CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 12:53:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,667 Commits 40 Branches 127 Tags
ca71c00f1cd2fd7b6fddf3a5877b459941c23721
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub d31ea4097d Merge pull request #10683 from Security-Onion-Solutions/fix/kibana_http_search 
Kibana dashboard changes
 2023-06-30 17:17:37 -04:00
Wes c277b7acfa Change Zeek file from evet dataset to tags 2023-06-30 20:24:10 +00:00
Wes 6bdccec6b1 Add asterisk back to Modbus search 2023-06-30 19:01:53 +00:00
Wes 8b38cbe8cf Fix Modbus since the previous fix was reverted 2023-06-30 17:38:05 +00:00
Wes 35ea084466 Update from exported saved objects again 2023-06-30 16:55:00 +00:00
Wes e2acf027a9 Update from exported saved objects 2023-06-30 16:01:50 +00:00
Wes 273e78da94 Modbus dashboard - use asterisk 2023-06-30 15:03:20 +00:00
Wes 446376395e Modbus dashboard - use tags 2023-06-30 13:56:08 +00:00
Wes a13001dce0 PE dashboard - use tags 2023-06-30 13:40:36 +00:00
Wes 8819e1d4d6 HTTP search - use tags 2023-06-30 13:02:00 +00:00
weslambertandGitHub add72d7a5c Merge pull request #10670 from Security-Onion-Solutions/fix/kibana_dashboards 
Kibana Dashboards - Remove Wazuh reference and use tags
 2023-06-28 09:41:19 -04:00
Wes 8436b647dd Remove Wazuh and use tags 2023-06-27 18:05:04 +00:00
weslambertandGitHub c2efd7ef64 Merge pull request #10655 from Security-Onion-Solutions/feature/supported_integrations 
Restructure Elasticsearch templates for supported integrations
 2023-06-26 09:43:10 -04:00
weslambertandGitHub 05b84327b8 Fix typo 2023-06-23 16:32:57 -04:00
weslambertandGitHub e02bdffe34 Fix typos 2023-06-23 16:10:22 -04:00
weslambertandGitHub e2ff48164b Only load if so-elastic-fleet-common exists 2023-06-23 16:03:58 -04:00
weslambertandGitHub aa91c1fef2 Add empty object for index_settings 2023-06-23 15:57:30 -04:00
weslambertandGitHub ff7db0be63 Remove old index settings 2023-06-23 15:31:11 -04:00
Wes b96d3473f2 Fix indentation 2023-06-23 18:38:04 +00:00
Wes 62fa15c63e Add more templates 2023-06-23 14:43:15 +00:00
weslambertandGitHub e995576b1d Remove extra templates 2023-06-23 09:41:49 -04:00
Wes 5e8748c436 Load Elasticsearch templates 2023-06-23 13:28:01 +00:00
Wes e2cca917c1 Add package load command to Fleet setup 2023-06-23 13:26:06 +00:00
Wes d8700137d2 Add updated so-elasticsearch-templates-load 2023-06-23 13:23:29 +00:00
Wes 2c42d4b19e Add package check to so-elasticsearch-templates-load 2023-06-23 13:22:51 +00:00
Wes a3c7e40c40 Add package load command 2023-06-23 13:20:05 +00:00
Wes 94fe456e28 Add package functions 2023-06-23 13:19:20 +00:00
Wes 662db41857 Add default packages 2023-06-23 13:17:38 +00:00
weslambertandGitHub 6b97d07a89 Merge pull request #10629 from Security-Onion-Solutions/fix/elasticsearch_ingest_suricata_xff_ip 
Parse xff
 2023-06-22 08:45:58 -04:00
weslambertandGitHub 7e37cd0f05 Parse xff 2023-06-21 14:29:54 -04:00
Wes 3a34da354f Use append instead of set 2023-06-15 16:35:43 +00:00
Wes 58a63e0765 Remove extra comma 2023-06-15 14:22:37 +00:00
Wes b5bccc5e05 Use module in dataset name and add dataset tag 2023-06-15 13:06:57 +00:00
