 Wes Lambert
|
cbfe375407
|
Custom analyzer and responder dirs
|
2020-06-17 13:16:52 +00:00 |
|
 weslambertandGitHub
|
91c32725fb
|
Merge pull request #851 from Security-Onion-Solutions/fix/es_field_fixes
Fix/es field fixes
|
2020-06-15 12:59:01 -04:00 |
|
|
Wes Lambert
|
f3c9f2e5ea
|
update templates
|
2020-06-15 16:57:46 +00:00 |
|
|
Wes Lambert
|
206261fbe6
|
rename id to log.id.fuid for X509
|
2020-06-15 16:55:14 +00:00 |
|
|
Wes Lambert
|
18547e8ea8
|
enforce field types
|
2020-06-15 16:54:33 +00:00 |
|
|
weslambertandGitHub
|
014274930a
|
Merge pull request #815 from Security-Onion-Solutions/fix/syslog_cleanup
Clean up some stuff
|
2020-06-02 15:32:32 -04:00 |
|
|
weslambertandGitHub
|
c91bc0e681
|
Clean up some stuff
|
2020-06-02 15:31:48 -04:00 |
|
|
weslambertandGitHub
|
98e0f0d7d8
|
Merge pull request #814 from Security-Onion-Solutions/feature/syslog
Feature/syslog
|
2020-06-02 13:39:23 -04:00 |
|
|
Wes Lambert
|
8cac30728b
|
update Logstash config
|
2020-06-02 17:36:36 +00:00 |
|
|
Wes Lambert
|
91673a5d70
|
Update FB config
|
2020-06-02 17:33:42 +00:00 |
|
|
weslambertandGitHub
|
551c663046
|
Merge pull request #808 from Security-Onion-Solutions/fix/tunnel_parents
Rename tunnel_parents
|
2020-06-01 09:52:55 -04:00 |
|
|
Wes Lambert
|
51f5d64ef6
|
Rename tunnel_parents
|
2020-06-01 13:51:32 +00:00 |
|
|
weslambertandGitHub
|
fa8b88b090
|
Merge pull request #806 from Security-Onion-Solutions/feature/vxlan_tunnel_id
fix naming of uid field for tunnel
|
2020-06-01 08:54:12 -04:00 |
|
|
Wes Lambert
|
d7ce3d4719
|
fix naming of uid field for tunnel
|
2020-06-01 12:52:57 +00:00 |
|
|
weslambertandGitHub
|
2601ffe902
|
Merge pull request #797 from Security-Onion-Solutions/fix/radius_parsing
fix framed_addr field
|
2020-05-29 07:56:22 -04:00 |
|
|
Wes Lambert
|
4059121dd6
|
fix framed_addr field
|
2020-05-29 11:55:18 +00:00 |
|
|
weslambertandGitHub
|
f5300d3d5a
|
Merge pull request #794 from Security-Onion-Solutions/feature/zeek-stats
Add basic Zeek stats script
|
2020-05-28 13:55:43 -04:00 |
|
|
Wes Lambert
|
7f75050682
|
Add basic Zeek stats script
|
2020-05-28 17:54:15 +00:00 |
|
|
weslambertandGitHub
|
7c232318ad
|
Merge pull request #793 from Security-Onion-Solutions/fix/so-stop-exact-match
Update for exact match (ex. thehive, thehive-es, thehive-cortex)
|
2020-05-28 13:17:56 -04:00 |
|
|
weslambertandGitHub
|
b835c2e27e
|
Update for exact match (ex. thehive, thehive-es, thehive-cortex)
|
2020-05-28 13:17:31 -04:00 |
|
|
weslambertandGitHub
|
ae6f028666
|
Merge pull request #792 from Security-Onion-Solutions/fix/suricata_config_nsm
Move eve.json to /nsm
|
2020-05-28 13:00:15 -04:00 |
|
|
weslambertandGitHub
|
12f426d4f4
|
Move eve.json to /nsm
|
2020-05-28 12:59:41 -04:00 |
|
|
weslambertandGitHub
|
8291de40cf
|
Merge pull request #791 from Security-Onion-Solutions/fix/socto-ip-hostname
add master to SOCtopus hosts file
|
2020-05-28 12:46:57 -04:00 |
|
|
Wes Lambert
|
869bfb947d
|
add master to SOCtopus hosts file
|
2020-05-28 16:45:48 +00:00 |
|
|
weslambertandGitHub
