  weslambertandGitHub
|
ce49e050bc
|
Update timing for sensor clean cron
|
2020-08-25 12:14:43 -04:00 |
|
|
weslambertandGitHub
|
61cc5b9712
|
Merge pull request #1246 from Security-Onion-Solutions/fix/sensor_clean_log
Fix/sensor clean log
|
2020-08-25 11:36:10 -04:00 |
|
|
Wes Lambert
|
c03812f7ab
|
Add rotation for sensor_clean log
|
2020-08-25 15:34:30 +00:00 |
|
|
weslambertandGitHub
|
a8f727ad40
|
Don't write to log if not past CRIT_DISK_USAGE
|
2020-08-25 11:19:36 -04:00 |
|
|
weslambertandGitHub
|
12a9d26231
|
Merge pull request #1223 from Security-Onion-Solutions/fix/aws_fwd_defaults
Add defaults file for fwdnode
|
2020-08-20 10:17:21 -04:00 |
|
|
Wes Lambert
|
3f04e566f2
|
Add defaults file for fwdnode
|
2020-08-20 14:16:05 +00:00 |
|
|
weslambertandGitHub
|
d80156505c
|
Merge pull request #1217 from Security-Onion-Solutions/fix/aws_automation
Add defaults file for search node
|
2020-08-19 15:09:00 -04:00 |
|
|
Wes Lambert
|
ed1e346789
|
Add defaults file for search node
|
2020-08-19 19:07:24 +00:00 |
|
|
weslambertandGitHub
|
d25afe4aa5
|
Merge pull request #1216 from Security-Onion-Solutions/fix/logstash_hosts
Add manager IP to container hosts file
|
2020-08-19 14:39:04 -04:00 |
|
|
weslambertandGitHub
|
b5dd868d1b
|
Add manager IP to container hosts file
|
2020-08-19 14:34:28 -04:00 |
|
|
weslambertandGitHub
|
ca84ae43ef
|
Merge pull request #1208 from Security-Onion-Solutions/fix/remove_pillar_from_setup
Don't echo pillar to setup log
|
2020-08-18 15:44:20 -04:00 |
|
|
weslambertandGitHub
|
a4e986ea37
|
Don't echo pillar to setup log
|
2020-08-18 15:43:43 -04:00 |
|
|
weslambertandGitHub
|
82bfa567d0
|
Merge pull request #1204 from Security-Onion-Solutions/fix/enable_strelka_default
Enable YARA rules by default
|
2020-08-18 14:54:46 -04:00 |
|
|
weslambertandGitHub
|
eaad0487b5
|
Enable YARA rules by default
|
2020-08-18 14:54:11 -04:00 |
|
|
weslambertandGitHub
|
945bc5c6de
|
Merge pull request #1184 from Security-Onion-Solutions/fix/automate_ssh
Don't copy SSH key if automated install
|
2020-08-14 14:42:44 -04:00 |
|
|
weslambertandGitHub
|
c9d6293f8f
|
Don't copy SSH key if automated install
|
2020-08-14 14:41:35 -04:00 |
|
|
Wes Lambert
|
7686a05f42
|
Set Strelka rules enabled by default for Eval Mode
|
2020-08-14 15:33:38 +00:00 |
|
|
weslambertandGitHub
|
b662f9354f
|
Merge pull request #1180 from Security-Onion-Solutions/fix/thehive_global
Only copy TheHive details to global pillar if enabled
|
2020-08-14 11:23:16 -04:00 |
|
|
Wes Lambert
|
ab4285aaaf
|
Only copy TheHive details to global pillar if enabled
|
2020-08-14 15:21:56 +00:00 |
|
|
weslambertandGitHub
|
796551d71b
|
Merge pull request #1161 from Security-Onion-Solutions/fix/redisconf
Update Redis maxmemory settings
|
2020-08-11 13:27:28 -04:00 |
|
|
weslambertandGitHub
|
b95f8a9314
|
Update Redis maxmemory settings
|
2020-08-11 12:57:57 -04:00 |
|
|
weslambertandGitHub
|
e9af032c28
|
Merge pull request #1143 from Security-Onion-Solutions/feature/aws_mgr_defaults
Add AWS defaults file for manager
|
2020-08-04 10:13:07 -04:00 |
|
|
Wes Lambert
|
46f70c254c
|
Add AWS defaults file for manager
|
2020-08-04 14:11:50 +00:00 |
|
|
weslambertandGitHub
|
f7425b14e3
|
Merge pull request #1142 from Security-Onion-Solutions/feature/aws_eval_defaults
