CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 21:03:10 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,110 Commits 40 Branches 127 Tags
cd766753eb0a09ce41fa892c0016632ddce7eb49
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub e9af032c28 Merge pull request #1143 from Security-Onion-Solutions/feature/aws_mgr_defaults 
Add AWS defaults file for manager
 2020-08-04 10:13:07 -04:00
Wes Lambert 46f70c254c Add AWS defaults file for manager 2020-08-04 14:11:50 +00:00
weslambertandGitHub f7425b14e3 Merge pull request #1142 from Security-Onion-Solutions/feature/aws_eval_defaults 
AWS defaults modifications
 2020-08-03 23:51:32 -04:00
Wes Lambert 2290c28a07 AWS defaults modifications 2020-08-04 03:49:59 +00:00
weslambertandGitHub 12f53ce9d9 Merge pull request #1134 from Security-Onion-Solutions/fix/aws_auto_reboot 
Reboot after finished with setup
 2020-08-03 10:31:24 -04:00
weslambertandGitHub 7e2917fc99 Reboot after finished with setup 2020-08-03 10:31:03 -04:00
weslambertandGitHub 9255e77263 Merge pull request #1129 from Security-Onion-Solutions/feature/aws_standalone_defaults 
Add AWS Standalone Defaults
 2020-07-31 16:15:12 -04:00
Wes Lambert ecafbc6014 Add AWS Standalone Defaults 2020-07-31 20:12:25 +00:00
weslambertandGitHub 00ba4ca6c0 Merge pull request #1121 from Security-Onion-Solutions/fix/thehive_static 
Fix/thehive static
 2020-07-30 10:27:43 -04:00
weslambertandGitHub 4282930f08 Update cortex-application.conf 2020-07-30 10:26:49 -04:00
weslambertandGitHub c58ee8a37d Add Cortex play secret 2020-07-30 10:25:53 -04:00
weslambertandGitHub b6a053070f Change TheHive play secret 2020-07-30 10:25:07 -04:00
weslambertandGitHub 2fab00458b Add randomized play secrets for Cortex + TheHive 2020-07-30 10:23:00 -04:00
weslambertandGitHub 646bf1cb4d Merge pull request #1118 from Security-Onion-Solutions/fix/wazuh_register_to 
Fix/wazuh registration timeout
 2020-07-29 13:53:45 -04:00
weslambertandGitHub c48ba8abaf Re-arrange config 2020-07-29 13:52:12 -04:00
weslambertandGitHub 9db390023b Increase timeout from 10s to 30s 2020-07-29 13:51:46 -04:00
weslambertandGitHub 4b36c4a809 Merge pull request #1115 from Security-Onion-Solutions/fix/remove_ls_syslog 
Remove LS syslog port binding
 2020-07-29 08:35:41 -04:00
weslambertandGitHub 7d432091e2 Remove LS syslog port binding 2020-07-29 08:35:07 -04:00
weslambertandGitHub 0f6ecdf38a Merge pull request #1104 from Security-Onion-Solutions/feature/cortex_orguser 
Create default orguser if empty
 2020-07-27 09:50:23 -04:00
Wes Lambert e81fd7464b Create default orguser if empty 2020-07-27 13:49:17 +00:00
weslambertandGitHub ced51761fa Merge pull request #1103 from Security-Onion-Solutions/feature/wazuh_version 
Bump Wazuh version
 2020-07-27 09:46:27 -04:00
Wes Lambert ac5aeb4801 Bump Wazuh version 2020-07-27 13:45:34 +00:00
weslambertandGitHub 88ffd0c17c Merge pull request #1101 from Security-Onion-Solutions/feature/wazuh_symlinks 
Add Wazuh Wazuh symlinks for config/rules
