1085 Commits

Author	SHA1	Message	Date
Wes	1b47d5c622	Changes for Elastic 8.14.1	2024-07-01 15:16:58 +00:00
Wes	32d7927a49	Template changes for Elastic 8.14.1	2024-07-01 15:16:06 +00:00
reyesj2	a81e4c3362	remove dash(-) from kafka.id ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-11 11:55:17 -04:00
reyesj2	08557ae287	kafka.id field should only be present when metadata for kafka exists ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-11 11:01:34 -04:00
reyesj2	4581a46529	Merge remote-tracking branch 'remotes/origin/2.4/dev' into reyesj2/kafka	2024-06-05 20:47:41 -04:00
reyesj2	3b0339a9b3	create kafka.id from kafka {partition}-{offset}-{timestamp} for tracking event ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-04 14:27:52 -04:00
reyesj2	75bdc92bbf	Merge remote-tracking branch 'remotes/origin/2.4/dev' into reyesj2/kafka	2024-05-31 14:02:43 -04:00
Wes	a8c231ad8c	Add component templates	2024-05-31 17:47:01 +00:00
Wes	f396247838	Add index templates and lifecycle policies	2024-05-31 17:46:19 +00:00
Wes	2c635bce62	Set index for Suricata alerts	2024-05-30 17:02:31 +00:00
Wes	e831354401	Add Suricata alerts setting for configuration	2024-05-30 17:00:11 +00:00
Wes	55c5ea5c4c	Add template for Suricata alerts	2024-05-30 16:58:56 +00:00
reyesj2	1fd5165079	Merge remote-tracking branch 'origin/2.4/dev' into reyesj2/kafka ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-05-29 23:37:40 -04:00
DefensiveDepth	8e7c487cb0	Fix strelka rule.uuid	2024-05-23 05:59:31 -04:00
weslambert	f4490fab58	Add rule.uuid for YARA matches	2024-05-21 17:05:39 -04:00
weslambert	deb140e38e	Exclude detections from template name matching	2024-05-21 13:38:52 -04:00
m0duspwnens	cc6cb346e7	fix issue/13030	2024-05-16 16:31:45 -04:00
m0duspwnens	b54632080e	check if exists in override before popping	2024-05-16 16:04:17 -04:00
m0duspwnens	9796354b48	dont merge policy from global_overrides if not defined in default index_settings	2024-05-16 14:27:32 -04:00
weslambert	d606f259d1	Add detection alerts	2024-05-13 14:25:11 -04:00
weslambert	c8870eae65	Add detection alerts template	2024-05-13 14:23:47 -04:00
Doug Burks	26cb8d43e1	FIX: so-index-list typo #12988	2024-05-10 08:01:56 -04:00
Doug Burks	a1291e43c3	FIX: so-index-list typo #12988	2024-05-10 07:58:13 -04:00
reyesj2	2ad87bf1fe	merge 2.4/dev ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-05-08 16:30:45 -04:00
m0duspwnens	5dc098f0fc	remove test file	2024-05-08 08:54:24 -04:00
m0duspwnens	dcc1f656ee	predownload logstash and elastic for new searchnode and heavynode	2024-05-07 10:13:51 -04:00
reyesj2	e960ae66a3	Merge remote-tracking branch 'remotes/origin/2.4/dev' into reyesj2/kafka	2024-05-02 15:12:27 -04:00
Wes	3285ae9366	Update mappings for detection fields	2024-05-01 20:11:56 +00:00
weslambert	fe2edeb2fb	30d to 60d	2024-05-01 11:01:59 -04:00
weslambert	6294f751ee	Cold min_age to 60d	2024-05-01 10:59:41 -04:00
Doug Burks	4d6124f982	FIX: Elasticsearch min_age regex #12885	2024-04-30 10:18:34 -04:00
reyesj2	fadb6e2aa9	Re-add original timestamp format + ignore failures with this processor ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:57:48 -04:00
reyesj2	192d91565d	Update final pipeline timestamp format for event.module system events ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:34:29 -04:00
weslambert	b424426298	Exclude suricata	2024-04-25 09:14:18 -04:00
Josh Patterson	03f9160fcc	Merge pull request #12860 from Security-Onion-Solutions/issue/12856 ... allow for enabled/disable of so-elasticsearch-indices-delete cronjob	2024-04-25 09:07:44 -04:00
m0duspwnens	d50de804a8	update annotation	2024-04-25 09:04:34 -04:00
weslambert	44afa55274	Fix comments about deletion	2024-04-24 17:41:37 -04:00
weslambert	ab832e4bb2	Include logstash-prefixed indices	2024-04-24 17:17:53 -04:00
m0duspwnens	c9d9979f22	allow for enabled/disable of so-elasticsearch-indices-delete cronjob	2024-04-24 16:18:45 -04:00
weslambert	59a02635ed	Change index sorting	2024-04-24 15:18:49 -04:00
weslambert	1b3a0a3de8	Remove hot max_age	2024-04-24 10:11:02 -04:00
weslambert	75b5e16696	Update description, type, and regex	2024-04-24 09:14:39 -04:00
weslambert	8a0a435700	Fix warm description	2024-04-24 08:35:19 -04:00
weslambert	691b02a15e	Fix warm description	2024-04-23 10:40:09 -04:00
Jorge Reyes	d402943403	Merge pull request #12773 from Security-Onion-Solutions/reyesj2/kismet ... Kismet integration for WiFi devices	2024-04-22 15:59:22 -04:00
Doug Burks	406dda6051	Update so-elasticsearch-cluster-space-used	2024-04-18 11:48:15 -04:00
Doug Burks	229a989914	Update so-elasticsearch-cluster-space-total	2024-04-18 11:47:01 -04:00
Mike Reeves	67a57e9df7	Update limited-analyst.json	2024-04-17 13:14:45 -04:00
m0duspwnens	c014508519	need /opt/so/conf/ca/cacerts on receiver for kafka to run	2024-04-12 13:50:25 -04:00
reyesj2	55cf90f477	merge 2.4/dev ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-11 14:44:59 -04:00