Commit Graph

10714 Commits

Author SHA1 Message Date
Wes
a6bc5b108f Add missing OPCUA 'activate_session' pipelines 2022-11-22 20:51:44 +00:00
weslambert
090f8309c2 Merge pull request #9207 from Security-Onion-Solutions/fix/ingest_typos_2_4
Fix spelling of 'wireguard.responses' field name
2022-11-22 15:36:04 -05:00
weslambert
356904f751 Fix spelling of 'wireguard.responses' field name 2022-11-22 13:03:04 -05:00
weslambert
f9cc7888f4 Merge pull request #9204 from Security-Onion-Solutions/fix/ics_ingest_field_names_2_4
Fix ICS Ingest Field Names
2022-11-22 12:30:17 -05:00
weslambert
6b77843e52 Fix format/speliing for 'enip.status_code' field name 2022-11-22 12:07:55 -05:00
weslambert
13faf63770 Fix spelling for 'stun.class' field name 2022-11-22 12:07:15 -05:00
weslambert
b801997709 Merge pull request #9196 from Security-Onion-Solutions/fix/missing_ics_pipelines_2_4
Add COTP and TDS ingest pipelines
2022-11-22 08:44:19 -05:00
Wes
a38e312df4 Add COTP and TDS ingest pipelines 2022-11-22 13:36:27 +00:00
weslambert
bde899e7cb Merge pull request #9194 from Security-Onion-Solutions/fix/ics_tag_syntax_error_2_4
Fix syntax error for 'ics' tag logic
2022-11-22 07:32:54 -05:00
weslambert
d2bc1a5523 Fix syntax error for 'ics' tag logic 2022-11-22 07:24:54 -05:00
weslambert
68efd817e0 Merge pull request #9189 from Security-Onion-Solutions/feature/filebeat_config_ics_event_tag_2_4
Add 'ics' tag to events generated from ICS protocol logs
2022-11-21 17:06:14 -05:00
weslambert
fe180d5657 Fix indentation 2022-11-21 17:02:17 -05:00
weslambert
9994d47a43 Add 'ics' tag to events generated from ICS protocol logs 2022-11-21 16:46:47 -05:00
Doug Burks
6e1e6e15e8 Merge pull request #9186 from Security-Onion-Solutions/dougburks-patch-2
Add ICS/SCADA logs to filebeat defaults.yaml
2022-11-21 13:30:35 -05:00
Doug Burks
febb781428 Add ICS/SCADA logs to filebeat defaults.yaml 2022-11-21 12:10:55 -05:00
weslambert
061f0b0595 Merge pull request #9159 from Security-Onion-Solutions/feature/additional_ics_scada_ingest_pipelines_2_4
Add additional ICS/SCADA ingest node pipelines
2022-11-21 10:32:00 -05:00
Doug Burks
5a0fe6050b Merge pull request #9179 from Security-Onion-Solutions/dougburks-patch-2
Simplify version in README.md to just 2.4
2022-11-21 08:46:33 -05:00
Doug Burks
778ee4b00f Simplify version in README.md to just 2.4 2022-11-21 08:39:18 -05:00
Jason Ertel
5f59ae52d5 Merge pull request #9162 from Security-Onion-Solutions/config
Config
2022-11-17 11:50:35 -05:00
Wes
05b9a067fd Add additional ICS/SCADA ingest node pipelines 2022-11-17 16:03:21 +00:00
Jason Ertel
ed9aa5b73f Ensure filecheck is up by checking every minute 2022-11-17 10:48:53 -05:00
Jason Ertel
7f7e5474ed Add more logging for filecheck monitoring, and ensure scripts are accessible to salt-relay 2022-11-17 10:43:05 -05:00
Jason Ertel
0ffef75d7b Move background jobs to cron 2022-11-17 09:50:41 -05:00
Jason Ertel
c572848ece temporarily remove filecheck for debug purposes 2022-11-17 08:06:24 -05:00
Jason Ertel
7cd5d625d1 temporarily remove salt-pipe for debug purposes 2022-11-16 20:45:50 -05:00
Jason Ertel
4497037442 Use bg:True to send cmd to background 2022-11-16 20:03:54 -05:00
weslambert
c14c8c1306 Merge pull request #9154 from Security-Onion-Solutions/fix/ics_scada_ingest_pipeline_updates_2_4
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 16:17:19 -05:00
Wes
638a3568b0 Update ingest node pipelines for ICS/SCADA protocols 2022-11-16 21:11:21 +00:00
Josh Brower
98af16055c Merge pull request #9151 from Security-Onion-Solutions/2.4/elasticfleet-ag
Initial support for Elastic Fleet Package Registry
2022-11-16 08:45:29 -05:00
Josh Brower
8db49feb32 Use our docker image 2022-11-16 08:24:25 -05:00
Josh Brower
48d191b656 Merge remote-tracking branch 'remotes/origin/2.4/dev' into 2.4/elasticfleet-ag 2022-11-15 12:13:05 -05:00
Doug Burks
a2da8e5e08 Merge pull request #9129 from Security-Onion-Solutions/dougburks-patch-1
fix descriptions in files related to analyzers
2022-11-12 19:26:34 +00:00
Doug Burks
632464335f fix descriptions in files related to analyzers 2022-11-12 13:14:02 -05:00
Doug Burks
f77db78219 fix descriptions in files related to analyzers 2022-11-12 13:13:30 -05:00
Doug Burks
2f4ce91678 fix descriptions in files related to analyzers 2022-11-12 13:12:58 -05:00
Doug Burks
154dff98de fix descriptions in files related to analyzers 2022-11-12 13:12:23 -05:00
Doug Burks
a15ca3cc49 fix descriptions in files related to analyzers 2022-11-12 13:11:38 -05:00
Doug Burks
a6ad7fa3ac Merge pull request #9125 from Security-Onion-Solutions/dougburks-patch-2
FIX: Avoid deprecation warning in Zeek file extraction script #9123
2022-11-11 21:33:43 +00:00
Doug Burks
40f5bb25ef FIX: Avoid deprecation warning in Zeek file extraction script #9123 2022-11-11 16:28:23 -05:00
Josh Patterson
7420c31411 Merge pull request #9096 from Security-Onion-Solutions/salt3005.1_2.4
roll back to salt 3004.2
2022-11-08 15:47:00 -05:00
m0duspwnens
00cb0f5abb roll back to salt 3004.2 2022-11-08 15:45:18 -05:00
Mike Reeves
bf31b593ed Merge pull request #9055 from Security-Onion-Solutions/strelkastuff
Strelkastuff
2022-11-08 13:45:42 -05:00
Josh Patterson
4870b4b91f Merge pull request #9095 from Security-Onion-Solutions/salt3005.1_2.4
upgrade to salt 3005.1
2022-11-08 13:45:24 -05:00
m0duspwnens
1a678064dc upgrade to salt 3005.1 2022-11-08 13:42:24 -05:00
Josh Brower
c389944e5c Initial support for Elastic Package Registry 2022-11-08 09:56:53 -05:00
Mike Reeves
de19a4dc53 Add Strelka Filecheck 2022-11-02 10:04:33 -04:00
Mike Reeves
d97de9fd0d Add Strelka Filecheck 2022-11-02 10:02:21 -04:00
Mike Reeves
bf5df1ac51 Add Strelka Filecheck 2022-11-02 09:57:07 -04:00
Mike Reeves
225c33e5c9 Add Strelka Filecheck 2022-11-02 09:46:23 -04:00
Mike Reeves
4187363451 Add Strelka Filecheck 2022-11-02 09:44:08 -04:00