9291 Commits

Author	SHA1	Message	Date
Corey Ogburn	1da88b70ac	Specify Error Retry Wait and Error Limit for All Detection Engines ... If a sync errors out, the engine will wait `communityRulesImportErrorSeconds` seconds instead of the usual `communityRulesImportFrequencySeconds` seconds wait. If `failAfterConsecutiveErrorCount` errors happen in a row when syncing detections to ElasticSearch then the sync is considered a failure and will give up and try again later. This assumes ElasticSearch is the source of the errors and backs of in hopes it'll be able to fix itself.	2024-05-07 10:34:50 -06:00
Jason Ertel	b4817fa062	Merge pull request #12956 from Security-Onion-Solutions/jertel/testcy ... test regexes for detections	2024-05-07 08:45:38 -07:00
weslambert	2e70d157e2	Add ref	2024-05-07 11:13:51 -04:00
Wes	bee8c2c1ce	Remove watch	2024-05-07 13:21:59 +00:00
Jason Ertel	4ebe070cd8	test regexes for detections	2024-05-06 19:03:12 -04:00
weslambert	a5e89c0854	Merge pull request #12947 from Security-Onion-Solutions/fix/strelka_yara_distributed ... Fix YARA rules for distributed deployments	2024-05-06 15:53:08 -04:00
weslambert	a25e43db8f	Merge pull request #12948 from Security-Onion-Solutions/fix/strelka_yara_watch ... Restart Strelka backend when YARA rules change	2024-05-06 15:52:57 -04:00
Josh Brower	b997e44715	Merge pull request #12939 from Security-Onion-Solutions/2.4/detections-airgap ... Initial airgap support for detections	2024-05-06 15:46:29 -04:00
Wes	1e48955376	Restart when rules change	2024-05-06 19:39:03 +00:00
Wes	5056ec526b	Add compiled directory	2024-05-06 19:27:38 +00:00
m0duspwnens	2431d7b028	Merge branch '2.4/detections-airgap' of https://github.com/Security-Onion-Solutions/securityonion into 2.4/detections-airgap	2024-05-06 15:27:27 -04:00
Wes	d2fa77ae10	Update compile script	2024-05-06 19:10:41 +00:00
Wes	445fb31634	Add manager SLS	2024-05-06 19:09:37 +00:00
Wes	5aa611302a	Handle YARA rules for distributed deployments	2024-05-06 19:08:01 +00:00
m0duspwnens	554a203541	update airgapEnabled in map file	2024-05-06 12:59:45 -04:00
DefensiveDepth	be1758aea7	Fix license and folder	2024-05-06 12:22:44 -04:00
m0duspwnens	38f74d2e9e	change quotes	2024-05-06 11:38:30 -04:00
m0duspwnens	5b966b83a9	change rulesRepos for airgap or not	2024-05-06 09:26:52 -04:00
Doug Burks	3f73b14a6a	FEATURE: Add event.dataset to all Events table layouts #12641	2024-05-06 09:20:47 -04:00
Doug Burks	f689cfcd0a	FEATURE: Add Events table columns for stun logs #12940	2024-05-06 08:52:43 -04:00
DefensiveDepth	26c6a98b45	Initial airgap support for detections	2024-05-06 08:43:01 -04:00
Doug Burks	7b905f5a94	FEATURE: Add Events table columns for tunnel logs #12937	2024-05-06 08:22:08 -04:00
m0duspwnens	bdf1b45a07	redirect and throw in bg	2024-05-03 14:54:44 -04:00
m0duspwnens	3d4fd59a15	orchit	2024-05-03 13:48:51 -04:00
m0duspwnens	442a717d75	orchit	2024-05-03 12:08:57 -04:00
m0duspwnens	fa3522a233	fix requirement	2024-05-03 11:10:21 -04:00
m0duspwnens	bbc374b56e	add logic in orch	2024-05-03 09:56:52 -04:00
m0duspwnens	2929877042	fix var	2024-05-02 16:37:54 -04:00
m0duspwnens	8035740d2b	Merge remote-tracking branch 'origin/2.4/dev' into orchit	2024-05-02 16:34:24 -04:00
Josh Patterson	4f8aaba6c6	Merge pull request #12918 from Security-Onion-Solutions/pw ... run so-rule-update if ruleset or code changes for idstools	2024-05-02 16:33:24 -04:00
m0duspwnens	e9b1263249	orchestate searchnode deployment	2024-05-02 16:32:43 -04:00
Josh Patterson	3b2d3573d8	Update pillarWatch.py	2024-05-02 16:06:04 -04:00
m0duspwnens	33d1170a91	add default pillar value for pillarWatch	2024-05-02 11:58:39 -04:00
Doug Burks	0822a46e94	FIX: Improve File dashboard #12914	2024-05-02 10:42:34 -04:00
Doug Burks	1be3e6204d	FIX: Improve File dashboard #12914	2024-05-02 10:38:56 -04:00
Wes	3285ae9366	Update mappings for detection fields	2024-05-01 20:11:56 +00:00
Josh Patterson	72b2503b49	Merge pull request #12906 from Security-Onion-Solutions/det_easr ... Apply autoEnabledSigmaRules based on role if defined and default if not	2024-05-01 13:05:36 -04:00
Mike Reeves	854799fabb	Merge pull request #12902 from Security-Onion-Solutions/TOoSmOotH-patch-2 ... Update config.sls	2024-05-01 12:56:04 -04:00
m0duspwnens	47ba4c0f57	add new annotation for soc autoEnabledSigmaRules	2024-05-01 12:55:29 -04:00
Mike Reeves	10c8e4203c	Update config.sls	2024-05-01 12:54:21 -04:00
Jason Ertel	05c69925c9	Merge pull request #12904 from Security-Onion-Solutions/jertel/wf ... mark detections settings as read-only via the UI	2024-05-01 09:54:03 -07:00
Jason Ertel	252d9a5320	make rule settings advanced	2024-05-01 12:51:04 -04:00
m0duspwnens	7122709bbf	set Sigma rules based on role if defined and default if not	2024-05-01 12:25:34 -04:00
Mike Reeves	f7223f132a	Update config.sls	2024-05-01 12:00:39 -04:00
Mike Reeves	8cd75902f2	Update config.sls	2024-05-01 11:47:51 -04:00
Jason Ertel	c71af9127b	mark detections settings as read-only via the UI	2024-05-01 11:47:38 -04:00
weslambert	e6f45161c1	Merge pull request #12900 from Security-Onion-Solutions/fix/cold_min_age ... Cold min_age to 60d	2024-05-01 11:24:48 -04:00
weslambert	fe2edeb2fb	30d to 60d	2024-05-01 11:01:59 -04:00
weslambert	6294f751ee	Cold min_age to 60d	2024-05-01 10:59:41 -04:00
Jason Ertel	66563a4da0	zeek networks will only ever have one HOME_NETWORKS setting	2024-05-01 09:31:11 -04:00