CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-20 15:53:39 +02:00
Code Issues Packages Projects Releases Wiki Activity
10,420 Commits 45 Branches 127 Tags
d36f2f642f8a4f2f110f97d4adbc00a80726d71a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Doug BurksandGitHub de0a7d3bcd Merge pull request #8293 from Security-Onion-Solutions/dougburks-patch-1 
change hyperlink for Elastic 8 issues
 2022-07-13 12:41:50 -04:00
Doug BurksandGitHub c67a58a5b1 change hyperlink for Elastic 8 issues 2022-07-13 12:40:03 -04:00
Doug BurksandGitHub 7ae5d49a4a Merge pull request #8290 from Security-Onion-Solutions/dougburks-patch-1 
increment version to 2.3.140
 2022-07-13 09:33:37 -04:00
Doug BurksandGitHub 34d3c6a882 increment version to 2.3.140 2022-07-13 09:32:28 -04:00
Doug BurksandGitHub 00cf0b38d0 Merge pull request #8165 from Security-Onion-Solutions/dougburks-patch-1 
FIX: Improve default dashboards #8136
 2022-06-21 12:57:46 -04:00
Doug BurksandGitHub 94c637449d FIX: Improve default dashboards #8136 2022-06-21 12:53:06 -04:00
Doug BurksandGitHub 286909af4b Merge pull request #8113 from Security-Onion-Solutions/fix/pfsense-category 
FIX: Add event.category field to pfsense firewall logs #8112
 2022-06-13 08:08:00 -04:00
doug 025993407e FIX: Add event.category field to pfsense firewall logs #8112 2022-06-13 08:03:44 -04:00
Doug BurksandGitHub 73baa1d2f0 Merge pull request #8073 from Security-Onion-Solutions/dougburks-patch-1 
Update motd.md to include links to Dashboards and Cases
 2022-06-04 08:53:54 -04:00
Doug BurksandGitHub dce415297c improve readability in motd.md 2022-06-04 06:59:09 -04:00
Doug BurksandGitHub de126647f8 Update motd.md to include links to Dashboards and Cases 2022-06-04 06:55:08 -04:00
Doug BurksandGitHub c34f456151 Merge pull request #8069 from Security-Onion-Solutions/dougburks-patch-1 
add bar and pie examples to overview dashboard in dashboards.queries.…
 2022-06-03 15:04:16 -04:00
Doug BurksandGitHub 83bff5ee87 add bar and pie examples to overview dashboard in dashboards.queries.json 2022-06-03 15:02:40 -04:00
Doug BurksandGitHub 918f431728 Merge pull request #8065 from Security-Onion-Solutions/dougburks-patch-1 
Add sankey diagram to default dashboard in dashboards.queries.json
 2022-06-03 11:13:39 -04:00
Doug BurksandGitHub 4a886338c8 fix description field for default dashboard in dashboards.queries.json 2022-06-03 11:10:01 -04:00
Doug BurksandGitHub 7da1802eae Add sankey diagram to default dashboard in dashboards.queries.json 2022-06-03 11:03:48 -04:00
Doug BurksandGitHub 91f8d3e5e9 Merge pull request #8050 from Security-Onion-Solutions/fix/elastalert-query 
FIX: Elastalert query in Hunt #8049
 2022-05-31 16:54:34 -04:00
Doug BurksandGitHub 269b16bbfd https://github.com/Security-Onion-Solutions/securityonion/issues/8049 2022-05-31 16:51:05 -04:00
Doug BurksandGitHub cd382a1b25 FIX: Elastalert query in Hunt #8049 2022-05-31 16:50:32 -04:00
Doug BurksandGitHub e1c9b0d108 FIX: Elastalert query in Hunt #8049 2022-05-31 16:47:52 -04:00
Doug BurksandGitHub 9a98667e85 FIX: Elastalert query in Hunt #8049 2022-05-31 16:47:11 -04:00
doug b93a108386 update Cases screenshot in README 2022-05-27 16:33:08 -04:00
doug 6089f3906d update screenshots and README 2022-05-27 16:32:00 -04:00
Doug BurksandGitHub 6bd02c0b99 Merge pull request #8003 from Security-Onion-Solutions/feature/elastic-7.17.4 
UPGRADE: Elastic 7.17.4 #8002
 2022-05-24 13:24:13 -04:00
Doug BurksandGitHub 1d0bb21908 UPGRADE: Elastic 7.17.4 #8002 2022-05-24 13:19:30 -04:00
Doug BurksandGitHub bde06e7ec5 UPGRADE: Elastic 7.17.4 #8002 2022-05-24 13:19:01 -04:00