AWS defaults modifications
|
2020-08-03 23:51:32 -04:00 |
|
|
Wes Lambert
|
2290c28a07
|
AWS defaults modifications
|
2020-08-04 03:49:59 +00:00 |
|
|
weslambertandGitHub
|
12f53ce9d9
|
Merge pull request #1134 from Security-Onion-Solutions/fix/aws_auto_reboot
Reboot after finished with setup
|
2020-08-03 10:31:24 -04:00 |
|
|
weslambertandGitHub
|
7e2917fc99
|
Reboot after finished with setup
|
2020-08-03 10:31:03 -04:00 |
|
|
weslambertandGitHub
|
9255e77263
|
Merge pull request #1129 from Security-Onion-Solutions/feature/aws_standalone_defaults
Add AWS Standalone Defaults
|
2020-07-31 16:15:12 -04:00 |
|
|
Wes Lambert
|
ecafbc6014
|
Add AWS Standalone Defaults
|
2020-07-31 20:12:25 +00:00 |
|
|
weslambertandGitHub
|
00ba4ca6c0
|
Merge pull request #1121 from Security-Onion-Solutions/fix/thehive_static
Fix/thehive static
|
2020-07-30 10:27:43 -04:00 |
|
|
weslambertandGitHub
|
4282930f08
|
Update cortex-application.conf
|
2020-07-30 10:26:49 -04:00 |
|
|
weslambertandGitHub
|
c58ee8a37d
|
Add Cortex play secret
|
2020-07-30 10:25:53 -04:00 |
|
|
weslambertandGitHub
|
b6a053070f
|
Change TheHive play secret
|
2020-07-30 10:25:07 -04:00 |
|
|
weslambertandGitHub
|
2fab00458b
|
Add randomized play secrets for Cortex + TheHive
|
2020-07-30 10:23:00 -04:00 |
|
|
weslambertandGitHub
|
646bf1cb4d
|
Merge pull request #1118 from Security-Onion-Solutions/fix/wazuh_register_to
Fix/wazuh registration timeout
|
2020-07-29 13:53:45 -04:00 |
|
|
weslambertandGitHub
|
c48ba8abaf
|
Re-arrange config
|
2020-07-29 13:52:12 -04:00 |
|
|
weslambertandGitHub
|
9db390023b
|
Increase timeout from 10s to 30s
|
2020-07-29 13:51:46 -04:00 |
|
|
weslambertandGitHub
|
4b36c4a809
|
Merge pull request #1115 from Security-Onion-Solutions/fix/remove_ls_syslog
Remove LS syslog port binding
|
2020-07-29 08:35:41 -04:00 |
|
|
weslambertandGitHub
|
7d432091e2
|
Remove LS syslog port binding
|
2020-07-29 08:35:07 -04:00 |
|
|
weslambertandGitHub
|
0f6ecdf38a
|
Merge pull request #1104 from Security-Onion-Solutions/feature/cortex_orguser
Create default orguser if empty
|
2020-07-27 09:50:23 -04:00 |
|
|
Wes Lambert
|
e81fd7464b
|
Create default orguser if empty
|
2020-07-27 13:49:17 +00:00 |
|
|
weslambertandGitHub
|
ced51761fa
|
Merge pull request #1103 from Security-Onion-Solutions/feature/wazuh_version
Bump Wazuh version
|
2020-07-27 09:46:27 -04:00 |
|
|
Wes Lambert
|
ac5aeb4801
|
Bump Wazuh version
|
2020-07-27 13:45:34 +00:00 |
|
|
weslambertandGitHub
|
88ffd0c17c
|
Merge pull request #1101 from Security-Onion-Solutions/feature/wazuh_symlinks
Add Wazuh Wazuh symlinks for config/rules
|
2020-07-27 08:15:58 -04:00 |
|
|
Wes Lambert
|
51e27cadc8
|
Add Wazuh Wazuh symlinks for cpnfig/rules
|
2020-07-27 12:14:43 +00:00 |
|
|
weslambertandGitHub
|
2d2bebdd9c
|
Merge pull request #1100 from Security-Onion-Solutions/feature/wazuh_nsm
Move Wazuh from /opt/so/ to /nsm/wazuh
|
2020-07-27 07:59:39 -04:00 |
|
|
Wes Lambert
|
958ee25f6d
|
Move Wazuh from /opt/so/ to /nsm/wazuh
|
2020-07-27 11:58:12 +00:00 |
|
|
weslambertandGitHub
|
2d096ddd66
|
Merge pull request #1096 from Security-Onion-Solutions/fix/elastalert_thehive
Make sure we are searching all clusters when running rules
|
2020-07-24 18:05:46 -04:00 |
|
|
Wes Lambert
|
