 Wes Lambert
|
fa9be58b23
|
Specify index templates
|
2022-03-07 20:04:23 +00:00 |
|
|
Wes Lambert
|
647b316a96
|
Remove old ES index templates
Signed-off-by: Wes Lambert <wlambertts@gmail.com>
|
2022-03-07 20:02:45 +00:00 |
|
 Mike Reeves
|
d33db6fb23
|
Only load pipelines on change
|
2022-03-07 14:25:46 -05:00 |
|
|
Wes Lambert
|
c549b20221
|
Add DTC client mappings
|
2022-03-07 18:36:26 +00:00 |
|
|
Mike Reeves
|
c67604590d
|
Only load templates on change
|
2022-03-07 09:52:18 -05:00 |
|
|
Wes Lambert
|
33ba45472f
|
Replace syslog facility and severity with label fields
|
2022-03-04 21:40:41 +00:00 |
|
|
weslambert
|
f71ccadb8a
|
Change to label fields for Zeek syslog
|
2022-03-04 16:29:55 -05:00 |
|
|
weslambert
|
fc3273fa49
|
Change to label fields to comply with what's defined in Filebeat template
|
2022-03-04 16:29:01 -05:00 |
|
|
weslambert
|
254cf53c2f
|
Increase clause count to 3500
|
2022-03-04 10:36:37 -05:00 |
|
|
Wes Lambert
|
ffae22beef
|
Add DTC syslog mappings for .keyword and add refs to defaults.yml
|
2022-03-04 13:04:11 +00:00 |
|
|
Wes Lambert
|
1f71816ad7
|
Add keyword subfield for DTC winlog mappings
|
2022-03-03 14:54:30 +00:00 |
|
|
Wes Lambert
|
1c086e36da
|
Add missing comma for file mappings
|
2022-03-03 13:49:54 +00:00 |
|
|
Wes Lambert
|
aa8d24b6cd
|
Add DTC destination, source, and winlog mapping references to templates in defaults file
|
2022-03-03 13:42:20 +00:00 |
|
|
Wes Lambert
|
85979cbce8
|
Add file, process, and winlog mapping changes
|
2022-03-03 13:37:27 +00:00 |
|
|
Wes Lambert
|
8f97f09c9c
|
Additional .keyword changes for host.hostname client.address, and event.action
|
2022-03-02 21:54:46 +00:00 |
|
|
Wes Lambert
|
3ee46e4c29
|
Add .keyword for destination/source geo.country_name
|
2022-03-02 21:50:03 +00:00 |
|
|
Wes Lambert
|
c5b16fdf3b
|
Adjust field limit for now
|
2022-03-02 16:33:39 +00:00 |
|
 Josh Brower
|
2ba72791aa
|
Remove sigma regen cron
|
2022-03-02 10:31:15 -05:00 |
|
|
Wes Lambert
|
ab9b81ea39
|
Change match_only_text to text for mac in host mappings
|
2022-03-02 15:01:05 +00:00 |
|
|
Wes Lambert
|
ed620b93b7
|
Add custom analyzer definition to all SO/DTC mappings
|
2022-03-02 14:43:19 +00:00 |
|
|
Wes Lambert
|
27c8eaa630
|
Update all other mappings for .security where applicable
|
2022-03-02 14:39:23 +00:00 |
|
|
Wes Lambert
|
e925d435ff
|
Update event, file, and host mappings to include .security
|
2022-03-02 14:33:52 +00:00 |
|
|
Wes Lambert
|
496b161253
|
Update ECS mappings to include .security
|
2022-03-02 14:27:36 +00:00 |
|
|
Wes Lambert
|
aae2fd1fbb
|
Update DNS mappings to include .security
|
2022-03-02 14:27:15 +00:00 |
|
|
Wes Lambert
|
0b45cf7ae1
|
Update base mappings to include .security
|
2022-03-02 14:25:57 +00:00 |
|
|
Wes Lambert
|
d89af5f04f
|
Update agent mappings to include .security
|
2022-03-02 14:25:14 +00:00 |
|
|
Wes Lambert
|
2d2ec45029
|
Modify base ECS mappings to include .security where possible, as well as custom analyzer definition
|
2022-03-02 14:19:36 +00:00 |
|
|
Wes Lambert
|
5489b8559d
|
Revert "Switch from .security to match_only_text"
This reverts commit f7862af934.