 2020-07-27 08:15:58 -04:00
Wes Lambert 51e27cadc8 Add Wazuh Wazuh symlinks for cpnfig/rules 2020-07-27 12:14:43 +00:00
weslambertandGitHub 2d2bebdd9c Merge pull request #1100 from Security-Onion-Solutions/feature/wazuh_nsm 
Move Wazuh from /opt/so/ to /nsm/wazuh
 2020-07-27 07:59:39 -04:00
Wes Lambert 958ee25f6d Move Wazuh from /opt/so/ to /nsm/wazuh 2020-07-27 11:58:12 +00:00
weslambertandGitHub 2d096ddd66 Merge pull request #1096 from Security-Onion-Solutions/fix/elastalert_thehive 
Make sure we are searching all clusters when running rules
 2020-07-24 18:05:46 -04:00
Wes Lambert 3ac9f1800b Make sure we are searching all clusters when running rules 2020-07-24 22:04:30 +00:00
weslambertandGitHub 2341d9592e Merge pull request #1025 from Security-Onion-Solutions/fix/wazuh_cleanup 
Change verbiage
 2020-07-17 09:39:21 -04:00
weslambertandGitHub e91aa751a7 Change verbiage 2020-07-17 09:38:43 -04:00
weslambertandGitHub f8bb094546 Merge pull request #1014 from Security-Onion-Solutions/fix/strelka_standalone 
Fix module eval
 2020-07-16 09:32:06 -04:00
Wes Lambert 8275f458a1 Fix module eval 2020-07-16 13:30:38 +00:00
weslambertandGitHub 7fecfdab32 Update README.md 2020-07-16 08:14:47 -04:00
weslambertandGitHub f7d527bb90 Update README.md 2020-07-16 08:14:23 -04:00
weslambertandGitHub 7a36803e2c Merge pull request #1002 from Security-Onion-Solutions/fix/strelka_observer 
Add observer name for Strelka events
 2020-07-14 13:39:52 -04:00
Wes Lambert f9df39977b Add observer name for Strelka events 2020-07-14 17:38:43 +00:00
weslambertandGitHub 7ed902c0ae Merge pull request #1001 from Security-Onion-Solutions/fix/suricata_timestamp 
Convert message timestamp to @timestamp
 2020-07-14 13:34:58 -04:00
Wes Lambert d6afde90b0 Convert message timestamp to @timestamp 2020-07-14 13:37:00 +00:00
weslambertandGitHub ef64048fc6 Merge pull request #978 from Security-Onion-Solutions/fix/sensor-clean 
Fix value
 2020-07-10 17:17:57 -04:00
weslambertandGitHub eb2dc0be4c Fix value 2020-07-10 17:17:33 -04:00
weslambertandGitHub 9b079df9f5 Merge pull request #974 from Security-Onion-Solutions/fix/sensor_clean 
Fix/sensor clean
 2020-07-10 15:35:57 -04:00
Wes Lambert d7f7fb801c Set role 2020-07-10 19:35:27 +00:00
Wes Lambert 37ab252e01 Add sensor proc eval 2020-07-10 19:30:08 +00:00
weslambertandGitHub 33375a0809 Merge pull request #973 from Security-Onion-Solutions/fix/curator_logsizelimit 
Move zeek_clean to so-sensor-clean
 2020-07-10 13:57:58 -04:00
Wes Lambert 6e99ca600f Move zeek_clean to so-sensor-clean 2020-07-10 17:56:40 +00:00
weslambertandGitHub 818f7f56b2 Merge pull request #965 from Security-Onion-Solutions/feature/add_gcp_check 
Add GCP and make cloud check more generic
 2020-07-08 23:31:37 -04:00
weslambertandGitHub c01047fad2 Add /dev/null 2020-07-08 23:30:50 -04:00
weslambertandGitHub 889ba67d85 Move EC2 to more generic cloud verbiage 2020-07-08 23:27:46 -04:00
weslambertandGitHub ce00d829e1 Move EC2 to more generic cloud verbiage and check for GCP 2020-07-08 23:26:48 -04:00