3ac9f1800b
|
Make sure we are searching all clusters when running rules
|
2020-07-24 22:04:30 +00:00 |
|
|
weslambertandGitHub
|
2341d9592e
|
Merge pull request #1025 from Security-Onion-Solutions/fix/wazuh_cleanup
Change verbiage
|
2020-07-17 09:39:21 -04:00 |
|
|
weslambertandGitHub
|
e91aa751a7
|
Change verbiage
|
2020-07-17 09:38:43 -04:00 |
|
|
weslambertandGitHub
|
f8bb094546
|
Merge pull request #1014 from Security-Onion-Solutions/fix/strelka_standalone
Fix module eval
|
2020-07-16 09:32:06 -04:00 |
|
|
Wes Lambert
|
8275f458a1
|
Fix module eval
|
2020-07-16 13:30:38 +00:00 |
|
|
weslambertandGitHub
|
7fecfdab32
|
Update README.md
|
2020-07-16 08:14:47 -04:00 |
|
|
weslambertandGitHub
|
f7d527bb90
|
Update README.md
|
2020-07-16 08:14:23 -04:00 |
|
|
weslambertandGitHub
|
7a36803e2c
|
Merge pull request #1002 from Security-Onion-Solutions/fix/strelka_observer
Add observer name for Strelka events
|
2020-07-14 13:39:52 -04:00 |
|
|
Wes Lambert
|
f9df39977b
|
Add observer name for Strelka events
|
2020-07-14 17:38:43 +00:00 |
|
|
weslambertandGitHub
|
7ed902c0ae
|
Merge pull request #1001 from Security-Onion-Solutions/fix/suricata_timestamp
Convert message timestamp to @timestamp
|
2020-07-14 13:34:58 -04:00 |
|
|
Wes Lambert
|
d6afde90b0
|
Convert message timestamp to @timestamp
|
2020-07-14 13:37:00 +00:00 |
|
|
weslambertandGitHub
|
ef64048fc6
|
Merge pull request #978 from Security-Onion-Solutions/fix/sensor-clean
Fix value
|
2020-07-10 17:17:57 -04:00 |
|
|
weslambertandGitHub
|
eb2dc0be4c
|
Fix value
|
2020-07-10 17:17:33 -04:00 |
|
|
weslambertandGitHub
|
9b079df9f5
|
Merge pull request #974 from Security-Onion-Solutions/fix/sensor_clean
Fix/sensor clean
|
2020-07-10 15:35:57 -04:00 |
|
|
Wes Lambert
|
d7f7fb801c
|
Set role
|
2020-07-10 19:35:27 +00:00 |
|
|
Wes Lambert
|
37ab252e01
|
Add sensor proc eval
|
2020-07-10 19:30:08 +00:00 |
|
|
weslambertandGitHub
|
33375a0809
|
Merge pull request #973 from Security-Onion-Solutions/fix/curator_logsizelimit
Move zeek_clean to so-sensor-clean
|
2020-07-10 13:57:58 -04:00 |
|
|
Wes Lambert
|
6e99ca600f
|
Move zeek_clean to so-sensor-clean
|
2020-07-10 17:56:40 +00:00 |
|
|
weslambertandGitHub
|
818f7f56b2
|
Merge pull request #965 from Security-Onion-Solutions/feature/add_gcp_check
Add GCP and make cloud check more generic
|
2020-07-08 23:31:37 -04:00 |
|
|
weslambertandGitHub
|
c01047fad2
|
Add /dev/null
|
2020-07-08 23:30:50 -04:00 |
|
|
weslambertandGitHub
|
889ba67d85
|
Move EC2 to more generic cloud verbiage
|
2020-07-08 23:27:46 -04:00 |
|
|
weslambertandGitHub
|
ce00d829e1
|
Move EC2 to more generic cloud verbiage and check for GCP
|
2020-07-08 23:26:48 -04:00 |
|
|
weslambertandGitHub
|
67fb46f519
|
Merge pull request #963 from Security-Onion-Solutions/fix/curator_logsizelimit
Add standalone evaluation for log_size_limit
|
2020-07-08 15:40:54 -04:00 |
|
|
Wes Lambert
|
f2cea273b6
|
Add standalone evaluation for log_size_limit
|
2020-07-08 19:39:14 +00:00 |
|
|
weslambertandGitHub
|
beda67d2a9
|
Merge pull request #955 from Security-Onion-Solutions/fix/strelka_message_drop
Drop message field and original exiftool keys
|
2020-07-08 10:56:06 -04:00 |
|
|
weslambertandGitHub
|
4cf31e1ee7
|
Drop message field and original exiftool keys
|
2020-07-08 10:55:40 -04:00 |
