436 Commits

Author	SHA1	Message	Date
Josh Brower	a75238bc3f	so-import-evtx - fix ingest formatting	2021-09-15 14:13:16 -04:00
Josh Brower	7b93f355e2	so-import-evtx - timestamp extraction	2021-08-25 15:17:19 -04:00
Mike Reeves	71bbb41b5f	Merge branch 'dev' into bravo	2021-08-04 10:57:10 -04:00
William Wernert	8a49039b85	Only append source.ip to logscan.source.ips if it's been created	2021-08-02 09:50:49 -04:00
William Wernert	4f39cd1d7f	Add logscan dynamic object to so-common template mappings	2021-07-30 16:02:02 -04:00
William Wernert	2a6277c0c3	Fix field names in logscan pipeline	2021-07-30 15:46:39 -04:00
William Wernert	33bd6aed20	Fix logscan pipeline on eval ... * Rename logscan pipeline to logscan.alert * Add module to indices array in filebeat.yml	2021-07-30 14:41:15 -04:00
William Wernert	0b06d0bfdb	Merge branch 'dev' into foxtrot	2021-07-29 15:15:25 -04:00
Jason Ertel	4c6447a3da	merge 2.3.61 MSEARCH hotfix into dev	2021-07-29 15:00:58 -04:00
Mike Reeves	a42d8c9229	Fix Manager Search	2021-07-28 17:03:14 -04:00
doug	3d3593a1a9	FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770	2021-07-22 09:50:21 -04:00
Mike Reeves	09165daab8	Several Suricata things	2021-07-21 09:10:33 -04:00
William Wernert	9bf1d3e0c6	Misc fixes	2021-07-16 14:59:44 -04:00
William Wernert	3a12d28d20	Merge branch 'dev' into feature/logscan	2021-07-16 14:13:19 -04:00
Wes Lambert	05aad07bfc	Replace staging path with processed path for analyzed files	2021-07-14 15:04:46 +00:00
Wes Lambert	723172bc1f	Add path_unmatch for data.port so it is not mapped as integer	2021-07-14 13:45:09 +00:00
Wes Lambert	323b5d6694	Add dynamic mapping for wazuh	2021-07-14 13:43:34 +00:00
Wes Lambert	441cd3fc59	Move Wazuh-specific data to wazuh.data	2021-07-14 13:42:51 +00:00
William Wernert	e7a6172d7e	[fix] Add single quotes to strings	2021-07-13 14:07:27 -04:00
William Wernert	115e0a6fee	[fix] Add missing comma	2021-07-13 12:04:10 -04:00
William Wernert	e059c25ebc	[fix][wip] Fix pipeline parsing errors	2021-07-13 11:05:05 -04:00
William Wernert	2b0bca8e55	Merge branch 'dev' into feature/logscan	2021-07-12 14:58:30 -04:00
doug	e6f9592cde	FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770	2021-07-12 13:24:21 -04:00
William Wernert	bac7ef71d8	Add logscan.source.ips field	2021-07-09 10:55:11 -04:00
William Wernert	80525ee736	[wip] Add logscan pipeline	2021-07-08 12:29:50 -04:00
Mike Reeves	693f455862	ECS hotfix	2021-07-02 08:55:49 -04:00
weslambert	fcbacd473d	Add ELK, redis	2021-06-30 09:34:56 -04:00
weslambert	06d77d9972	Update so-common-template.json	2021-06-30 09:31:32 -04:00
Jason Ertel	5298cb8cfb	Update copyrights	2021-06-21 07:06:49 -04:00
Jason Ertel	fca1c6e957	Merge branch 'dev' into kilo	2021-06-14 10:40:04 -04:00
Mike Reeves	12d4d4a4f7	Dynamix Pipelines take 2	2021-06-10 09:19:15 -04:00
Jason Ertel	89a02383b8	Correct cronjob path issue for sysctl; suppress diff outputs from users/roles files; suppress salt state output during user sync	2021-06-09 16:31:32 -04:00
Mike Reeves	1c7741fdbe	Add templates for SO logs	2021-06-09 12:38:19 -04:00
Jason Ertel	e22421ec99	Refactor users/roles management via salt due to Salt's clobbering of the inode which breaks Docker mounts	2021-06-04 20:01:30 -04:00
weslambert	cba719b3a0	Remove extra comma	2021-06-02 16:42:09 -04:00
weslambert	4241bb08b8	Add suricata/zeek until we migrate templates	2021-06-02 16:37:43 -04:00
weslambert	4c74e7f308	Add event.kind and set name to module[dot]dataset	2021-06-02 15:35:26 -04:00
weslambert	db48c15f1d	Create event.kind field and rename dataset to be module[dot]dataset	2021-06-02 15:33:18 -04:00
Jason Ertel	fc6b3726a4	Fix missing colon for mode	2021-06-02 15:23:16 -04:00
Jason Ertel	588da4d7dc	Resolve salt pillar/state/jinja race condition	2021-06-02 14:34:21 -04:00
Mike Reeves	7b7111e12c	Fix some hunt queries	2021-06-02 13:53:39 -04:00
Mike Reeves	e00fe0a732	Enable for all modes	2021-06-02 10:02:11 -04:00
Jason Ertel	7aede4d058	Persist chown/chmod settings on users/roles files	2021-06-02 09:01:16 -04:00
m0duspwnens	7e48740ea7	fix merge conflict	2021-06-01 10:56:02 -04:00
m0duspwnens	d25a439bd4	more changes	2021-06-01 10:53:58 -04:00
Josh Patterson	c4ae8c3418	Merge pull request #4359 from Security-Onion-Solutions/pipeline_userpass ... generate pillar file if auth enabled or not	2021-06-01 09:38:34 -04:00
m0duspwnens	f87dce8ec1	generate pillar file if auth enabled or not	2021-06-01 09:38:07 -04:00
Josh Patterson	5d2f1c8e11	Merge pull request #4357 from Security-Onion-Solutions/pipeline_userpass ... fix logic	2021-06-01 08:36:48 -04:00
m0duspwnens	1aa2852ed6	fix logic	2021-06-01 08:35:43 -04:00
Jason Ertel	a42a406f53	Remove extra users file mounts; disable elastic anon access when auth enabled	2021-05-29 07:52:08 -04:00