Josh Brower
378c99ae88
Fix bindings
2024-02-02 18:27:49 -05:00
Corey Ogburn
8f81c9eb68
Updating config for Detection(s)
2024-02-02 11:49:58 -07:00
Pete
cf83d1cb86
feat: use mountpoint for Elastic log limit
...
Instead of just existence, this checks if the directories are separate mountpoints when determining disk size and log_size_limit calculations.
It also sets the percentage to 80 if /nsm/elasticsearch is a separate mountpoint. This allows for better disk utilization on server configurations where /nsm is based on large slow HDDs for increased PCAP retention but /nsm/elasticsearch is based on SSDs for faster Elasticsearch performance.
2024-02-02 12:25:16 -05:00
Pete
7a29b3a529
call salt before stopping salt services
...
salt-call does not work when the salt-master is not running. If these calls are to succeed, they should occur before the salt services are stopped.
2024-02-02 08:45:01 -05:00
Josh Brower
fe196b5661
Add SOC Config for Detections
2024-02-01 12:22:50 -05:00
m0duspwnens
61ee41e431
Merge remote-tracking branch 'origin/2.4/dev' into salt3006.6
2024-02-01 11:07:06 -05:00
m0duspwnens
0d5db58c86
upgrade salt3006.6
2024-02-01 10:32:41 -05:00
Josh Brower
3d478b92b2
Merge pull request #12294 from Security-Onion-Solutions/jppffa
...
Jppffa
2024-02-01 09:47:18 -05:00
Josh Brower
e090518b59
Refactor script
2024-02-01 09:46:53 -05:00
weslambert
91c1e595ef
Merge pull request #12297 from Security-Onion-Solutions/feature/pipeline_config_ui
...
Manage custom Elasticsearch and Logstash pipelines in UI
2024-02-01 09:18:30 -05:00
Wes
1818e134ca
Change numbers for Logstash
2024-02-01 14:01:55 +00:00
Wes
182667bafb
Change numbers for Elasticsearch
2024-02-01 13:59:23 +00:00
Josh Brower
49b5788ac1
add bindings
2024-02-01 07:21:49 -05:00
Josh Brower
881d6b313e
Update VERSION - kilo
2024-01-31 17:04:11 -05:00
Josh Brower
db057b4dfa
Merge pull request #12296 from Security-Onion-Solutions/cogburn/detection_playbooks
...
Cogburn/detection playbooks
2024-01-31 16:48:51 -05:00
Wes
136097f981
Custom Logstash pipeline annotations
2024-01-31 21:47:09 +00:00
Wes
bc502cc065
Custom Elasticserach pipeline annotations
2024-01-31 21:46:33 +00:00
m0duspwnens
ae32ac40c2
add fleet node nginx to docker annotations
2024-01-31 16:28:45 -05:00
m0duspwnens
2f03248612
use different nginx defaults for so-fleet node hosting artifacts
2024-01-31 16:25:09 -05:00
Mike Reeves
a094d1007b
Merge pull request #12293 from Security-Onion-Solutions/TOoSmOotH-patch-3
...
fix salt lock for airgap version mismatches
2024-01-31 16:21:16 -05:00
Mike Reeves
341ff5b564
Update so-functions
2024-01-31 16:18:51 -05:00
Josh Brower
0fe96bfc2d
switch to symlink
2024-01-31 16:17:40 -05:00
Wes
4672a5b8eb
Custom pipeline configuration in UI
2024-01-31 20:18:17 +00:00
Wes
1853dc398b
Custom pipeline configuration
2024-01-31 20:17:33 +00:00
Wes
bc75be9402
Custom pipelines in UI
2024-01-31 20:16:48 +00:00
Wes
cd4bd6460a
Custom pipelines
2024-01-31 20:16:18 +00:00
Corey Ogburn
585147d1de
Added so-detection mapping in elasticsearch
2024-01-31 10:39:47 -07:00
Mike Reeves
0d01d09d2e
fix pcap paths
2024-01-31 09:15:35 -05:00
Pete
1192dbd530
also remove intca symlink
...
The symlink is created in init.sls; it should be removed here.
2024-01-31 09:01:56 -05:00
Mike Reeves
00289c201e
fix pcap paths
2024-01-31 08:58:57 -05:00
Corey Ogburn
858166bcae
WIP: Detections Changes
...
Removed some strelka/yara rules from salt.
Removed yara scripts for downloading and updating rules. This will be managed by SOC.
Added a new compile_yara.py script.
Added the strelka repos folder.
2024-01-30 15:43:51 -07:00
m0duspwnens
4be1214bab
pcap engine logic for sensoroni
2024-01-30 16:53:57 -05:00
Corey Ogburn
0fa4d92f8f
socsigmarepo
...
Need write permissions on the /opt/so/rules dir so I can clone the sigma repo there.
2024-01-30 14:49:05 -07:00
m0duspwnens
8a25748e33
grammar
2024-01-30 16:06:24 -05:00
m0duspwnens
8b503e2ffa
telegraf dont run stenoloss script if suricata is pcap engine
2024-01-30 15:58:11 -05:00
Jorge Reyes
4dd0b4a4fd
Merge pull request #12283 from Security-Onion-Solutions/reyesj2-patch-6
...
Remove remediate from initial oscap scan
2024-01-30 15:56:13 -05:00
reyesj2
b5ffa186fb
Remove remediate from initial oscap scan
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2024-01-30 15:54:23 -05:00
m0duspwnens
f32cb1f115
fix find to work with steno and suri pcap
2024-01-30 15:48:10 -05:00
m0duspwnens
8ed66ea468
disable stenographer if suricata is pcap engine
2024-01-30 15:22:32 -05:00
m0duspwnens
0522dc180a
map pcap dir to container. enable pcap-log in map
2024-01-30 13:39:35 -05:00
m0duspwnens
37dcb84a09
add missing comma
2024-01-30 10:50:01 -05:00
m0duspwnens
d118ff4728
add GLOBALS.pcap_engine
2024-01-29 16:54:08 -05:00
Mike Reeves
88d2ddba8b
add placeholder for telegraf
2024-01-29 15:53:54 -05:00
Mike Reeves
ab551a747d
Threads placeholder logic
2024-01-29 15:44:57 -05:00
Mike Reeves
88c01a22d6
Add annotation logic
2024-01-29 15:27:28 -05:00
Mike Reeves
0c969312e2
Add Globals
2024-01-29 15:22:20 -05:00
Mike Reeves
5b05aec96a
Target sspecific minion
2024-01-29 14:56:51 -05:00
Mike Reeves
1a2245a1ed
Add so-minion modifications
2024-01-29 13:44:53 -05:00
Josh Brower
0d08bb0a91
Finalize script
2024-01-29 11:37:28 -05:00
Jorge Reyes
cb5e111a00
Merge pull request #12267 from Security-Onion-Solutions/reyesj2-patch-6
...
Update soup
2024-01-29 10:22:35 -05:00