|
2022-03-01 18:44:00 +00:00 |
|
|
Wes Lambert
|
2a9caccc7c
|
Revert "Add additional .text subfield mappings"
This reverts commit 61dadc6249.
|
2022-03-01 18:43:24 +00:00 |
|
|
Wes Lambert
|
a290602a70
|
Revert syslog pipeline updates from Abe' PR for now
|
2022-03-01 15:31:07 +00:00 |
|
|
Wes Lambert
|
038dc49098
|
Temporarily increase field limit before trimming efforts
|
2022-03-01 15:06:28 +00:00 |
|
|
Wes Lambert
|
dc07adca63
|
Rename ingest.timestamp to event.ingested
|
2022-03-01 15:05:08 +00:00 |
|
|
Josh Brower
|
e960d99901
|
Enable state tracking for sigma refresh
|
2022-02-28 21:18:41 -05:00 |
|
|
Josh Brower
|
09f1a5025d
|
Merge remote-tracking branch 'remotes/origin/dev' into delta
|
2022-02-28 21:18:07 -05:00 |
|
|
Josh Brower
|
41a58b791a
|
Enable state tracking for sigma refresh
|
2022-02-28 21:17:59 -05:00 |
|
 Jason Ertel
|
f147bb33ed
|
Upgrade to ES 7.17.1
|
2022-02-28 18:18:09 -05:00 |
|
 Josh Patterson
|
6b3b5e9a1f
|
Merge pull request #7363 from Security-Onion-Solutions/soup_singlenode_30
allow for check_log_size_limit to work without salt-master running
|
2022-02-28 17:13:42 -05:00 |
|
|
Josh Brower
|
d71bde0e38
|
Merge pull request #7362 from Security-Onion-Solutions/delta
Navigator - include attack json for airgap
|
2022-02-28 16:33:10 -05:00 |
|
|
Josh Brower
|
2075412ca2
|
Navigator - include attack json for airgap
|
2022-02-28 16:15:30 -05:00 |
|
|
m0duspwnens
|
a51f833f36
|
output only the value for log_size_limit
|
2022-02-28 16:13:43 -05:00 |
|
|
m0duspwnens
|
8d12e136f2
|
Merge remote-tracking branch 'remotes/origin/dev' into soup_singlenode_30
|
2022-02-28 15:43:37 -05:00 |
|
|
m0duspwnens
|
710059211d
|
remove debug echo, mkdir verbose
|
2022-02-28 14:54:39 -05:00 |
|
|
m0duspwnens
|
80e5198f9e
|
combine local and default pillars to get pillar values locally
|
2022-02-28 14:35:16 -05:00 |
|
|
m0duspwnens
|
dc24cb711d
|
need local to be --local
|
2022-02-28 13:50:08 -05:00 |
|
|
m0duspwnens
|
c5bf818049
|
debug messages and pass local to lookup_salt_value
|
2022-02-28 13:39:50 -05:00 |
|
|
weslambert
|
414b9dcd59
|
Run template load first to prevent issues with pipeline changes that generate new indices
|
2022-02-28 12:33:18 -05:00 |
|
|
m0duspwnens
|
cd981fa2ae
|
forgot then for if
|
2022-02-28 12:25:06 -05:00 |
|
|
m0duspwnens
|
278235b0ca
|
update so-common lookup_salt_value to accept local option. soup get minion id from grains with local option
|
2022-02-28 12:15:23 -05:00 |
|
|
weslambert
|
a9caef9596
|
Merge pull request #7338 from Security-Onion-Solutions/fix/endgame_template
Revert Endgame index name changes
|
2022-02-28 08:13:09 -05:00 |
|
 Doug Burks
|
32b71fdcac
|
Avoid changing _index for imported logs
|
2022-02-26 10:36:09 -05:00 |
|