weslambertandGitHub 67fb46f519 Merge pull request #963 from Security-Onion-Solutions/fix/curator_logsizelimit 
Add standalone evaluation for log_size_limit
 2020-07-08 15:40:54 -04:00
Wes Lambert f2cea273b6 Add standalone evaluation for log_size_limit 2020-07-08 19:39:14 +00:00
weslambertandGitHub beda67d2a9 Merge pull request #955 from Security-Onion-Solutions/fix/strelka_message_drop 
Drop message field and original exiftool keys
 2020-07-08 10:56:06 -04:00
weslambertandGitHub 4cf31e1ee7 Drop message field and original exiftool keys 2020-07-08 10:55:40 -04:00
weslambertandGitHub 9c11de5455 Merge pull request #953 from Security-Onion-Solutions/fix/zeek_files_uid 
Rename uids to uid
 2020-07-08 09:40:04 -04:00
weslambertandGitHub b25a3b6986 Rename uids to uid 2020-07-08 09:39:37 -04:00
weslambertandGitHub 88b7a31195 Merge pull request #952 from Security-Onion-Solutions/fix/wazuh_authdport 
Add Wazuh Authd Port
 2020-07-08 09:26:28 -04:00
weslambertandGitHub 987acaeb7b Add Wazuh Authd Port 2020-07-08 09:26:04 -04:00
weslambertandGitHub 2992938596 Merge pull request #947 from Security-Onion-Solutions/fix/strelka_exiftool 
Add fields for exiftool keys
 2020-07-07 17:13:57 -04:00
Wes Lambert 3b50ce032a Add fields for exiftool keys 2020-07-07 20:02:09 +00:00
weslambertandGitHub 34e06ecde1 Merge pull request #940 from Security-Onion-Solutions/feature/strelka_fuid 
Add Zeek FUID for Strelka records
 2020-07-07 11:01:09 -04:00
Wes Lambert e0570e1db7 Add Zeek FUID for Strelka records 2020-07-07 15:00:01 +00:00
weslambertandGitHub d334d5ab83 Merge pull request #938 from Security-Onion-Solutions/fix/strelka_filebeat 
Fix pillar reference for Strelka/FB
 2020-07-07 09:48:19 -04:00
Wes Lambert 2fdd5fd77b Fix pillar reference for Strelka/FB 2020-07-07 13:46:57 +00:00
weslambertandGitHub 0bfa3d486e Merge pull request #923 from Security-Onion-Solutions/fix/es-allow 
Fix my typo
 2020-07-02 13:32:45 -04:00
weslambertandGitHub bbc752b6d9 Fix my typo 2020-07-02 13:32:19 -04:00
Wes Lambert 26b0daf2da Add other setup-related items for EC2 interface 2020-07-01 17:42:51 +00:00
Wes Lambert 3cf79995a2 Modify Whiptail menu for EC2 NIC 2020-07-01 17:32:43 +00:00
weslambertandGitHub 0b7026a11e Merge pull request #906 from Security-Onion-Solutions/fix/ingest_parsing 
Fix/ingest parsing
 2020-06-29 23:07:22 -04:00
Wes Lambert 84e2965fef Addl krb fix 2020-06-30 03:06:01 +00:00
Wes Lambert bf8798f1d1 Fix krb client/server cert subject parsing 2020-06-30 03:04:01 +00:00
Wes Lambert 8f5da66335 Add null safe operator for query name 2020-06-30 03:02:38 +00:00
weslambertandGitHub b398d58dc9 Merge pull request #902 from Security-Onion-Solutions/feature/es_allow 
Add ES REST API option for so-allow
 2020-06-29 14:51:09 -04:00
Wes Lambert ed60d48c81 Add ES REST API option for so-allow 2020-06-29 18:49:16 +00:00
weslambertandGitHub b99b19ce58 Merge pull request #898 from Security-Onion-Solutions/feature/strelka_scripts 