Doug BurksandGitHub eb9597217c Merge pull request #7949 from Security-Onion-Solutions/fix/dashboards-hunt-queries 
update dashboards.queries.json and hunt.queries.json
 2022-05-16 08:47:06 -04:00
doug 5cbb50a781 update dashboards.queries.json and hunt.queries.json 2022-05-16 08:33:48 -04:00
Doug BurksandGitHub 58b049257d Merge pull request #7932 from Security-Onion-Solutions/dougburks-patch-1 
remove duplicate showSubtitle from hunt.queries.json
 2022-05-12 09:24:18 -04:00
Doug BurksandGitHub 6ed3f42449 remove duplicate showSubtitle from hunt.queries.json 2022-05-12 09:23:00 -04:00
Doug BurksandGitHub 2910b56ea1 Merge pull request #7835 from Security-Onion-Solutions/elastic-7.17.3 
UPGRADE: Elastic 7.17.3 #7807
 2022-04-21 09:02:51 -04:00
Doug BurksandGitHub e608285341 UPGRADE: Elastic 7.17.3 #7807 2022-04-21 08:57:08 -04:00
Doug BurksandGitHub 04856540dc UPGRADE: Elastic 7.17.3 #7807 2022-04-21 08:54:09 -04:00
Doug BurksandGitHub feb7eeeb8e UPGRADE: Elastic 7.17.3 #7807 2022-04-21 08:47:40 -04:00
Doug BurksandGitHub 44f4b1da7f Merge pull request #7832 from Security-Onion-Solutions/fix/prevent-multiple-instances 
FIX: Prevent multiple instances of so-sensor-clean and so-playbook-sync #6622
 2022-04-20 17:00:09 -04:00
Doug BurksandGitHub 1edb443c5d so-playbook-sync pgrep should be more strict to avoid multiple matches on Ubuntu 2022-04-20 16:48:26 -04:00
Doug BurksandGitHub 8fc03afdc0 so-sensor-clean pgrep should be more strict to avoid matching multiples on Ubuntu 2022-04-20 16:47:18 -04:00
Doug BurksandGitHub 3aac644da5 Merge pull request #7830 from Security-Onion-Solutions/dougburks-patch-1 
FIX: Improve Zeek file extraction #7829
 2022-04-20 14:13:13 -04:00
Doug BurksandGitHub 15ef0968d9 FIX: Improve Zeek file extraction #7829 2022-04-20 14:01:46 -04:00
Doug BurksandGitHub 6339ee3bf3 Merge pull request #7818 from Security-Onion-Solutions/dougburks-patch-1 
Slight change to IDH verbiage in so-whiptail
 2022-04-18 16:35:22 -04:00
Doug BurksandGitHub 5d62ece03b Slight change to IDH verbiage in so-whiptail 2022-04-18 16:33:54 -04:00
Doug BurksandGitHub 6905ca276a Merge pull request #7816 from Security-Onion-Solutions/dougburks-patch-1 
remove old comments from so-whiptail
 2022-04-18 11:30:43 -04:00
Doug BurksandGitHub 3682754399 remove old comments from so-whiptail 2022-04-18 11:29:46 -04:00
Doug BurksandGitHub 3fb7399000 Merge pull request #7813 from Security-Onion-Solutions/dougburks-patch-1 
Remove distributed verbiage from other node option in so-whiptail
 2022-04-18 08:24:52 -04:00
Doug BurksandGitHub 400879c079 Remove distributed verbiage from other node option in so-whiptail 2022-04-18 07:53:57 -04:00
Doug BurksandGitHub 62f3f13bbc Merge pull request #7803 from Security-Onion-Solutions/dougburks-patch-1 
move thehive removal from up_to_2.3.120 to post_to_2.3.120
 2022-04-15 15:48:12 -04:00
Doug BurksandGitHub 0eda9a3bd7 move thehive removal from up_to_2.3.120 to post_to_2.3.120 2022-04-15 15:45:01 -04:00
Doug BurksandGitHub ee00678362 Merge pull request #7802 from Security-Onion-Solutions/dougburks-patch-1 
Replace old saltstack repo in so-preflight
 2022-04-15 13:17:14 -04:00
Doug BurksandGitHub ce192c2526 Update so-preflight 2022-04-15 13:11:15 -04:00
Doug BurksandGitHub f461d01961 Merge pull request #7800 from Security-Onion-Solutions/dougburks-patch-1 
Improve grammar in so-whiptail
 2022-04-15 10:52:29 -04:00
Doug BurksandGitHub a69d361d1b Improve grammar in so-whiptail 2022-04-15 10:45:34 -04:00
Doug BurksandGitHub 1e187f0c44 Merge pull request #7703 from Security-Onion-Solutions/hotfix/2.3.110 
