CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 21:03:10 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,647 Commits 40 Branches 127 Tags
d334d5ab83dfe09dfc992ea761a43fbecf4fa9de
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub d334d5ab83 Merge pull request #938 from Security-Onion-Solutions/fix/strelka_filebeat 
Fix pillar reference for Strelka/FB
 2020-07-07 09:48:19 -04:00
Wes Lambert 2fdd5fd77b Fix pillar reference for Strelka/FB 2020-07-07 13:46:57 +00:00
weslambertandGitHub 0bfa3d486e Merge pull request #923 from Security-Onion-Solutions/fix/es-allow 
Fix my typo
 2020-07-02 13:32:45 -04:00
weslambertandGitHub bbc752b6d9 Fix my typo 2020-07-02 13:32:19 -04:00
Wes Lambert 26b0daf2da Add other setup-related items for EC2 interface 2020-07-01 17:42:51 +00:00
Wes Lambert 3cf79995a2 Modify Whiptail menu for EC2 NIC 2020-07-01 17:32:43 +00:00
weslambertandGitHub 0b7026a11e Merge pull request #906 from Security-Onion-Solutions/fix/ingest_parsing 
Fix/ingest parsing
 2020-06-29 23:07:22 -04:00
Wes Lambert 84e2965fef Addl krb fix 2020-06-30 03:06:01 +00:00
Wes Lambert bf8798f1d1 Fix krb client/server cert subject parsing 2020-06-30 03:04:01 +00:00
Wes Lambert 8f5da66335 Add null safe operator for query name 2020-06-30 03:02:38 +00:00
weslambertandGitHub b398d58dc9 Merge pull request #902 from Security-Onion-Solutions/feature/es_allow 
Add ES REST API option for so-allow
 2020-06-29 14:51:09 -04:00
Wes Lambert ed60d48c81 Add ES REST API option for so-allow 2020-06-29 18:49:16 +00:00
weslambertandGitHub b99b19ce58 Merge pull request #898 from Security-Onion-Solutions/feature/strelka_scripts 
Add Strelka mgmt scripts
 2020-06-29 09:11:16 -04:00
Wes Lambert 9ac85cf674 Add Stelka mgmt scripts 2020-06-29 13:09:14 +00:00
weslambertandGitHub 6f6e8a8853 Merge pull request #897 from Security-Onion-Solutions/fix/strelka_rules 
Fix/strelka rules
 2020-06-26 16:43:21 -04:00
weslambertandGitHub c421bd464a Remove Strelka function (in favor of direct script execution in so-setup) 2020-06-26 16:42:44 -04:00
weslambertandGitHub 8c47723bc9 Run YARA update script after applying state 2020-06-26 15:45:52 -04:00
weslambertandGitHub 813c243d3d Update so-yara-update 2020-06-26 13:26:08 -04:00
weslambertandGitHub 5e41bba6db Merge pull request #892 from Security-Onion-Solutions/feature/more_strelka_rules 
Feature/more strelka rules
 2020-06-25 12:33:36 -04:00
Wes Lambert a24402de99 More Strelka rule config 2020-06-25 16:31:04 +00:00
Wes Lambert 63c45be388 Update Strelka init for rules 2020-06-25 15:49:58 +00:00
Wes Lambert 6487fdf5e6 Add Strelka YARA function 2020-06-25 15:46:37 +00:00
weslambertandGitHub 83ed21314a Merge pull request #888 from Security-Onion-Solutions/feature/strelka_rules 
Feature/strelka rules
 2020-06-24 13:28:52 -04:00
Wes Lambert f5bb831edf Fix comment 2020-06-24 17:27:59 +00:00
Wes Lambert a01339039a Update Setup for Strelka rules 2020-06-24 17:22:55 +00:00
Wes Lambert 8bfbd77367 Update whiptail for Strelka 2020-06-24 17:18:05 +00:00
Wes Lambert 52a0ace1b8 Use Strelka rules if enabled 2020-06-24 17:08:58 +00:00
weslambertandGitHub c3651f1b45 Merge pull request #884 from Security-Onion-Solutions/feature/strelka_client 
Add FW config for Strelka frontend
 2020-06-23 14:57:06 -04:00
Wes Lambert f7eacc2b05 Add FW config for Strelka frontend 2020-06-23 18:47:23 +00:00
weslambertandGitHub 685e3048ac Merge pull request #883 from Security-Onion-Solutions/fix/hunt_files_rename 
Update file dataset name for hunt queries
 2020-06-23 13:49:52 -04:00
Wes Lambert c0428ce79d Update file dataset name for hunt queries 2020-06-23 17:48:12 +00:00
weslambertandGitHub 13df2e6312 Merge pull request #882 from Security-Onion-Solutions/fix/files_rename 
Move dataset from files to file
 2020-06-23 13:44:26 -04:00
