Josh Brower
f72cbd5f23
Merge pull request #12755 from Security-Onion-Solutions/2.4/detections-defaults
...
2.4/detections defaults
2024-04-04 11:33:59 -04:00
DefensiveDepth
49d5fa95a2
Detections tweaks
2024-04-04 11:26:44 -04:00
Doug Burks
d8ac3f1292
FEATURE: Add dashboards specific to Elastic Agent #12746
2024-04-04 09:30:05 -04:00
Doug Burks
5ec3b834fb
FEATURE: Add Events table columns for event.module sigma #12743
2024-04-04 09:11:41 -04:00
DefensiveDepth
f66cca96ce
YARA casing
2024-04-03 16:17:29 -04:00
Corey Ogburn
0f50a265cf
Update SOC Config with State File Paths
...
Each detection engine is getting a state file to help manage the timer over restarts. By default, the files will go in soc's config folder inside a fingerprints folder.
2024-04-03 13:12:18 -06:00
Jason Ertel
3e05c04aa1
Merge pull request #12731 from Security-Onion-Solutions/jertel/ana
...
SOC Telemetry
2024-04-03 14:51:41 -04:00
Doug Burks
9078b2bad2
FEATURE: Add Events table columns for event.module kratos #12740
2024-04-03 12:46:29 -04:00
Doug Burks
66844af1c2
FEATURE: Add dashboard for SOC Login Failures #12738
2024-04-03 11:54:53 -04:00
Josh Brower
fbdcc53fe0
Merge pull request #12732 from Security-Onion-Solutions/2.4/detections-defaults
...
Feature - auto-enabled Sigma rules
2024-04-03 09:01:09 -04:00
DefensiveDepth
a8f25150f6
Feature - auto-enabled Sigma rules
2024-04-03 08:21:50 -04:00
Doug Burks
2f03cbf115
FEATURE: Add Events table columns for event.module strelka #12716
2024-04-02 10:42:20 -04:00
Doug Burks
b2b54ccf60
FEATURE: Add Events table columns for event.module strelka #12716
2024-04-02 10:11:16 -04:00
Doug Burks
6c2437f8ef
FEATURE: Add Events table columns for event.module playbook #12703
2024-04-02 09:55:56 -04:00
Doug Burks
505eeea66a
Update defaults.yaml
2024-04-02 09:39:54 -04:00
DefensiveDepth
7f488422b0
Add default columns
2024-04-02 09:13:27 -04:00
Jason Ertel
9d2b40f366
Merge branch '2.4/dev' into jertel/ana
2024-04-01 09:50:38 -04:00
Jason Ertel
3aea2dec85
analytics
2024-04-01 09:50:18 -04:00
Corey Ogburn
e5a3a54aea
Proper YAML
2024-03-29 14:31:43 -06:00
Doug Burks
b64ed5535e
FEATURE: Add individual dashboards for Zeek SSL and Suricata SSL logs #12699
2024-03-29 15:29:38 -04:00
Doug Burks
5be56703e9
Merge pull request #12698 from Security-Onion-Solutions/dougburks-patch-1
...
FEATURE: Add Events table columns for zeek ssl and suricata ssl #12697
2024-03-29 14:46:39 -04:00
Doug Burks
0c7ba62867
FEATURE: Add Events table columns for zeek ssl and suricata ssl #12697
2024-03-29 14:44:29 -04:00
Corey Ogburn
e747a4e3fe
New Settings for Manual Sync in Detections
2024-03-29 12:25:03 -06:00
Doug Burks
102c3271d1
FEATURE: Add process.command_line to Process Info and Process Ancestry dashboards #12694
2024-03-29 12:04:47 -04:00
Doug Burks
e2caf4668e
FEATURE: Add Events table columns for event.module elastic_agent #12666
2024-03-26 16:08:41 -04:00
Josh Brower
63a58efba4
Merge pull request #12656 from Security-Onion-Solutions/2.4/detections-fixes
...
Add bindings for sigma repos
2024-03-26 09:33:38 -04:00
Josh Brower
9c12aa261e
Merge pull request #12660 from Security-Onion-Solutions/kilo
...
Initial cut to remove Playbook and deps
2024-03-26 08:31:11 -04:00
Doug Burks
20bd9a9701
FEATURE: Include additional groupby fields in Dashboards relating to sankey diagrams #12657
2024-03-26 07:39:24 -04:00
DefensiveDepth
d7ecad4333
Initial cut to remove Playbook and deps
2024-03-25 19:42:31 -04:00
DefensiveDepth
49fa800b2b
Add bindings for sigma repos
2024-03-25 14:45:50 -04:00
Josh Brower
b8d33ab983
Merge pull request #12639 from Security-Onion-Solutions/2.4/enable-detections
...
Enable Detections
2024-03-25 09:30:01 -04:00
Corey Ogburn
237946e916
Specify Folder in Rule Repo
2024-03-22 13:52:20 -06:00
Corey Ogburn
3d04d37030
Update ElastAlert Config with Default Repos
2024-03-22 13:52:20 -06:00
Doug Burks
a78a304d4f
FEATURE: Add event.dataset to all Events column layouts #12641
2024-03-22 13:19:31 -04:00
DefensiveDepth
5ca9ec4b17
Enable Detections
2024-03-22 10:12:26 -04:00
Doug Burks
2b019ec8fe
Merge pull request #12634 from Security-Onion-Solutions/dougburks-patch-1
...
FEATURE: Add Events column layout for event.module system #12628
2024-03-22 05:52:23 -04:00
DefensiveDepth
4a33234c34
Default update to 24 hours
2024-03-21 07:26:19 -04:00
Doug Burks
778997bed4
FEATURE: Add Events column layout for event.module system #12628
2024-03-20 17:07:37 -04:00
DefensiveDepth
d84af803a6
Enable Autoupdates
2024-03-20 08:48:31 -04:00
DefensiveDepth
020eb47026
Change Detections defaults
2024-03-19 13:53:37 -04:00
m0duspwnens
1a829190ac
remove modules if detections disabled
2024-03-13 09:46:44 -04:00
DefensiveDepth
61a183b7fc
Add regex defaults
2024-03-11 15:55:39 -04:00
Corey Ogburn
6f05c3976b
Updated RulesRepo for New Strelka Structure
2024-03-08 11:29:46 -07:00
Jason Ertel
8f36a8a4b6
Merge pull request #12514 from Security-Onion-Solutions/jertel/annotations
...
detections annotations
2024-03-06 11:10:21 -05:00
Jason Ertel
167aff24f6
detections annotations
2024-03-06 11:03:52 -05:00
Josh Brower
9e671621db
Merge pull request #12510 from Security-Onion-Solutions/2.4/excludedetections
...
Add Exclusion toggle
2024-03-06 10:56:29 -05:00
Jason Ertel
12653eec8c
add new pcap annotations
2024-03-06 08:14:33 -05:00
Josh Brower
1b47537a3f
Add Exclusion toggle
2024-03-06 07:16:50 -05:00
Doug Burks
52580fb8c4
Merge pull request #12434 from Security-Onion-Solutions/feature/improve-endpoint-columns
...
Add multiple endpoint features
2024-02-26 12:05:30 -05:00
Doug Burks
f8424f3dad
Update defaults.yaml
2024-02-26 11:22:09 -05:00