Hotfix/2.3.110
 2022-04-04 23:37:28 -04:00
Doug BurksandGitHub a3f8a10eb9 Merge pull request #7608 from Security-Onion-Solutions/fix/telegraf-non-root 
FIX: Run telegraf as non-root #7468
 2022-03-18 15:17:28 -04:00
Doug BurksandGitHub eda7a8d7ea FIX: Update telegraf influxdbsize.sh to collect influxdb size from influxdb_size.log #7468 2022-03-18 13:15:43 -04:00
Doug BurksandGitHub f7dc5588ae FIX: Update common init.sls to create cron job to write influxdb size for telegraf #7468 2022-03-18 13:13:46 -04:00
Doug BurksandGitHub c13994994b FIX: Update telegraf init.sls to run telegraf as non-root #7468 2022-03-18 13:11:56 -04:00
Doug BurksandGitHub 50477071b8 Merge pull request #7588 from Security-Onion-Solutions/fix/prevent-multiple-instances 
FIX: Prevent multiple instances of so-sensor-clean and so-playbook-sync #6622
 2022-03-16 13:54:00 -04:00
Doug BurksandGitHub e65f2a5513 FIX: Prevent multiple instances of so-sensor-clean #6622 2022-03-16 13:28:39 -04:00
Doug BurksandGitHub e56f90d83c FIX: Prevent multiple instances of so-playbook-sync #6622 2022-03-16 13:27:37 -04:00
Doug BurksandGitHub 9bf0265cea Merge pull request #7566 from Security-Onion-Solutions/feature/hunt-soc-auth 
FEATURE: Add new Hunt query for SOC logins #7327
 2022-03-15 10:58:40 -04:00
Doug BurksandGitHub eec44a6b02 Add a SOC Auth query to hunt.queries.json 2022-03-15 10:38:46 -04:00
Doug BurksandGitHub d1e1887e36 Add support for Kratos audit logs in hunt.eventfields.json 2022-03-15 10:37:58 -04:00
Doug BurksandGitHub 63cef4daff Merge pull request #7557 from Security-Onion-Solutions/dougburks-patch-1 
FIX: surilogcompress cron job not running
 2022-03-15 07:41:05 -04:00
Doug BurksandGitHub db4f138a78 FIX: surilogcompress cron job not running 
The suricata user was originally created with `/opt/so/conf/suricata` as its home directory. I think at some point we changed permissions on `/opt/so/conf` and at that point the `surilogcompress` cron job stopped working. Changing the home directory to `/nsm/suricata` works on all of my PROD systems (including Ubuntu and CentOS).

For more information, please see:
https://github.com/Security-Onion-Solutions/securityonion/issues/7133
 2022-03-15 07:10:02 -04:00
Doug BurksandGitHub 06efef7b81 Merge pull request #7467 from Security-Onion-Solutions/dougburks-patch-1 
Revert security_opt addition in telegraf init.sls
 2022-03-08 18:51:52 -05:00
Doug BurksandGitHub b76c01ef53 Revert security_opt addition in telegraf init.sls 2022-03-08 18:27:15 -05:00
Doug BurksandGitHub da8e885ede Merge pull request #7451 from Security-Onion-Solutions/fix/docker-apparmor 
Update init.sls to avoid telegraf apparmor issues
 2022-03-07 17:06:42 -05:00
Doug BurksandGitHub 104de2a3c9 Update init.sls to avoid telegraf apparmor issues 
See #2560
 2022-03-07 16:11:22 -05:00
Doug BurksandGitHub a59779905f Merge pull request #7437 from Security-Onion-Solutions/dougburks-patch-1 
fix typo
 2022-03-07 08:05:07 -05:00
Doug BurksandGitHub 848a5c6350 fix typo 2022-03-07 08:03:41 -05:00
dougandMike Reeves bbced5b52f FIX: curator should exclude so-case* indices #7270 2022-03-01 14:34:52 -05:00
Doug BurksandMike Reeves f134c74585 FIX: curator should exclude so-case* indices #7270 2022-03-01 14:34:41 -05:00
Doug BurksandGitHub adf3dc0cf6 Merge pull request #7370 from Security-Onion-Solutions/fix/syslog 
Revert syslog pipeline updates from Abe's PR for now
 2022-03-01 11:13:13 -05:00
Doug BurksandGitHub e0b3635318 Merge pull request #7339 from Security-Onion-Solutions/fix/zeek_dns-import 