|
|
weslambertandGitHub
|
9c11de5455
|
Merge pull request #953 from Security-Onion-Solutions/fix/zeek_files_uid
Rename uids to uid
|
2020-07-08 09:40:04 -04:00 |
|
|
weslambertandGitHub
|
b25a3b6986
|
Rename uids to uid
|
2020-07-08 09:39:37 -04:00 |
|
|
weslambertandGitHub
|
88b7a31195
|
Merge pull request #952 from Security-Onion-Solutions/fix/wazuh_authdport
Add Wazuh Authd Port
|
2020-07-08 09:26:28 -04:00 |
|
|
weslambertandGitHub
|
987acaeb7b
|
Add Wazuh Authd Port
|
2020-07-08 09:26:04 -04:00 |
|
|
weslambertandGitHub
|
2992938596
|
Merge pull request #947 from Security-Onion-Solutions/fix/strelka_exiftool
Add fields for exiftool keys
|
2020-07-07 17:13:57 -04:00 |
|
|
Wes Lambert
|
3b50ce032a
|
Add fields for exiftool keys
|
2020-07-07 20:02:09 +00:00 |
|
|
weslambertandGitHub
|
34e06ecde1
|
Merge pull request #940 from Security-Onion-Solutions/feature/strelka_fuid
Add Zeek FUID for Strelka records
|
2020-07-07 11:01:09 -04:00 |
|
|
Wes Lambert
|
e0570e1db7
|
Add Zeek FUID for Strelka records
|
2020-07-07 15:00:01 +00:00 |
|
|
weslambertandGitHub
|
d334d5ab83
|
Merge pull request #938 from Security-Onion-Solutions/fix/strelka_filebeat
Fix pillar reference for Strelka/FB
|
2020-07-07 09:48:19 -04:00 |
|
|
Wes Lambert
|
2fdd5fd77b
|
Fix pillar reference for Strelka/FB
|
2020-07-07 13:46:57 +00:00 |
|
|
weslambertandGitHub
|
0bfa3d486e
|
Merge pull request #923 from Security-Onion-Solutions/fix/es-allow
Fix my typo
|
2020-07-02 13:32:45 -04:00 |
|
|
weslambertandGitHub
|
bbc752b6d9
|
Fix my typo
|
2020-07-02 13:32:19 -04:00 |
|
|
Wes Lambert
|
26b0daf2da
|
Add other setup-related items for EC2 interface
|
2020-07-01 17:42:51 +00:00 |
|
|
Wes Lambert
|
3cf79995a2
|
Modify Whiptail menu for EC2 NIC
|
2020-07-01 17:32:43 +00:00 |
|
|
weslambertandGitHub
|
0b7026a11e
|
Merge pull request #906 from Security-Onion-Solutions/fix/ingest_parsing
Fix/ingest parsing
|
2020-06-29 23:07:22 -04:00 |
|
|
Wes Lambert
|
84e2965fef
|
Addl krb fix
|
2020-06-30 03:06:01 +00:00 |
|
|
Wes Lambert
|
bf8798f1d1
|
Fix krb client/server cert subject parsing
|
2020-06-30 03:04:01 +00:00 |
|
|
Wes Lambert
|
8f5da66335
|
Add null safe operator for query name
|
2020-06-30 03:02:38 +00:00 |
|
|
weslambertandGitHub
|
b398d58dc9
|
Merge pull request #902 from Security-Onion-Solutions/feature/es_allow
Add ES REST API option for so-allow
|
2020-06-29 14:51:09 -04:00 |
|
|
Wes Lambert
|
ed60d48c81
|
Add ES REST API option for so-allow
|
2020-06-29 18:49:16 +00:00 |
|
|
weslambertandGitHub
|
b99b19ce58
|
Merge pull request #898 from Security-Onion-Solutions/feature/strelka_scripts
Add Strelka mgmt scripts
|
2020-06-29 09:11:16 -04:00 |
|
|
Wes Lambert
|
9ac85cf674
|
Add Stelka mgmt scripts
|
2020-06-29 13:09:14 +00:00 |
|
|
weslambertandGitHub
|
6f6e8a8853
|
Merge pull request #897 from Security-Onion-Solutions/fix/strelka_rules
Fix/strelka rules
|
2020-06-26 16:43:21 -04:00 |
|
|
weslambertandGitHub
|
c421bd464a
|
Remove Strelka function (in favor of direct script execution in so-setup)
|
2020-06-26 16:42:44 -04:00 |
|
|
weslambertandGitHub
|
8c47723bc9
|
Run YARA update script after applying state
|
2020-06-26 15:45:52 -04:00 |
|
|
weslambertandGitHub
|
813c243d3d
|
Update so-yara-update
|
2020-06-26 13:26:08 -04:00 |
|