weslambertandGitHub 03082339ca Merge pull request #10592 from Security-Onion-Solutions/fix/analyzer_dependencies 
Update analyzer dependencies
 2023-06-14 12:22:06 -04:00
weslambertandGitHub 3f1741e75a Merge pull request #10585 from Security-Onion-Solutions/fix/elasticsearch_templates 
Update Elasticsearch templates for Fleet
 2023-06-14 09:33:23 -04:00
Wes 48331ce35b Add system.system component templates 2023-06-14 13:29:11 +00:00
Wes c2ac60b82e Add system.system template and add event-mappings 2023-06-14 13:28:00 +00:00
Wes c205438771 Update dependencies 2023-06-14 02:35:29 +00:00
Wes 8cde05807c Remove elastic-agent dir 2023-06-13 21:33:04 +00:00
Wes 2ac0aba916 Add osquery files 2023-06-13 21:32:02 +00:00
Wes af003cc2a1 Add osquery templates 2023-06-13 20:43:39 +00:00
Wes bd7644a557 Add another template 2023-06-13 19:13:20 +00:00
Wes 5547a1b7ab Add event mappings 2023-06-13 18:23:50 +00:00
Wes 1b90fd8581 Add custom component templates 2023-06-13 18:21:45 +00:00
Wes e43b7607bb Add more component templates 2023-06-13 17:04:03 +00:00
Wes a265c06e31 Add other component templates 2023-06-13 15:47:25 +00:00
Wes 2aa954cb0a Add component templates 2023-06-13 15:25:23 +00:00
Wes 73812b11a3 Allow ingest node pipelines that start with a period 2023-06-13 13:37:56 +00:00
Wes 38ab426470 Add final Fleet pipeline 2023-06-13 13:36:26 +00:00
Wes d0a6881c2c Add event mappings and remove meta information for now 2023-06-13 13:35:46 +00:00
Wes 57268ba934 Change priority of templates 2023-06-12 14:29:45 +00:00
Wes 1208915896 Remove Elastic Agent package templates 2023-06-12 14:24:59 +00:00
Wes 42f5ad9939 Add templates for system.auth and systen.syslog 2023-06-12 14:23:24 +00:00
weslambertandGitHub 32f3ee0b01 Merge pull request #10564 from Security-Onion-Solutions/fix/elasticsearch_templates 
Update templates for integrations
 2023-06-12 09:05:31 -04:00
Wes ad5a424c03 Update templates for integrations 2023-06-09 18:32:50 +00:00
weslambertandGitHub d1c86cb9ff Merge pull request #10550 from Security-Onion-Solutions/kilo 
Elastalert and EQL
 2023-06-08 11:21:18 -04:00
weslambertandGitHub 8ccb24dda2 Update version to 2.4.3 2023-06-08 11:05:05 -04:00
weslambertandGitHub 932054e9da Update version to 2.4.0 2023-06-08 11:04:45 -04:00
weslambertandGitHub f68527d366 Merge pull request #10541 from Security-Onion-Solutions/fix/curator_action_ignore_empty_list 
Use ignore_empty_list
 2023-06-07 10:36:38 -04:00
Wes 81e3d26540 Ignore empty list 2023-06-07 13:14:52 +00:00
weslambertandGitHub 96b60fa39a Restore original URL syntax, but use data stream 2023-06-06 20:53:05 -04:00
weslambertandGitHub f172a74fbc Remove EQL setting 2023-06-06 20:51:29 -04:00
weslambertandGitHub c4be56ec7b Update host syntax 2023-06-06 20:51:03 -04:00
weslambertandGitHub 96195806ab Update version to 2.4.0-kilo 2023-06-06 20:50:10 -04:00
weslambertandGitHub 88bbd3440d Merge pull request #10522 from Security-Onion-Solutions/fix/playbook_index 
Change Playbook index to a data stream and update mapping for event.severity_label
 2023-06-06 09:03:49 -04:00
Wes 495a9c0783 Add mapping for event.severity_label 2023-06-05 21:19:37 +00:00
