CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,355 Commits 40 Branches 127 Tags
ce313d8dc492eb2ddf0efbdbb776e2e1fa4d511a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 583b65e952 Fix syntax 2021-01-21 11:52:23 -05:00
weslambertandGitHub d6043d091b Merge pull request #2701 from Security-Onion-Solutions/feature/filebeat_events 
Allow for Filebeat queue/output adjustments via pillar
 2021-01-21 10:36:33 -05:00
Wes Lambert 19d22e1f8a Allow for Filebeat queue/output adjustments via pillar 2021-01-21 15:34:54 +00:00
weslambertandGitHub a99246c600 Merge pull request #2698 from Security-Onion-Solutions/fix/reserved_ports 
Fix/reserved ports
 2021-01-21 08:39:35 -05:00
Wes Lambert 0039877779 Check for port availability for Wazuh and Strelka 2021-01-21 13:29:09 +00:00
Wes Lambert 9a91674688 Add reserved ports file for sysctl 2021-01-21 13:18:22 +00:00
Wes Lambert 74e315841a Modify common to reserve Docker proxy ports 2021-01-21 13:17:16 +00:00
Wes LambertandWilliam Wernert 7f64d57111 Reserve port for Wazuh API and check if port is already in use 2021-01-06 14:37:28 -05:00
Wes LambertandWilliam Wernert e7db1a99bd Set @timestamp to winlog.systemTime 2021-01-06 14:37:28 -05:00
weslambertandWilliam Wernert c864cc607f Remove multiple old so-yara-update cron jobs, if needed 2021-01-06 14:37:27 -05:00
weslambertandWilliam Wernert 958635b012 Remove old Strelka cron job 2021-01-06 14:37:27 -05:00
weslambertandGitHub 36ae09ac4a Merge pull request #2545 from Security-Onion-Solutions/fix/wazuh_port_reservation 
Reserve port for Wazuh API and check if port is already in use
 2021-01-06 11:49:23 -05:00
weslambertandGitHub 55344725e7 Merge pull request #2544 from Security-Onion-Solutions/fix/winlog_timestamp 
Set @timestamp to winlog.systemTime
 2021-01-06 11:49:01 -05:00
Wes Lambert 875908dc90 Set @timestamp to winlog.systemTime 2021-01-06 16:47:35 +00:00
Wes Lambert f2b677bfcb Reserve port for Wazuh API and check if port is already in use 2021-01-06 15:52:10 +00:00
weslambertandGitHub 707528d7e8 Merge pull request #2530 from Security-Onion-Solutions/fix/strelka_cron_2 
Remove multiple old so-yara-update cron jobs, if needed
 2021-01-04 16:30:22 -05:00
weslambertandGitHub c1e245043e Remove multiple old so-yara-update cron jobs, if needed 2021-01-04 16:29:32 -05:00
weslambertandGitHub e51f60f7fa Merge pull request #2521 from Security-Onion-Solutions/fix/strelka_rule_cron 
Remove old Strelka cron job
 2021-01-04 10:19:50 -05:00
weslambertandGitHub 535820bfa7 Remove old Strelka cron job 2021-01-04 10:18:32 -05:00
weslambertandGitHub f6a199156b Merge pull request #2428 from Security-Onion-Solutions/feature/strelka_pillar_repos 
Support setting rule repos via pillar
 2020-12-22 10:38:01 -05:00
Wes Lambert ac96ded2dc Support setting rule repos via pillar 2020-12-22 15:36:15 +00:00
weslambertandGitHub def08895d5 Merge pull request #2393 from Security-Onion-Solutions/fix/strelka_filestream 
Fix/strelka filestream
 2020-12-18 15:48:54 -05:00
weslambertandGitHub 2fee2ca143 Change identifier name to be more descriptive 2020-12-18 15:40:54 -05:00
weslambertandGitHub 7453626b06 Add identifier 2020-12-18 15:39:52 -05:00
weslambertandGitHub 1a463bccaf Add cron.absent to remove old cron job if present 2020-12-18 11:25:14 -05:00
