 +00:00
Wes Lambert 8bfbd77367 Update whiptail for Strelka 2020-06-24 17:18:05 +00:00
Wes Lambert 52a0ace1b8 Use Strelka rules if enabled 2020-06-24 17:08:58 +00:00
weslambertandGitHub c3651f1b45 Merge pull request #884 from Security-Onion-Solutions/feature/strelka_client 
Add FW config for Strelka frontend
 2020-06-23 14:57:06 -04:00
Wes Lambert f7eacc2b05 Add FW config for Strelka frontend 2020-06-23 18:47:23 +00:00
weslambertandGitHub 685e3048ac Merge pull request #883 from Security-Onion-Solutions/fix/hunt_files_rename 
Update file dataset name for hunt queries
 2020-06-23 13:49:52 -04:00
Wes Lambert c0428ce79d Update file dataset name for hunt queries 2020-06-23 17:48:12 +00:00
weslambertandGitHub 13df2e6312 Merge pull request #882 from Security-Onion-Solutions/fix/files_rename 
Move dataset from files to file
 2020-06-23 13:44:26 -04:00
Wes Lambert af451573eb Move dataset from files to file 2020-06-23 17:43:28 +00:00
weslambertandGitHub fb9ac58ed6 Merge pull request #869 from Security-Onion-Solutions/feature/elastic_indices_rw 
Basic index read-only attr removal script
 2020-06-17 15:00:23 -04:00
Wes Lambert 6d25151ab8 Basic index read-only attr removal script 2020-06-17 18:59:13 +00:00
weslambertandGitHub 569fc4ac4d Merge pull request #867 from Security-Onion-Solutions/feature/zeek_custom_policy 
Feature/zeek custom policy
 2020-06-17 13:12:38 -04:00
Wes Lambert 90c278096c Add custom Zeek script dir 2020-06-17 17:11:27 +00:00
weslambertandGitHub b489420002 Merge pull request #865 from Security-Onion-Solutions/feature/cortex_custom 
Feature/cortex custom
 2020-06-17 09:22:42 -04:00
Wes Lambert 1beff65cc9 fix typo 2020-06-17 13:20:32 +00:00
Wes Lambert cbfe375407 Custom analyzer and responder dirs 2020-06-17 13:16:52 +00:00
weslambertandGitHub 91c32725fb Merge pull request #851 from Security-Onion-Solutions/fix/es_field_fixes 
Fix/es field fixes
 2020-06-15 12:59:01 -04:00
Wes Lambert f3c9f2e5ea update templates 2020-06-15 16:57:46 +00:00
Wes Lambert 206261fbe6 rename id to log.id.fuid for X509 2020-06-15 16:55:14 +00:00
Wes Lambert 18547e8ea8 enforce field types 2020-06-15 16:54:33 +00:00
weslambertandGitHub 014274930a Merge pull request #815 from Security-Onion-Solutions/fix/syslog_cleanup 
Clean up some stuff
 2020-06-02 15:32:32 -04:00
weslambertandGitHub c91bc0e681 Clean up some stuff 2020-06-02 15:31:48 -04:00
weslambertandGitHub 98e0f0d7d8 Merge pull request #814 from Security-Onion-Solutions/feature/syslog 
Feature/syslog
 2020-06-02 13:39:23 -04:00
Wes Lambert 8cac30728b update Logstash config 2020-06-02 17:36:36 +00:00
Wes Lambert 91673a5d70 Update FB config 2020-06-02 17:33:42 +00:00
weslambertandGitHub 551c663046 Merge pull request #808 from Security-Onion-Solutions/fix/tunnel_parents 
Rename tunnel_parents
 2020-06-01 09:52:55 -04:00
Wes Lambert 51f5d64ef6 Rename tunnel_parents 2020-06-01 13:51:32 +00:00
weslambertandGitHub fa8b88b090 Merge pull request #806 from Security-Onion-Solutions/feature/vxlan_tunnel_id 
fix naming of uid field for tunnel
 2020-06-01 08:54:12 -04:00
Wes Lambert d7ce3d4719 fix naming of uid field for tunnel 2020-06-01 12:52:57 +00:00
weslambertandGitHub 2601ffe902 Merge pull request #797 from Security-Onion-Solutions/fix/radius_parsing 
fix framed_addr field
 2020-05-29 07:56:22 -04:00
Wes Lambert 4059121dd6 fix framed_addr field 2020-05-29 11:55:18 +00:00
weslambertandGitHub f5300d3d5a Merge pull request #794 from Security-Onion-Solutions/feature/zeek-stats 
Add basic Zeek stats script
 2020-05-28 13:55:43 -04:00
Wes Lambert 7f75050682 Add basic Zeek stats script 2020-05-28 17:54:15 +00:00