5649986834
Merge branch '2.4/dev' into vlb2
2024-12-09 15:35:57 -05:00
dcbb0e48d4
make sure its owned by socore
2024-11-08 14:34:29 -05:00
8b70aa9f0e
Fix socore permissions
2024-11-08 09:19:41 -05:00
f5bd8ab585
Rewrite docs
2024-11-07 15:33:47 -05:00
28d468dd41
Merge remote-tracking branch 'origin/2.4/dev' into 2.4/templaterepos
2024-11-07 07:25:01 -05:00
52a144c052
Added Help Link to Annotation for IgnoredSidRanges
2024-11-05 12:11:17 -07:00
25d55feeef
More Detailed Description
2024-11-05 11:41:14 -07:00
5e48ccafce
Update Default Value
2024-11-05 11:11:34 -07:00
69dd35c30a
Add Option for Ignoring Ranges of SIDs in Suricata Integrity Check
2024-11-04 14:31:53 -07:00
efbf62f56a
adding beacon
2024-11-04 08:30:40 -05:00
5406a263d5
Add local custom template
2024-10-29 19:42:06 -04:00
c64a05f2ff
dynamic annotations
2024-10-29 10:20:31 -04:00
0c4426a55e
Merge branch '2.4/dev' into vertlybimp
2024-10-29 08:32:39 -04:00
6a3e5415cf
Merge pull request #13832 from Security-Onion-Solutions/2.4/sigmapipelines
...
Add process and file creation mappings
2024-10-28 18:30:21 -04:00
f3ca5b1c42
Remove OS-specific mappings
2024-10-28 09:19:51 -04:00
feb700393e
merge with 2.4.120, fix merge conflicts
2024-10-25 15:09:38 -04:00
6ce52bf9ab
Specify Defaults for detectionEngineStatusQueries
...
Specify the defaults as an example to the user.
2024-10-24 13:11:49 -06:00
f67fcecc6e
Clean up StatusQueries String
2024-10-24 11:18:48 -06:00
b7c392a244
Corrected a misspelling
2024-10-24 11:18:48 -06:00
ad0b0a5e95
Refactor to String
...
To accomodate the config screen, the annotation now specifies it as a multiline string with a yaml syntax. The user can edit the yaml to add or remove queries. The UI will parse the YAML before use.
Also updated the IntegrityFailure queries to specify table columns more relevant to a sync failure than the default ones.
2024-10-24 11:18:47 -06:00
c77b0afd8e
Move to Client/Detections
...
Added a basic annotation.
2024-10-24 11:18:47 -06:00
04ebe4efea
Array to Dictionary
2024-10-24 11:18:46 -06:00
cbb4d6846f
Detection Engine Status Queries
...
A few for testing
2024-10-24 11:18:45 -06:00
0476585370
dynamic annotations
2024-10-22 09:03:02 -04:00
dcdfaf66f4
Add process and file creation mappings
2024-10-16 15:20:52 -04:00
dcc1738978
dynamic annotations
2024-10-11 10:46:07 -04:00
d2bd9c0e26
Changes to allow reviews to start showing
2024-10-10 09:48:59 -06:00
778d5be407
Change summaries branch
2024-09-25 15:35:08 -04:00
cce9e162d4
remove colon to avoid yaml parsing problems
2024-09-16 15:30:14 -04:00
217bb388a0
Clarify enabled settings
2024-09-16 10:05:17 -04:00
8b8737221d
mark specific settings as allowed to include Jinja
2024-09-11 09:28:17 -04:00
f19a35ff06
move custom alerters to subgroup; avoid false positives on log check
2024-08-28 09:32:25 -04:00
6043da4424
annotation updates
2024-08-27 13:04:43 -04:00
48f1e24bf5
notification updates
2024-08-22 09:04:43 -04:00
cf47508185
notification updates
2024-08-22 09:02:32 -04:00
caa8d9ecb0
fix repo path
2024-08-09 06:58:40 -04:00
c71b9f6e8f
Fix CopyPasta
...
Strelka annotations referenced ElastAlert. Fixed.
2024-08-08 13:31:08 -06:00
8c1feccbe0
Tweak value
2024-08-08 12:53:51 -06:00
5ee15c8b41
Tweak value
2024-08-08 12:00:07 -06:00
5328f55322
Remove new config value
2024-08-08 11:43:15 -06:00
712f904c43
Config for Repo Folder
...
The folder we checkout the AI Summary repo into should definitely exist.
2024-08-08 10:57:07 -06:00
ccd7d86302
More AI Summaries Config/Annotations
...
Added aiRepoBranch to all 3 detection engines.
Added showUnreviewedAiSummaries to client parameters.
Added annotations.
2024-08-08 10:46:41 -06:00
fc89604982
New Config Values/Annotations for Ai Summaries
...
Each engine pulls the same repo into the same location and shows the summaries.
Which repo and where to keep them is advanced, but turning AI summaries on or off is not.
2024-08-06 13:55:54 -06:00
3130b56d58
Provide new setting to require OTP
2024-07-30 10:39:57 -04:00
45b2413175
Removed Allow/Deny Regexes, Added Enable/Disable Regex
...
Update config and annotations for new regex support for suricata.
2024-07-19 12:45:24 -06:00
022df966c7
Remove Allow/Deny Regex, Add Suricata Enable/Disable Regex
2024-07-19 12:28:04 -06:00
d0565baaa3
New Config Values for Detections Bulk Indexer
...
`maxScrollSize` defines the "page size" of each scroll request.
`bulkIndexerWorkerCount` defines how many worker threads a bulk indexer should use. 0 or fewer indicates that 1 thread per CPU core should be used.
2024-07-15 14:43:47 -06:00
3991c7b5fe
FEATURE: Add new action to SOC Actions list to allow users to more easily add their own actions #13346
2024-07-15 15:52:00 -04:00
dfd8ac3626
FIX: Update SOC MOTD #13320
2024-07-09 12:55:58 -04:00
50f0c43212
merge dev
2024-06-26 12:33:32 -04:00
m0duspwnens
defensivedepth
Corey Ogburn
Jason Ertel
Doug Burks