|
9de1a25703
|
Merge pull request #789 from Security-Onion-Solutions/fix/filebeat_init
Fix filebeat init
|
2020-05-28 12:11:39 -04:00 |
|
|
weslambertandGitHub
|
d2263db0ff
|
Update init.sls
|
2020-05-28 12:11:08 -04:00 |
|
|
weslambertandGitHub
|
c775e583dd
|
Merge pull request #788 from Security-Onion-Solutions/feature/filebeat-syslog-fw
allow syslog
|
2020-05-28 09:58:15 -04:00 |
|
|
Wes Lambert
|
b7d7747f65
|
allow syslog
|
2020-05-28 13:56:02 +00:00 |
|
|
weslambertandGitHub
|
3883c8bfe0
|
Merge pull request #784 from Security-Onion-Solutions/feature/filebeat-syslog
Feature/filebeat syslog
|
2020-05-28 08:39:11 -04:00 |
|
|
Wes Lambert
|
d2b93d531e
|
Basic syslog config
|
2020-05-28 12:36:29 +00:00 |
|
|
Wes Lambert
|
5afc05feb2
|
Update FB init for syslog
|
2020-05-28 12:35:22 +00:00 |
|
|
Wes Lambert
|
b9bdca509e
|
update Filebeat config for syslog
|
2020-05-28 12:33:41 +00:00 |
|
|
weslambertandGitHub
|
04800277c2
|
Merge pull request #783 from Security-Onion-Solutions/fix/hive_rename_bug
Hive to TheHive
|
2020-05-27 15:44:22 -04:00 |
|
|
weslambertandGitHub
|
6a935b5452
|
Hive to TheHive
|
2020-05-27 15:43:41 -04:00 |
|
|
weslambertandGitHub
|
9595d63c01
|
Merge pull request #782 from Security-Onion-Solutions/feature/thehive-start-stop-restart
Add Hive/ES/Cortex scripts
|
2020-05-27 13:46:18 -04:00 |
|
|
Wes Lambert
|
b80eb5f73b
|
Add Hive/ES/Cortex scripts
|
2020-05-27 17:43:17 +00:00 |
|
|
weslambertandGitHub
|
f07d6dfb30
|
Merge pull request #780 from Security-Onion-Solutions/fix/thehive_path
Rename Hive to TheHive in several places
|
2020-05-27 13:22:57 -04:00 |
|
|
Wes Lambert
|
b26f6826dd
|
Rename Hive to TheHive in several places
|
2020-05-27 17:17:55 +00:00 |
|
|
weslambertandGitHub
|
58f4cce4f3
|
Merge pull request #779 from Security-Onion-Solutions/fix/suricata_log_path
Fix/suricata log path
|
2020-05-27 13:03:10 -04:00 |
|
|
Wes Lambert
|
d56bc4c167
|
fix path
|
2020-05-27 17:01:05 +00:00 |
|
|
Wes Lambert
|
3684cdf1c6
|
Update FB and LS
|
2020-05-27 17:00:09 +00:00 |
|
|
Wes Lambert
|
e78a3f3278
|
update Suricata config
|
2020-05-27 16:59:26 +00:00 |
|
|
Wes Lambert
|
b7a0f79038
|
Update Suricata init
|
2020-05-27 16:58:31 +00:00 |
|
|
weslambertandGitHub
|
042618cd8f
|
Merge pull request #777 from Security-Onion-Solutions/fix/strelka_init
Wrap with quotes
|
2020-05-27 09:03:06 -04:00 |
|
|
weslambertandGitHub
|
f3809cb93d
|
Wrap with quotes
|
2020-05-27 08:31:14 -04:00 |
|
|
weslambertandGitHub
|
0b200d15fd
|
Merge pull request #768 from Security-Onion-Solutions/fix/es_watermark
Update ES watermark settings
|
2020-05-26 10:19:57 -04:00 |
|
|
Wes Lambert
|
0e51ab41cf
|
Update ES watermark settings
|
2020-05-26 14:18:58 +00:00 |
|
|
weslambertandGitHub
|
8aa2cab680
|
Merge pull request #767 from Security-Onion-Solutions/fix/so_index_transition
Fix/so index transition
|
2020-05-26 10:08:20 -04:00 |
|
|
Wes Lambert
|
97306d3acd
|
rename indices
|
2020-05-26 14:05:33 +00:00 |
|
|
Wes Lambert
|
3eb62287ac
|
update Curator config for index transition