Wes Lambert af451573eb Move dataset from files to file 2020-06-23 17:43:28 +00:00
weslambertandGitHub fb9ac58ed6 Merge pull request #869 from Security-Onion-Solutions/feature/elastic_indices_rw 
Basic index read-only attr removal script
 2020-06-17 15:00:23 -04:00
Wes Lambert 6d25151ab8 Basic index read-only attr removal script 2020-06-17 18:59:13 +00:00
weslambertandGitHub 569fc4ac4d Merge pull request #867 from Security-Onion-Solutions/feature/zeek_custom_policy 
Feature/zeek custom policy
 2020-06-17 13:12:38 -04:00
Wes Lambert 90c278096c Add custom Zeek script dir 2020-06-17 17:11:27 +00:00
weslambertandGitHub b489420002 Merge pull request #865 from Security-Onion-Solutions/feature/cortex_custom 
Feature/cortex custom
 2020-06-17 09:22:42 -04:00
Wes Lambert 1beff65cc9 fix typo 2020-06-17 13:20:32 +00:00
Wes Lambert cbfe375407 Custom analyzer and responder dirs 2020-06-17 13:16:52 +00:00
weslambertandGitHub 91c32725fb Merge pull request #851 from Security-Onion-Solutions/fix/es_field_fixes 
Fix/es field fixes
 2020-06-15 12:59:01 -04:00
Wes Lambert f3c9f2e5ea update templates 2020-06-15 16:57:46 +00:00
Wes Lambert 206261fbe6 rename id to log.id.fuid for X509 2020-06-15 16:55:14 +00:00
Wes Lambert 18547e8ea8 enforce field types 2020-06-15 16:54:33 +00:00
weslambertandGitHub 014274930a Merge pull request #815 from Security-Onion-Solutions/fix/syslog_cleanup 
Clean up some stuff
 2020-06-02 15:32:32 -04:00
weslambertandGitHub c91bc0e681 Clean up some stuff 2020-06-02 15:31:48 -04:00
weslambertandGitHub 98e0f0d7d8 Merge pull request #814 from Security-Onion-Solutions/feature/syslog 
Feature/syslog
 2020-06-02 13:39:23 -04:00
Wes Lambert 8cac30728b update Logstash config 2020-06-02 17:36:36 +00:00
Wes Lambert 91673a5d70 Update FB config 2020-06-02 17:33:42 +00:00
weslambertandGitHub 551c663046 Merge pull request #808 from Security-Onion-Solutions/fix/tunnel_parents 
Rename tunnel_parents
 2020-06-01 09:52:55 -04:00
Wes Lambert 51f5d64ef6 Rename tunnel_parents 2020-06-01 13:51:32 +00:00
weslambertandGitHub fa8b88b090 Merge pull request #806 from Security-Onion-Solutions/feature/vxlan_tunnel_id 
fix naming of uid field for tunnel
 2020-06-01 08:54:12 -04:00
Wes Lambert d7ce3d4719 fix naming of uid field for tunnel 2020-06-01 12:52:57 +00:00
weslambertandGitHub 2601ffe902 Merge pull request #797 from Security-Onion-Solutions/fix/radius_parsing 
fix framed_addr field
 2020-05-29 07:56:22 -04:00
Wes Lambert 4059121dd6 fix framed_addr field 2020-05-29 11:55:18 +00:00
weslambertandGitHub f5300d3d5a Merge pull request #794 from Security-Onion-Solutions/feature/zeek-stats 
Add basic Zeek stats script
 2020-05-28 13:55:43 -04:00
Wes Lambert 7f75050682 Add basic Zeek stats script 2020-05-28 17:54:15 +00:00
weslambertandGitHub 7c232318ad Merge pull request #793 from Security-Onion-Solutions/fix/so-stop-exact-match 
Update for exact match (ex. thehive, thehive-es, thehive-cortex)
 2020-05-28 13:17:56 -04:00
weslambertandGitHub b835c2e27e Update for exact match (ex. thehive, thehive-es, thehive-cortex) 2020-05-28 13:17:31 -04:00
weslambertandGitHub ae6f028666 Merge pull request #792 from Security-Onion-Solutions/fix/suricata_config_nsm 
Move eve.json to /nsm
 2020-05-28 13:00:15 -04:00
weslambertandGitHub 12f426d4f4 Move eve.json to /nsm 2020-05-28 12:59:41 -04:00
weslambertandGitHub 8291de40cf Merge pull request #791 from Security-Onion-Solutions/fix/socto-ip-hostname 
add master to SOCtopus hosts file
 2020-05-28 12:46:57 -04:00
Wes Lambert 869bfb947d add master to SOCtopus hosts file 2020-05-28 16:45:48 +00:00
weslambertandGitHub 9de1a25703 Merge pull request #789 from Security-Onion-Solutions/fix/filebeat_init 
Fix filebeat init
 2020-05-28 12:11:39 -04:00
weslambertandGitHub d2263db0ff Update init.sls 2020-05-28 12:11:08 -04:00
