554 Commits

Author	SHA1	Message	Date
Doug Burks	d6cb8ab928	update events_x_process in defaults.yaml	2024-02-23 17:09:40 -05:00
Doug Burks	daf96d7934	fix new eventFields in merged.map.jinja	2024-02-23 17:07:48 -05:00
Doug Burks	58f4fb87d0	fix new eventFields in soc_soc.yaml	2024-02-23 17:06:29 -05:00
Doug Burks	b7ef1e8af1	add more endpoint.events.x fields to soc_soc.yaml	2024-02-23 15:38:53 -05:00
Doug Burks	7da0ccf5a6	add more endpoint.events.x entries to merged.map.jinja	2024-02-23 15:35:53 -05:00
m0duspwnens	573d565976	convert _x_ to . for soc ui to config	2024-02-23 15:03:44 -05:00
Doug Burks	b8baca417b	add endpoint_x_events_x_process to defaults.yaml	2024-02-23 14:03:04 -05:00
Josh Brower	1952f0f232	Merge remote-tracking branch 'origin/2.4/dev' into kilo	2024-02-21 13:11:49 -05:00
Jason Ertel	4b314c8715	replace correlate icon to avoid confusion with searcheng.in	2024-02-20 10:30:09 -05:00
Josh Brower	ffb3cc87b7	Default ruleset; Descriptions	2024-02-16 11:55:10 -05:00
Corey Ogburn	c64f37ab67	sigmaRulePackages is now a string array	2024-02-15 10:34:07 -07:00
Corey Ogburn	a5db9f87dd	Merge branch 'kilo' into cogburn/detection_playbooks	2024-02-13 14:08:44 -07:00
Corey Ogburn	8800b7e878	WIP: Detections Changes ... Removed some strelka/yara rules from salt. Removed yara scripts for downloading and updating rules. This will be managed by SOC. Added a new compile_yara.py script. Added the strelka repos folder.	2024-02-13 14:05:27 -07:00
Corey Ogburn	031ee078c5	socsigmarepo ... Need write permissions on the /opt/so/rules dir so I can clone the sigma repo there.	2024-02-13 14:05:27 -07:00
Josh Brower	0c6c6ba2d5	Various UI tweaks	2024-02-13 13:38:43 -05:00
Doug Burks	0741ae370a	Update defaults.yaml	2024-02-13 12:51:26 -05:00
Doug Burks	8060751a66	Add table columns to process dashboard in defaults.yaml	2024-02-13 12:24:33 -05:00
Josh Brower	ea80469c2d	Detection Default queries	2024-02-12 19:39:55 -05:00
Doug Burks	0ad39a7e32	FEATURE: Add new SOC action to show process ancestry #12345	2024-02-12 19:18:29 -05:00
Doug Burks	20d2f3b97e	Update Sublime action in defaults.yaml to use i18n	2024-02-12 19:13:32 -05:00
Josh Brower	5102269440	Update defaults	2024-02-12 16:44:54 -05:00
Corey Ogburn	29174566f3	WIP: Updated Detection Mappings, Changed Engine to Language ... Detection mappings updated to include the removal of Note and the addition of Tags, Ruleset, and Language. SOC defaults updated to use language based queries rather than engine and show the language column instead of the engine column in results.	2024-02-08 09:44:56 -07:00
Josh Brower	81a3e95914	Fixup sigma pipelines	2024-02-07 16:42:16 -05:00
Doug Burks	d3d2305f00	FEATURE: Add new dashboards for community_id and firewall auth #12323	2024-02-07 16:08:27 -05:00
Josh Brower	7e3187c0b8	Fixup sigma pipelines	2024-02-07 15:35:31 -05:00
Josh Brower	b7b501d289	Add Sigma pipelines	2024-02-07 15:02:52 -05:00
Doug Burks	7106095128	FEATURE: Improve Correlate and Hunt actions on SOC Actions menu #12315	2024-02-06 15:39:23 -05:00
Josh Brower	378c99ae88	Fix bindings	2024-02-02 18:27:49 -05:00
Corey Ogburn	8f81c9eb68	Updating config for Detection(s)	2024-02-02 11:49:58 -07:00
Josh Brower	fe196b5661	Add SOC Config for Detections	2024-02-01 12:22:50 -05:00
Josh Brower	49b5788ac1	add bindings	2024-02-01 07:21:49 -05:00
Corey Ogburn	858166bcae	WIP: Detections Changes ... Removed some strelka/yara rules from salt. Removed yara scripts for downloading and updating rules. This will be managed by SOC. Added a new compile_yara.py script. Added the strelka repos folder.	2024-01-30 15:43:51 -07:00
Corey Ogburn	0fa4d92f8f	socsigmarepo ... Need write permissions on the /opt/so/rules dir so I can clone the sigma repo there.	2024-01-30 14:49:05 -07:00
Jason Ertel	e075d07f5c	show last highstate date/time on grid metrics screen; expose maxUploadSize and staleMetricsMs settings on config screen	2023-12-29 11:38:42 -05:00
Doug Burks	ab5de4c104	update soc defaults.yaml	2023-12-19 07:27:07 -05:00
Doug Burks	4d8661d2e0	FIX: Update dashboard and hunt query for firewall logs #12021	2023-12-18 13:38:04 -05:00
Doug Burks	6a1073b616	FIX: Update dashboard and hunt query for firewall logs #12021	2023-12-18 12:57:40 -05:00
Doug Burks	8779fb8cbc	Update defaults.yaml	2023-12-14 13:30:52 -05:00
Doug Burks	042e5ae9f0	https://github.com/Security-Onion-Solutions/securityonion/issues/12021	2023-12-14 12:46:28 -05:00
m0duspwnens	3dbf97944d	fix extra_hosts. https://github.com/Security-Onion-Solutions/securityonion/issues/12015	2023-12-14 10:26:29 -05:00
weslambert	0334ef9677	Add eml observable type	2023-12-05 19:10:16 -05:00
Jason Ertel	c09e8f0d71	improve timing of responses	2023-11-16 15:58:48 -05:00
Jason Ertel	de99cda766	improve timing of responses	2023-11-16 15:51:17 -05:00
Doug Burks	4666b993e5	Update defaults.yaml	2023-11-14 09:58:45 -05:00
Wes	bca1194a46	Sublime SOC Action	2023-11-01 14:01:55 +00:00
m0duspwnens	99662c999f	log operation and minion target	2023-10-20 13:41:24 -04:00
Jason Ertel	84c39b5de7	only add heavynodes to remoteHostUrls	2023-10-16 13:01:13 -04:00
m0duspwnens	35157f2e8b	add comment	2023-09-07 15:46:04 -04:00
m0duspwnens	60f1947eb4	prevent endgame_dict from being added to standard_actions if it is already present	2023-09-07 14:01:19 -04:00
m0duspwnens	ffaab4a1b4	only add endgame to action if it is populated	2023-09-06 14:19:53 -04:00