Wes 905bc564fc Change data stream name 2023-06-05 21:18:47 +00:00
Wes f6f387428f Update Playbook alerter to write to a data stream 2023-06-05 21:17:10 +00:00
weslambertandGitHub 236eb0cbcc Merge pull request #10515 from Security-Onion-Solutions/fix/analyzers 
Update requests and whoisit
 2023-06-05 12:12:59 -04:00
Wes 841d0b4b1f Update dependencies after git add 2023-06-05 15:42:55 +00:00
Wes 272f97e2d7 Update dependencies 2023-06-05 15:42:38 +00:00
Wes eac9a3fc86 Update requests and whoisit 2023-06-05 15:41:01 +00:00
weslambertandGitHub 3a5a59af59 Merge pull request #10485 from Security-Onion-Solutions/fix/elastic_fleet_dedicated 
Add so-fleet role logic
 2023-05-31 16:04:40 -04:00
Wes 302e580d8f Add so-fleet role logic 2023-05-31 19:56:17 +00:00
weslambertandGitHub 540ee156db Merge pull request #10469 from Security-Onion-Solutions/fix/elastic_fleet_dynamic_configuration 
Use Fleet pillar instead of Zeek
 2023-05-31 12:36:39 -04:00
Wes 344e2bf1d0 Update defaults file 2023-05-31 15:30:03 +00:00
Wes 3441c0684e Create elasticfleet pillar dir 2023-05-31 15:10:35 +00:00
Wes ed560f19d3 Remove where not applicable 2023-05-31 14:28:43 +00:00
Wes b3f6012856 Change ordering 2023-05-31 14:22:47 +00:00
Wes 9ae26ec866 Add Fleet to top file 2023-05-31 14:21:39 +00:00
Wes 20aaa79476 Add pillar files for Fleet 2023-05-31 13:45:19 +00:00
Wes 2bb77251b0 Move Elastic Fleet logging exclusions to the Fleet pillar 2023-05-31 13:38:58 +00:00
weslambertandGitHub 36791665f3 Merge pull request #10462 from Security-Onion-Solutions/feature/elastic_agent_zeek_logging 
Dynamic integration configuration and Zeek log exclusions for Elastic Agent
 2023-05-30 19:27:13 -04:00
Wes f3be63051b Remove Fleet configuration 2023-05-30 20:48:43 +00:00
Wes e4b4bbcfdc Use ZEEKMERGED from zeek/config.map.jinja 2023-05-30 19:51:13 +00:00
Wes b6e090f29f Move Elastic Fleet logic in so-common to so-elastic-fleet-common 2023-05-30 18:43:56 +00:00
weslambertandGitHub 25006ed20b Merge pull request #10455 from Security-Onion-Solutions/fix/curator_cluster_delete_delete 
Update so-elasticsearch-cluster-space-used and so-curator-cluster-delete-delete
 2023-05-30 14:28:22 -04:00
Wes 4469a93a75 Fix typo 2023-05-30 18:24:30 +00:00
Wes 096dadf9bd Change 1024 to 1000 for gigabytes 2023-05-30 17:29:42 +00:00
Wes b441fe662f Change 1024 to 1000 for gigabytes 2023-05-30 17:28:59 +00:00
Wes e5117a343d Change description 2023-05-30 17:10:17 +00:00
Wes b9d692eb0e Remove default value 2023-05-30 17:08:52 +00:00
Wes 36a7f54160 Add extension 2023-05-30 16:46:38 +00:00
Wes 9035fa3037 Don't load Elasticsearch integration 2023-05-30 15:46:00 +00:00
Wes b4b87e5620 Only provide JSON output 2023-05-30 15:43:31 +00:00
Wes 97c53d70a4 Remove integrations 2023-05-30 14:05:40 +00:00
Wes 53b4f7bd5c Add spacing 2023-05-30 14:05:11 +00:00
Wes 79014a53ec Remove extra lines 2023-05-30 12:35:32 +00:00
Wes e910f04beb Add default description and Zeek log exclusions for Elastic Fleet 2023-05-30 03:10:52 +00:00
Wes ef5b63337b Add check for integration existence and integration update functionality 2023-05-30 02:58:00 +00:00