weslambertandGitHub 9493aad1a5 Read from dedicated unprocessed dir 2020-12-18 10:53:17 -05:00
weslambertandGitHub bf76c1b58c Create unprocessed dir and move Zeek extracted files there 2020-12-18 10:52:14 -05:00
weslambertandGitHub 24fce27e62 Merge pull request #2297 from Security-Onion-Solutions/feature/idstools_arg 
Add ability to supply an arg, for example overriding 15 min limit
 2020-12-10 09:31:50 -05:00
Wes Lambert 45faa7fda4 Add ability to supply an arg, for example overriding 15 min limit 2020-12-10 14:30:29 +00:00
weslambertandGitHub c2cf2c4987 Merge pull request #2296 from Security-Onion-Solutions/fix/suricata_ftp_data 
Add initial suricata.ftp_data pipeline
 2020-12-10 09:17:01 -05:00
Wes Lambert f689722559 Add initial suricata.ftp_data pipeline 2020-12-10 14:14:50 +00:00
weslambertandGitHub d09daef094 Merge pull request #2288 from Security-Onion-Solutions/fix/strelka_rules 
Expand STRELKARULES
 2020-12-09 17:05:44 -05:00
weslambertandGitHub 0b2e2739bd Expand STRELKARULES 2020-12-09 17:05:11 -05:00
weslambertandGitHub c41d4373b7 Merge pull request #2192 from Security-Onion-Solutions/fix/elasticsearch_bool_query_clause_count 
Add indices.query.bool.max_clause_count to allow for wildcard searche…
 2020-12-03 09:30:24 -05:00
weslambertandGitHub 95570976a8 Add indices.query.bool.max_clause_count to allow for wildcard searches targeting more than 1024 fields 2020-12-03 09:29:44 -05:00
weslambertandGitHub a84f816eff Merge pull request #2189 from Security-Onion-Solutions/feature/so-elastic-scripts 
so-elastic scripts
 2020-12-03 09:20:47 -05:00
Wes Lambert 4ce3ec7582 Make scripts executable 2020-12-03 14:18:22 +00:00
Wes Lambert f96365baba Add intial grouped Elastic start/stop/restart scripts 2020-12-03 14:17:32 +00:00
weslambertandGitHub c819729cd6 Don't use max_files or time_to_live for shutdown params 2020-12-02 13:17:19 -05:00
weslambertandGitHub 0e8f547087 Merge pull request #2160 from Security-Onion-Solutions/fix/strelka_mmbot 
Remove ScanMmbot
 2020-12-01 11:26:14 -05:00
weslambertandGitHub 9517cb2a58 Remove ScanMmbot 2020-12-01 11:25:51 -05:00
weslambertandGitHub 0c4ee94472 Merge pull request #2077 from Security-Onion-Solutions/fix/thehive_upgrade_conf 
Fix/thehive upgrade conf
 2020-11-24 11:52:51 -05:00
weslambertandGitHub 39bf60feb7 Add digit 2020-11-24 11:52:20 -05:00
weslambertandGitHub 35653d2e66 Changes for ES7 2020-11-24 11:51:19 -05:00
weslambertandGitHub eb2364b926 Changes for ES7 2020-11-24 11:49:08 -05:00
weslambertandGitHub e3a41c2a94 Changes for ES7 elasticsearch.yml 2020-11-24 11:20:09 -05:00
weslambertandGitHub 04c6bed779 Merge pull request #1977 from Security-Onion-Solutions/fix/zeek_log_inode_cleanup 
Change clean_removed to true to clean up tracking of Zeek logs removed fr…
 2020-11-18 13:49:46 -05:00
weslambertandGitHub 6b4af30fc1 Change clean_removed to true cleanup tracking of Zeek logs removed from current 2020-11-18 13:47:32 -05:00
weslambertandGitHub 4fad0e3a98 Merge pull request #1914 from Security-Onion-Solutions/fix/syslog_parsing 
Syslog updates
 2020-11-13 11:07:53 -05:00
Wes Lambert fddfb8eb92 Syslog updates 2020-11-13 16:06:22 +00:00
weslambertandGitHub 8c6adc21a8 Merge pull request #1891 from Security-Onion-Solutions/syslog_cef 
