m0duspwnens
d0c87cd317
allow for pillar override of defaults
2021-09-17 12:11:12 -04:00
m0duspwnens
0d074dafd4
add missing defaults
2021-09-17 09:52:50 -04:00
m0duspwnens
5b77dc109f
Merge remote-tracking branch 'remotes/origin/dev' into issue/1257
2021-09-16 16:54:23 -04:00
m0duspwnens
3ce48acadd
change cluster_settings to config
2021-09-16 16:44:31 -04:00
m0duspwnens
5526a2bc3a
reduce defaults.yaml
2021-09-16 15:32:08 -04:00
weslambert
18d81352c6
Merge pull request #5537 from Security-Onion-Solutions/delta
...
Add improved ignore functionality for YARA rules used by Strelka and add default ignored rules that break compilation
2021-09-16 10:38:49 -04:00
m0duspwnens
889d235c45
no box type more manager in true cluster
2021-09-16 09:15:24 -04:00
m0duspwnens
782b01e76f
seed_hosts to list
2021-09-15 17:07:52 -04:00
m0duspwnens
3bf9685df8
fix seed_hosts append
2021-09-15 17:00:16 -04:00
m0duspwnens
4cf91f6c86
fix dict update
2021-09-15 15:51:00 -04:00
m0duspwnens
a43b37f234
fix dict update
2021-09-15 15:49:18 -04:00
m0duspwnens
e0dc62b6e9
fix dict update
2021-09-15 15:43:47 -04:00
m0duspwnens
c213834316
update the dict
2021-09-15 15:24:40 -04:00
Josh Brower
c06668c68e
Merge pull request #5527 from Security-Onion-Solutions/feature/so-import-evtx
...
Feature/so import evtx
2021-09-15 14:17:15 -04:00
Josh Brower
a75238bc3f
so-import-evtx - fix ingest formatting
2021-09-15 14:13:16 -04:00
Josh Brower
ac417867ed
so-import-evtx - final fixes
2021-09-15 14:06:08 -04:00
m0duspwnens
1614b70853
update cluster name if true cluster
2021-09-15 13:45:43 -04:00
Mike Reeves
0882158e03
Merge pull request #5525 from Security-Onion-Solutions/soup80
...
soup changes 2.3.80
2021-09-15 13:44:54 -04:00
m0duspwnens
1a03853a7c
fix extend
2021-09-15 13:38:29 -04:00
Mike Reeves
aff571faf2
soup changes 2.3.80
2021-09-15 13:32:52 -04:00
m0duspwnens
e0faa4c75b
Merge branch 'issue/1257' of https://github.com/Security-Onion-Solutions/securityonion into issue/1257
2021-09-15 13:09:35 -04:00
m0duspwnens
e3e2e1d851
logic for truecluster to map file
2021-09-15 13:09:04 -04:00
weslambert
2affaf07a2
Merge pull request #5521 from Security-Onion-Solutions/fix/strelka-yara
...
Fix/strelka yara
2021-09-15 11:33:44 -04:00
weslambert
39e5ded58d
Refactor ignore list and only ignore for signature-base for now
2021-09-15 11:32:29 -04:00
weslambert
4d41d3aee1
Ignore these rules by default because they are causing issues with YARA compilation with Strelka
2021-09-15 10:29:11 -04:00
weslambert
5c8067728e
Remove unnecessary logic
2021-09-15 10:22:17 -04:00
Josh Brower
1d905124d3
Merge pull request #5519 from Security-Onion-Solutions/fix/fleet-link
...
Fix Fleet Link Logic
2021-09-15 09:30:21 -04:00
Josh Brower
e0a289182f
Fix Fleet Link Logic
2021-09-15 09:28:23 -04:00
m0duspwnens
551dba955c
set roles empty list
2021-09-15 09:20:33 -04:00
Mike Reeves
2ffb723bbd
Rename so-common-template.json to so-common-template.json.jinja
2021-09-14 13:58:45 -04:00
Mike Reeves
6ae2fba71f
Update search.sls
2021-09-14 13:57:26 -04:00
Mike Reeves
2cc25587d9
Update eval.sls
2021-09-14 13:57:04 -04:00
Mike Reeves
614a6dc9fe
Update manager.sls
2021-09-14 13:56:43 -04:00
Josh Brower
4b7667d87f
Merge pull request #5508 from Security-Onion-Solutions/fix/fleet-link
...
Fleet SA - SOC Link Fix
2021-09-14 13:29:20 -04:00
Josh Brower
74b0b365bd
Fleet SA - SOC Link Fix
2021-09-14 13:23:07 -04:00
Josh Brower
0b0d508585
so-import-evtx - tweaks
2021-09-14 12:01:14 -04:00
m0duspwnens
0534a2dda3
Merge remote-tracking branch 'remotes/origin/dev' into issue/1257
2021-09-13 15:04:50 -04:00
m0duspwnens
f8ab0ac8a9
config changes
2021-09-13 15:04:39 -04:00
m0duspwnens
0ae09cc630
config changes
2021-09-13 09:49:56 -04:00
Mike Reeves
332c4dda22
Merge pull request #5469 from Security-Onion-Solutions/fix/idstools-rule-clear
...
Allow so-rule-update to accept any number of args
2021-09-10 14:41:55 -04:00
William Wernert
679faddd52
Update so-rule-update to pass all args to docker exec
...
Instead of passing $1, build a string from all args and add that to the command string for the docker exec statement
2021-09-10 13:44:37 -04:00
William Wernert
0b42b19763
Update so-rule-update to source so-common
2021-09-10 13:41:58 -04:00
William Wernert
943bd3e902
Merge pull request #5468 from Security-Onion-Solutions/fix/idstools-rule-clear
...
Add `--force` flag to idstools-rulecat under so-rule-update
2021-09-10 13:17:16 -04:00
Mike Reeves
4af6a901a1
Merge pull request #5461 from Security-Onion-Solutions/truclusterrator
...
Add new hunt fields
2021-09-10 13:17:01 -04:00
William Wernert
9c310de459
Add --force flag to idstools-rulecat under so-rule-update
...
This forces idstools to pull from the url each time, which prevents it from clearing all.rules if idstools-rulecat is run twice within 15 minutes by any method (either restarting the container or running so-rule-update)
2021-09-10 13:15:09 -04:00
Mike Reeves
4f6a3269cb
Add more detail to syscollector
2021-09-10 09:59:47 -04:00
Doug Burks
6a2e1df7d4
Merge pull request #5460 from Security-Onion-Solutions/feature/welcome-link-docs
...
FEATURE: Add docs link to Setup #5459
2021-09-10 07:27:48 -04:00
doug
db50ef71b4
FEATURE: Add docs link to Setup #5459
2021-09-10 06:19:16 -04:00
Jason Ertel
4e2d5018a2
Merge pull request #5455 from Security-Onion-Solutions/kilo
...
Consolidate whiptail screens
2021-09-09 14:57:28 -04:00
Jason Ertel
94688a9adb
Eliminate adv component popup
2021-09-09 14:29:09 -04:00