weslambertandGitHub c775e583dd Merge pull request #788 from Security-Onion-Solutions/feature/filebeat-syslog-fw 
allow syslog
 2020-05-28 09:58:15 -04:00
Wes Lambert b7d7747f65 allow syslog 2020-05-28 13:56:02 +00:00
weslambertandGitHub 3883c8bfe0 Merge pull request #784 from Security-Onion-Solutions/feature/filebeat-syslog 
Feature/filebeat syslog
 2020-05-28 08:39:11 -04:00
Wes Lambert d2b93d531e Basic syslog config 2020-05-28 12:36:29 +00:00
Wes Lambert 5afc05feb2 Update FB init for syslog 2020-05-28 12:35:22 +00:00
Wes Lambert b9bdca509e update Filebeat config for syslog 2020-05-28 12:33:41 +00:00
weslambertandGitHub 04800277c2 Merge pull request #783 from Security-Onion-Solutions/fix/hive_rename_bug 
Hive to TheHive
 2020-05-27 15:44:22 -04:00
weslambertandGitHub 6a935b5452 Hive to TheHive 2020-05-27 15:43:41 -04:00
weslambertandGitHub 9595d63c01 Merge pull request #782 from Security-Onion-Solutions/feature/thehive-start-stop-restart 
Add Hive/ES/Cortex scripts
 2020-05-27 13:46:18 -04:00
Wes Lambert b80eb5f73b Add Hive/ES/Cortex scripts 2020-05-27 17:43:17 +00:00
weslambertandGitHub f07d6dfb30 Merge pull request #780 from Security-Onion-Solutions/fix/thehive_path 
Rename Hive to TheHive in several places
 2020-05-27 13:22:57 -04:00
Wes Lambert b26f6826dd Rename Hive to TheHive in several places 2020-05-27 17:17:55 +00:00
weslambertandGitHub 58f4cce4f3 Merge pull request #779 from Security-Onion-Solutions/fix/suricata_log_path 
Fix/suricata log path
 2020-05-27 13:03:10 -04:00
Wes Lambert d56bc4c167 fix path 2020-05-27 17:01:05 +00:00
Wes Lambert 3684cdf1c6 Update FB and LS 2020-05-27 17:00:09 +00:00
Wes Lambert e78a3f3278 update Suricata config 2020-05-27 16:59:26 +00:00
Wes Lambert b7a0f79038 Update Suricata init 2020-05-27 16:58:31 +00:00
weslambertandGitHub 042618cd8f Merge pull request #777 from Security-Onion-Solutions/fix/strelka_init 
Wrap with quotes
 2020-05-27 09:03:06 -04:00
weslambertandGitHub f3809cb93d Wrap with quotes 2020-05-27 08:31:14 -04:00
weslambertandGitHub 0b200d15fd Merge pull request #768 from Security-Onion-Solutions/fix/es_watermark 
Update ES watermark settings
 2020-05-26 10:19:57 -04:00
Wes Lambert 0e51ab41cf Update ES watermark settings 2020-05-26 14:18:58 +00:00
weslambertandGitHub 8aa2cab680 Merge pull request #767 from Security-Onion-Solutions/fix/so_index_transition 
Fix/so index transition
 2020-05-26 10:08:20 -04:00
Wes Lambert 97306d3acd rename indices 2020-05-26 14:05:33 +00:00
Wes Lambert 3eb62287ac update Curator config for index transition 2020-05-26 14:00:16 +00:00
weslambertandGitHub 956926d870 Merge pull request #766 from Security-Onion-Solutions/fix/soctopus_host 
update SOCtopus config for hostname/ip
 2020-05-26 09:20:43 -04:00
Wes Lambert 330de46249 update SOCtopus config for hostname/ip 2020-05-26 13:19:15 +00:00
weslambertandGitHub b5bd6e6144 Merge pull request #765 from Security-Onion-Solutions/fix/strelka_cron 
update Strelka cron
 2020-05-26 09:01:24 -04:00
Wes Lambert e09027e795 update Strelka cron 2020-05-26 13:00:03 +00:00
weslambertandGitHub 43a8ec6f50 Merge pull request #719 from Security-Onion-Solutions/fix/so-kibana-config 
Fix/so kibana config
 2020-05-18 09:23:17 -04:00
Wes Lambert ee5937d038 update Kibana config 2020-05-18 13:21:18 +00:00
Wes Lambert 228bbbea5f update config export 2020-05-18 13:16:42 +00:00
weslambertandGitHub f7de391518 Merge pull request #713 from Security-Onion-Solutions/fix/kibana_config_load 
change KRATOS to MASTER
 2020-05-16 13:07:24 -04:00
Wes Lambert 23eb73a943 change KRATOS to MASTER 2020-05-16 16:31:06 +00:00
weslambertandGitHub 907702441f Merge pull request #712 from Security-Onion-Solutions/fix/kibana_config_load_order 
Fix load order for PLACEHOLDER
 2020-05-16 11:49:58 -04:00
Wes Lambert 047f4e31ad Fix load order for PLACEHOLDER 2020-05-16 15:48:55 +00:00