Update syslog pipeline to allow for initial CEF parsing and pipeline …
 2020-11-11 16:40:55 -05:00
Wes Lambert 8258b782fc Update syslog pipeline to allow for initial CEF parsing and pipeline targeting 2020-11-11 21:39:40 +00:00
weslambertandGitHub 533a65205f Merge pull request #1885 from Security-Onion-Solutions/fix/syslog_application 
Add check for field
 2020-11-11 10:33:24 -05:00
weslambertandGitHub ea1f53b40c Add check for field 2020-11-11 10:29:58 -05:00
weslambertandGitHub 280fc501f9 Merge pull request #1882 from Security-Onion-Solutions/fix/extra_top_var 
Fix duplicate vars
 2020-11-11 08:53:43 -05:00
weslambertandGitHub 625307ac5f Fix duplicate vars 2020-11-11 08:52:39 -05:00
weslambertandGitHub 44677ad521 Merge pull request #1880 from Security-Onion-Solutions/disable_elastic 
Allow for disabling Elastic stack via pillar
 2020-11-11 08:29:23 -05:00
Wes Lambert 1c326f561b Allow for disabling Elastic stack via pillar 2020-11-11 13:26:59 +00:00
weslambertandGitHub 059c4e03e1 Merge pull request #1860 from Security-Onion-Solutions/strelka-parsing 
Pull out additional fields from Exif info
 2020-11-09 11:54:55 -05:00
Wes Lambert 7e578d2ce0 Pull out additional fields from Exif info 2020-11-09 16:53:53 +00:00
weslambertandGitHub 3abe8cb397 Merge pull request #1836 from Security-Onion-Solutions/fix/wazuh_agent_register 
Don't sleep if not registering agent
 2020-11-05 14:03:32 -05:00
weslambertandGitHub 2911e37b70 Don't sleep if not registering agent 2020-11-05 14:03:08 -05:00
weslambertandGitHub e040009d0b Merge pull request #1804 from Security-Onion-Solutions/fix/wazuh_api_creds_remove 
Remove Wazuh API creds after registering initial agent
 2020-11-03 09:57:58 -05:00
Wes Lambert 7dca988c11 Remove Wazuh API creds after registering intial agent 2020-11-03 14:53:50 +00:00
weslambertandGitHub bfe98433f6 Merge pull request #1789 from Security-Onion-Solutions/fix/zeek_intel 
Add Zeek intel.dat
 2020-11-02 16:38:16 -05:00
Wes Lambert 05549a2362 Add Zeek intel.dat 2020-11-02 21:36:44 +00:00
weslambertandGitHub 8a645edb34 Merge pull request #1788 from Security-Onion-Solutions/feature/nids_rules 
Allow for muliple files for rules
 2020-11-02 16:05:53 -05:00
Wes Lambert 24a54a326c Allow for muliple files for rules 2020-11-02 21:03:45 +00:00
weslambertandGitHub bb0cf9b8c7 Merge pull request #1784 from Security-Onion-Solutions/fix/strelka_exif_parsing 
Fix/strelka exif parsing
 2020-11-02 14:32:45 -05:00
Wes Lambert 3113d5fbdb Format scan.exiftool as text 2020-11-02 19:31:14 +00:00
Wes Lambert 6420ee0310 Update parsing for scan.exiftool 2020-11-02 19:28:12 +00:00
weslambertandGitHub 37c630d6ab Merge pull request #1776 from Security-Onion-Solutions/bugfix/af-packet-ring-size 
Match max-pending-packets size
 2020-11-02 08:39:21 -05:00
weslambertandGitHub 71a260a000 Match max-pending-packets size 2020-11-02 08:38:45 -05:00
weslambertandGitHub 7ea8dc84b6 Merge pull request #1696 from Security-Onion-Solutions/feature/wazuh-user-mods 
Add Wazuh user management scripts
 2020-10-28 08:24:15 -04:00
Wes Lambert 453247971e Add Wazuh user management scripts 2020-10-28 12:22:50 +00:00
weslambertandGitHub e2d95e0deb Merge pull request #1576 from Security-Onion-Solutions/fix/comon_nids_rule_ruleset 
