DefensiveDepth
b4aec9a9d0
alphabetical order
2024-05-15 16:29:21 -04:00
Doug Burks
67645a662d
FEATURE: Add NetFlow dashboard #13009
2024-05-14 10:14:16 -04:00
Doug Burks
5b45c80a62
FEATURE: Add NetFlow dashboard #13009
2024-05-14 10:01:18 -04:00
DefensiveDepth
e430de88d3
Change rule updates to 24h
2024-05-13 13:15:06 -04:00
Jason Ertel
45fd07cdf8
Merge pull request #12987 from Security-Onion-Solutions/jertel/testcy
...
Add quick action to find related alerts for a detection
2024-05-09 18:08:08 -04:00
Jason Ertel
fecd674fdb
Add quick action to find related alerts for a detection
2024-05-09 17:55:41 -04:00
Corey Ogburn
1da88b70ac
Specify Error Retry Wait and Error Limit for All Detection Engines
...
If a sync errors out, the engine will wait `communityRulesImportErrorSeconds` seconds instead of the usual `communityRulesImportFrequencySeconds` seconds wait.
If `failAfterConsecutiveErrorCount` errors happen in a row when syncing detections to ElasticSearch then the sync is considered a failure and will give up and try again later. This assumes ElasticSearch is the source of the errors and backs of in hopes it'll be able to fix itself.
2024-05-07 10:34:50 -06:00
Josh Brower
b997e44715
Merge pull request #12939 from Security-Onion-Solutions/2.4/detections-airgap
...
Initial airgap support for detections
2024-05-06 15:46:29 -04:00
m0duspwnens
2431d7b028
Merge branch '2.4/detections-airgap' of https://github.com/Security-Onion-Solutions/securityonion into 2.4/detections-airgap
2024-05-06 15:27:27 -04:00
m0duspwnens
554a203541
update airgapEnabled in map file
2024-05-06 12:59:45 -04:00
DefensiveDepth
be1758aea7
Fix license and folder
2024-05-06 12:22:44 -04:00
m0duspwnens
5b966b83a9
change rulesRepos for airgap or not
2024-05-06 09:26:52 -04:00
Doug Burks
3f73b14a6a
FEATURE: Add event.dataset to all Events table layouts #12641
2024-05-06 09:20:47 -04:00
Doug Burks
f689cfcd0a
FEATURE: Add Events table columns for stun logs #12940
2024-05-06 08:52:43 -04:00
Doug Burks
7b905f5a94
FEATURE: Add Events table columns for tunnel logs #12937
2024-05-06 08:22:08 -04:00
Doug Burks
0822a46e94
FIX: Improve File dashboard #12914
2024-05-02 10:42:34 -04:00
Doug Burks
1be3e6204d
FIX: Improve File dashboard #12914
2024-05-02 10:38:56 -04:00
Josh Patterson
72b2503b49
Merge pull request #12906 from Security-Onion-Solutions/det_easr
...
Apply autoEnabledSigmaRules based on role if defined and default if not
2024-05-01 13:05:36 -04:00
m0duspwnens
7122709bbf
set Sigma rules based on role if defined and default if not
2024-05-01 12:25:34 -04:00
Corey Ogburn
ddf662bdb4
Mark Repos as Community
...
Indicate that detection rules pulled from configured repos should be marked as Community rules.
2024-04-29 16:22:30 -06:00
DefensiveDepth
f2c3c928fc
Sigma pivot fix and cleanup
2024-04-29 08:49:05 -04:00
DefensiveDepth
3c3ed8b5c5
Add runtime status logs
2024-04-24 16:33:47 -04:00
Jorge Reyes
d402943403
Merge pull request #12773 from Security-Onion-Solutions/reyesj2/kismet
...
Kismet integration for WiFi devices
2024-04-22 15:59:22 -04:00
DefensiveDepth
a237ef5d96
Update default queries
2024-04-19 16:33:35 -04:00
DefensiveDepth
ff28476191
Fix compile_yara path
2024-04-16 13:10:17 -04:00
DefensiveDepth
dbfb178556
Add test
2024-04-16 12:22:53 -04:00
DefensiveDepth
f5e42e73af
Add docs for ruleset change
2024-04-12 13:30:20 -04:00
DefensiveDepth
49ccd86c39
Fix fingerprint paths
2024-04-12 08:35:44 -04:00
reyesj2
55cf90f477
merge 2.4/dev
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:44:59 -04:00
reyesj2
c269fb90ac
Added a Kismet Wifi devices dashboard for an overview of kismet data
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-04-11 14:41:54 -04:00
DefensiveDepth
ed97aa4e78
Enable Detections Adv by default
2024-04-11 08:21:20 -04:00
Josh Brower
f72cbd5f23
Merge pull request #12755 from Security-Onion-Solutions/2.4/detections-defaults
...
2.4/detections defaults
2024-04-04 11:33:59 -04:00
DefensiveDepth
49d5fa95a2
Detections tweaks
2024-04-04 11:26:44 -04:00
Doug Burks
d8ac3f1292
FEATURE: Add dashboards specific to Elastic Agent #12746
2024-04-04 09:30:05 -04:00
Doug Burks
5ec3b834fb
FEATURE: Add Events table columns for event.module sigma #12743
2024-04-04 09:11:41 -04:00
DefensiveDepth
f66cca96ce
YARA casing
2024-04-03 16:17:29 -04:00
Corey Ogburn
0f50a265cf
Update SOC Config with State File Paths
...
Each detection engine is getting a state file to help manage the timer over restarts. By default, the files will go in soc's config folder inside a fingerprints folder.
2024-04-03 13:12:18 -06:00
Jason Ertel
3e05c04aa1
Merge pull request #12731 from Security-Onion-Solutions/jertel/ana
...
SOC Telemetry
2024-04-03 14:51:41 -04:00
Doug Burks
9078b2bad2
FEATURE: Add Events table columns for event.module kratos #12740
2024-04-03 12:46:29 -04:00
Doug Burks
66844af1c2
FEATURE: Add dashboard for SOC Login Failures #12738
2024-04-03 11:54:53 -04:00
Josh Brower
fbdcc53fe0
Merge pull request #12732 from Security-Onion-Solutions/2.4/detections-defaults
...
Feature - auto-enabled Sigma rules
2024-04-03 09:01:09 -04:00
DefensiveDepth
a8f25150f6
Feature - auto-enabled Sigma rules
2024-04-03 08:21:50 -04:00
Doug Burks
2f03cbf115
FEATURE: Add Events table columns for event.module strelka #12716
2024-04-02 10:42:20 -04:00
Doug Burks
b2b54ccf60
FEATURE: Add Events table columns for event.module strelka #12716
2024-04-02 10:11:16 -04:00
Doug Burks
6c2437f8ef
FEATURE: Add Events table columns for event.module playbook #12703
2024-04-02 09:55:56 -04:00
Doug Burks
505eeea66a
Update defaults.yaml
2024-04-02 09:39:54 -04:00
DefensiveDepth
7f488422b0
Add default columns
2024-04-02 09:13:27 -04:00
Jason Ertel
9d2b40f366
Merge branch '2.4/dev' into jertel/ana
2024-04-01 09:50:38 -04:00
Jason Ertel
3aea2dec85
analytics
2024-04-01 09:50:18 -04:00
Corey Ogburn
e5a3a54aea
Proper YAML
2024-03-29 14:31:43 -06:00