|
2020-05-26 14:00:16 +00:00 |
|
|
weslambertandGitHub
|
956926d870
|
Merge pull request #766 from Security-Onion-Solutions/fix/soctopus_host
update SOCtopus config for hostname/ip
|
2020-05-26 09:20:43 -04:00 |
|
|
Wes Lambert
|
330de46249
|
update SOCtopus config for hostname/ip
|
2020-05-26 13:19:15 +00:00 |
|
|
weslambertandGitHub
|
b5bd6e6144
|
Merge pull request #765 from Security-Onion-Solutions/fix/strelka_cron
update Strelka cron
|
2020-05-26 09:01:24 -04:00 |
|
|
Wes Lambert
|
e09027e795
|
update Strelka cron
|
2020-05-26 13:00:03 +00:00 |
|
|
weslambertandGitHub
|
43a8ec6f50
|
Merge pull request #719 from Security-Onion-Solutions/fix/so-kibana-config
Fix/so kibana config
|
2020-05-18 09:23:17 -04:00 |
|
|
Wes Lambert
|
ee5937d038
|
update Kibana config
|
2020-05-18 13:21:18 +00:00 |
|
|
Wes Lambert
|
228bbbea5f
|
update config export
|
2020-05-18 13:16:42 +00:00 |
|
|
weslambertandGitHub
|
f7de391518
|
Merge pull request #713 from Security-Onion-Solutions/fix/kibana_config_load
change KRATOS to MASTER
|
2020-05-16 13:07:24 -04:00 |
|
|
Wes Lambert
|
23eb73a943
|
change KRATOS to MASTER
|
2020-05-16 16:31:06 +00:00 |
|
|
weslambertandGitHub
|
907702441f
|
Merge pull request #712 from Security-Onion-Solutions/fix/kibana_config_load_order
Fix load order for PLACEHOLDER
|
2020-05-16 11:49:58 -04:00 |
|
|
Wes Lambert
|
047f4e31ad
|
Fix load order for PLACEHOLDER
|
2020-05-16 15:48:55 +00:00 |
|
|
weslambertandGitHub
|
6e9784f68c
|
Merge pull request #711 from Security-Onion-Solutions/fix/kibana_config_placeholder
fix placeholder
|
2020-05-16 11:46:46 -04:00 |
|
|
Wes Lambert
|
3363a5a20a
|
fix placeholder
|
2020-05-16 15:45:52 +00:00 |
|
|
weslambertandGitHub
|
9d4397806b
|
Merge pull request #710 from Security-Onion-Solutions/fix/kibana_config_export
Fix/kibana config export
|
2020-05-16 11:35:43 -04:00 |
|
|
Wes Lambert
|
9b8cf3845a
|
update Kibana config export
|
2020-05-16 15:34:33 +00:00 |
|
|
Wes Lambert
|
89527c533a
|
update Kibana config export
|
2020-05-16 15:33:20 +00:00 |
|
|
weslambertandGitHub
|
5d7c020223
|
Merge pull request #709 from Security-Onion-Solutions/fix/kibana_config
update Kibana config
|
2020-05-16 11:09:45 -04:00 |
|
|
Wes Lambert
|
bd5cc35fc0
|
update Kibana config
|
2020-05-16 15:07:33 +00:00 |
|
|
weslambertandGitHub
|
95141574d4
|
Merge pull request #707 from Security-Onion-Solutions/fix/dhcp_parsing
Fix/dhcp parsing
|
2020-05-16 11:04:13 -04:00 |
|
|
Wes Lambert
|
4b91ade2e8
|
fix message_types one more time :)
|
2020-05-16 15:03:27 +00:00 |
|
|
Wes Lambert
|
9845ee189c
|
fix message_types for real
|
2020-05-16 15:02:41 +00:00 |
|
|
Wes Lambert
|
f0662eed48
|
remark Beat tag for now
|
2020-05-16 14:59:41 +00:00 |
|
|
Wes Lambert
|
6a2ddd4ef6
|
move to DNS
|
2020-05-16 14:58:51 +00:00 |
|
|
Wes Lambert
|
66c89abbc6
|
Fix DHCP message types
|
2020-05-16 14:58:06 +00:00 |
|
|
weslambertandGitHub
|
baf1de4b34
|
Merge pull request #700 from Security-Onion-Solutions/fix/common_type_removal
remove type field
|
2020-05-15 14:37:44 -04:00 |