Add Strelka mgmt scripts
 2020-06-29 09:11:16 -04:00
Wes Lambert 9ac85cf674 Add Stelka mgmt scripts 2020-06-29 13:09:14 +00:00
weslambertandGitHub 6f6e8a8853 Merge pull request #897 from Security-Onion-Solutions/fix/strelka_rules 
Fix/strelka rules
 2020-06-26 16:43:21 -04:00
weslambertandGitHub c421bd464a Remove Strelka function (in favor of direct script execution in so-setup) 2020-06-26 16:42:44 -04:00
weslambertandGitHub 8c47723bc9 Run YARA update script after applying state 2020-06-26 15:45:52 -04:00
weslambertandGitHub 813c243d3d Update so-yara-update 2020-06-26 13:26:08 -04:00
weslambertandGitHub 5e41bba6db Merge pull request #892 from Security-Onion-Solutions/feature/more_strelka_rules 
Feature/more strelka rules
 2020-06-25 12:33:36 -04:00
Wes Lambert a24402de99 More Strelka rule config 2020-06-25 16:31:04 +00:00
Wes Lambert 63c45be388 Update Strelka init for rules 2020-06-25 15:49:58 +00:00
Wes Lambert 6487fdf5e6 Add Strelka YARA function 2020-06-25 15:46:37 +00:00
weslambertandGitHub 83ed21314a Merge pull request #888 from Security-Onion-Solutions/feature/strelka_rules 
Feature/strelka rules
 2020-06-24 13:28:52 -04:00
Wes Lambert f5bb831edf Fix comment 2020-06-24 17:27:59 +00:00
Wes Lambert a01339039a Update Setup for Strelka rules 2020-06-24 17:22:55 +00:00
Wes Lambert 8bfbd77367 Update whiptail for Strelka 2020-06-24 17:18:05 +00:00
Wes Lambert 52a0ace1b8 Use Strelka rules if enabled 2020-06-24 17:08:58 +00:00
weslambertandGitHub c3651f1b45 Merge pull request #884 from Security-Onion-Solutions/feature/strelka_client 
Add FW config for Strelka frontend
 2020-06-23 14:57:06 -04:00
Wes Lambert f7eacc2b05 Add FW config for Strelka frontend 2020-06-23 18:47:23 +00:00
weslambertandGitHub 685e3048ac Merge pull request #883 from Security-Onion-Solutions/fix/hunt_files_rename 
Update file dataset name for hunt queries
 2020-06-23 13:49:52 -04:00
Wes Lambert c0428ce79d Update file dataset name for hunt queries 2020-06-23 17:48:12 +00:00
weslambertandGitHub 13df2e6312 Merge pull request #882 from Security-Onion-Solutions/fix/files_rename 
Move dataset from files to file
 2020-06-23 13:44:26 -04:00
Wes Lambert af451573eb Move dataset from files to file 2020-06-23 17:43:28 +00:00
weslambertandGitHub fb9ac58ed6 Merge pull request #869 from Security-Onion-Solutions/feature/elastic_indices_rw 
Basic index read-only attr removal script
 2020-06-17 15:00:23 -04:00
Wes Lambert 6d25151ab8 Basic index read-only attr removal script 2020-06-17 18:59:13 +00:00
weslambertandGitHub 569fc4ac4d Merge pull request #867 from Security-Onion-Solutions/feature/zeek_custom_policy 
Feature/zeek custom policy
 2020-06-17 13:12:38 -04:00
Wes Lambert 90c278096c Add custom Zeek script dir 2020-06-17 17:11:27 +00:00
weslambertandGitHub b489420002 Merge pull request #865 from Security-Onion-Solutions/feature/cortex_custom 
Feature/cortex custom
 2020-06-17 09:22:42 -04:00
Wes Lambert 1beff65cc9 fix typo 2020-06-17 13:20:32 +00:00