Avoid changing _index for imported logs
 2022-02-27 05:09:00 -05:00
Doug BurksandGitHub 32b71fdcac Avoid changing _index for imported logs 2022-02-26 10:36:09 -05:00
Doug BurksandGitHub 74037e6f00 Merge pull request #7335 from Security-Onion-Solutions/fix/soup-postversion 
make sure that each post_to_* function sets POSTVERSION at end
 2022-02-25 15:27:31 -05:00
Doug BurksandGitHub 8df47e809d make sure that each post_to_* function sets POSTVERSION at end 2022-02-25 14:30:59 -05:00
Doug BurksandGitHub aadc2a844b Merge pull request #7284 from Security-Onion-Solutions/fix/so-curator-closed-delete 
FIX: curator should exclude so-case* indices #7270
 2022-02-22 17:40:23 -05:00
doug 1392fc37e8 FIX: curator should exclude so-case* indices #7270 2022-02-22 17:00:52 -05:00
Doug BurksandGitHub 5b46d19b13 Merge pull request #7273 from Security-Onion-Solutions/dougburks-patch-1 
FIX: curator should exclude so-case* indices #7270
 2022-02-21 09:25:58 -05:00
Doug BurksandGitHub 1abd824c5f FIX: curator should exclude so-case* indices #7270 2022-02-21 09:00:05 -05:00
Doug BurksandGitHub 3b887c7b1a Merge pull request #7239 from Security-Onion-Solutions/dougburks-patch-1 
so-ip-update needs to queue the Kibana dashboard update
 2022-02-17 15:54:10 -05:00
Doug BurksandGitHub b4b7938ce2 so-ip-update needs to queue the Kibana dashboard update in case a salt operation is already running 2022-02-17 15:47:33 -05:00
Doug BurksandGitHub e5d7c1c77a Merge pull request #7238 from Security-Onion-Solutions/dougburks-patch-1-1 
so-ip-update needs to update Kibana dashboards
 2022-02-17 14:53:31 -05:00
Doug BurksandGitHub 1a96162966 so-ip-update needs to update Kibana dashboards 2022-02-17 14:49:55 -05:00
Doug BurksandGitHub e54ece06a2 Merge pull request #7106 from Security-Onion-Solutions/hotfix/2.3.100 
Hotfix/2.3.100
 2022-02-03 16:25:04 -05:00
Doug BurksandGitHub c39047666b Merge pull request #7082 from Security-Onion-Solutions/hotfix/2.3.100 
Hotfix/2.3.100
 2022-02-02 16:38:27 -05:00
Doug BurksandGitHub 7927534279 Merge pull request #7040 from Security-Onion-Solutions/dougburks-patch-1 
Update version from 2.3.91 to 2.3.100
 2022-01-31 13:32:05 -05:00
Doug BurksandGitHub e0f6b9af3a Update version from 2.3.91 to 2.3.100 2022-01-31 13:27:45 -05:00
Doug BurksandGitHub bc0a362b39 Move Kibana dashboard update from post_to_2.3.90() to post_to_2.3.100() 2022-01-29 08:02:56 -05:00
Doug BurksandGitHub 80b7487d45 Merge pull request #6968 from Security-Onion-Solutions/dougburks-patch-1 
Update CONTRIBUTING.md with warning about more involved PRs
 2022-01-24 10:39:40 -05:00
Doug BurksandGitHub 5f67dfd432 Update CONTRIBUTING.md 2022-01-24 10:36:22 -05:00
Doug BurksandGitHub fb5bff3913 Merge pull request #6956 from Security-Onion-Solutions/dougburks-patch-1 
Fix typos in ssh_warning
 2022-01-24 09:39:40 -05:00
Doug BurksandGitHub b103420100 fix typo in so-setup 2022-01-22 10:25:37 -05:00
Doug BurksandGitHub 304ef64bc8 fix another typo in ssh_warning 2022-01-22 10:24:36 -05:00
Doug BurksandGitHub 1e14e2977f Fix typo in ssh_warning 2022-01-22 10:21:14 -05:00
Doug BurksandGitHub a3c8335130 Merge pull request #6827 from Security-Onion-Solutions/dougburks-patch-1 
Remove unnecessary word
 2022-01-11 11:06:40 -05:00
Doug BurksandGitHub 29d8dbe371 Remove unnecessary word 2022-01-11 11:05:30 -05:00
Doug BurksandGitHub e56a9a5f22 Merge pull request #6711 from Security-Onion-Solutions/dougburks-patch-1 
fix typo in so-analyst-install
 2021-12-28 15:24:19 -05:00
Doug BurksandGitHub 463925686d fix typo in so-analyst-install 2021-12-28 15:23:17 -05:00