|
|
Wes Lambert
|
03805bd6e2
|
remove type field
|
2020-05-15 18:29:49 +00:00 |
|
|
weslambertandGitHub
|
59ece8fd29
|
Merge pull request #699 from Security-Onion-Solutions/fix/dce_rpc_parsing
update DCE/RPC parsing
|
2020-05-15 14:20:37 -04:00 |
|
|
Wes Lambert
|
5d5f5cf105
|
update DCE/RPC parsing
|
2020-05-15 18:19:05 +00:00 |
|
 Wes LambertandWilliam Wernert
|
7ea861650f
|
updated placeholder in saved objects
|
2020-04-18 19:11:20 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
8622dab0d2
|
update load script
|
2020-04-18 19:11:19 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
66b4f15a7b
|
replace static value for comm id
|
2020-04-18 19:03:11 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
b67229783b
|
update parsing for Zeek files
|
2020-04-18 18:59:21 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
358d2f74b2
|
update key name
|
2020-04-18 18:58:27 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
0a564a438b
|
update Kibana config
|
2020-04-18 18:58:27 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
5f2fa0fdc5
|
migrate Zeek clean script from Bro
|
2020-04-18 18:56:34 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
159799c91d
|
move PL
|
2020-04-18 18:10:34 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
0c658d01ef
|
remark config load section for now
|
2020-04-18 18:10:33 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
19678aa977
|
fix order
|
2020-04-18 18:09:38 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
40e683d7a6
|
replace URL template with Label template
|
2020-04-18 18:09:38 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
0e3978b87c
|
Revert "update Kibana config"
This reverts commit 82bd14252c.
|
2020-04-18 18:09:37 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
f2b3ca8763
|
add Kibana config export command
|
2020-04-18 18:08:41 -04:00 |
|
|
Wes LambertandWilliam Wernert
|
a7bb014fba
|
update Kibana config
|
2020-04-18 18:08:40 -04:00 |
|
|
weslambertandGitHub
|
60702687d2
|
Merge pull request #576 from Security-Onion-Solutions/fix/kibana_config
Fix/kibana config
|
2020-04-16 15:00:27 -04:00 |
|
|
Wes Lambert
|
1020428e49
|
updated placeholder in saved objects
|
2020-04-16 18:58:42 +00:00 |
|
|
Wes Lambert
|
15ba411d0a
|
update load script
|
2020-04-16 18:58:14 +00:00 |
|
|
weslambertandGitHub
|
133450d2de
|
Merge pull request #567 from Security-Onion-Solutions/fix/comm_id_pivot
replace static value for comm id
|
2020-04-15 14:16:36 -04:00 |
|
|
Wes Lambert
|
9a02550c69
|
replace static value for comm id
|
2020-04-15 18:15:01 +00:00 |
|
|
weslambertandGitHub
|
3321e975bd
|
Merge pull request #562 from Security-Onion-Solutions/fix/zeek_files
update parsing for Zeek files
|
2020-04-14 09:09:40 -04:00 |
|
|
Wes Lambert
|
59787a6532
|
update parsing for Zeek files
|
2020-04-14 13:08:31 +00:00 |
|
|
weslambertandGitHub
|
84e37856f0
|
Merge pull request #560 from Security-Onion-Solutions/fix/static_rename
Update key name for Wazuh and Strelka for Filebeat
|
2020-04-13 12:10:27 -04:00 |
|