Change rule_ruleset to rule.ruleset
 2020-10-20 22:15:00 -04:00
weslambertandGitHub 4765ef5f5c Change rule_ruleset to rule.ruleset 2020-10-20 22:14:23 -04:00
weslambertandGitHub 657e251f51 Merge pull request #1528 from Security-Onion-Solutions/fix/kibana_ack 
Update Kibana mappings for event ack/eslacation
 2020-10-15 14:48:00 -04:00
Wes Lambert d863f26f9d Update Kibana mappings for event ack/eslacation 2020-10-15 18:46:37 +00:00
weslambertandGitHub 36b9450a39 Merge pull request #1526 from Security-Onion-Solutions/fix/kibana_things 
Intel mapping enforcement and winlog.verion
 2020-10-15 08:43:34 -04:00
Wes Lambert af9daa4d71 Intel mapping enforcement and winlog.verion 2020-10-15 12:42:33 +00:00
weslambertandGitHub c81ee9621d Merge pull request #1525 from Security-Onion-Solutions/fix/kibana_discover_default 
Fix default discover query
 2020-10-14 17:44:55 -04:00
Wes Lambert e7401b3e0c Fix default discover query 2020-10-14 21:43:19 +00:00
weslambertandGitHub f2125242f9 Merge pull request #1523 from Security-Onion-Solutions/fix/strelka_file_mime_type 
Rename file.flavors.mime to file.mime_type
 2020-10-14 14:58:15 -04:00
Wes Lambert 54c4ee796f Rename file.flavors.mime to file.mime_type 2020-10-14 18:56:44 +00:00
weslambertandGitHub 8d4fd6c18d Merge pull request #1522 from Security-Onion-Solutions/fix/pipeline_commmon_remove_ignore_missing 
Fix common pipeline field removal so won't fail for missing fields
 2020-10-14 09:56:34 -04:00
Wes Lambert 3c820365ab Fix common pipeline field removal so won't fail for missing fields 2020-10-14 13:55:24 +00:00
weslambertandGitHub 4fff105986 Merge pull request #1514 from Security-Onion-Solutions/fix/replay_verbiage 
Replay verbiage -- let users know when preparing to replay
 2020-10-13 14:14:41 -04:00
Wes Lambert 3f8f0da468 Replay verbiage -- let users know when preparing to replay 2020-10-13 18:13:36 +00:00
weslambertandGitHub a17a2ad3de Merge pull request #1507 from Security-Onion-Solutions/fix/zeek_smb_ts_common 
Ensure Zeek logs without ts field have an @timestamp field associated
 2020-10-12 13:21:15 -04:00
Wes Lambert 14559b081d Ensure Zeek logs without ts field have an @timestamp field associated 2020-10-12 17:19:23 +00:00
weslambertandGitHub 748ff0dbeb Merge pull request #1506 from Security-Onion-Solutions/fix/index_dates 
Fix/index dates
 2020-10-12 11:45:08 -04:00
Wes Lambert 4fc4913d1e Don't predefine index date for Filebeat ES outputs 2020-10-12 15:44:00 +00:00
Wes Lambert 884cc2d054 Don't predefine index date for Logstash outputs 2020-10-12 15:41:47 +00:00
weslambertandGitHub 12c3c351d8 Merge pull request #1498 from Security-Onion-Solutions/feature/filterlog 
Feature/filterlog
 2020-10-09 20:05:21 -04:00
Wes Lambert 28a1f7f88a Remove pfsense tag 2020-10-10 00:03:51 +00:00
Wes Lambert b55ffa44f8 Fix module,dataset rename 2020-10-10 00:01:37 +00:00
Wes Lambert 69a04dedd3 Filterlog config changes 2020-10-09 23:56:52 +00:00
weslambertandGitHub 993aabedf2 Merge pull request #1491 from Security-Onion-Solutions/fix/so-elasticsearch-pipeline-stats-dots 
Ensure pipelines with dots in names can be referenced
 2020-10-08 15:41:44 -04:00
weslambertandGitHub 06706d29f2 Ensure pipelines with dots in names can be referenced 2020-10-08 15:41:17 -04:00