2535ae953d
Fix Index Patterns
...
so-assistant-chat and so-assistant-session both had templates with a trailing dash that prevented the pattern from applying to the name of the indices.
2025-09-09 14:00:01 -06:00
855b489c4b
datastream
2025-09-08 09:13:24 -06:00
673f9cb544
Responding to Feedback
2025-09-08 09:13:24 -06:00
73776f8d11
Cleaning up New ES Indexes
2025-09-08 09:13:23 -06:00
cea4eaf081
Updated Assistant Mapping
2025-09-08 09:13:22 -06:00
b1753f86f9
New Message Structure
2025-09-08 09:13:22 -06:00
6323fbf46b
Content Object
2025-09-08 09:13:21 -06:00
ba601c39b3
Rough Go at New Mappings/Settings
2025-09-08 09:13:21 -06:00
dfec29d18e
custom kquery
2025-09-04 15:37:28 -05:00
1a32a0897c
Merge remote-tracking branch 'origin/2.4/dev' into reyesj2/ea-alerter
2025-09-02 17:11:21 -05:00
e26310d172
elastic agent offline alerter
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-09-02 17:00:03 -05:00
a5675a79fe
es 8.18.6 pipeline upd
2025-08-28 19:45:17 -05:00
1ea7b3c09f
es 8.18.6
2025-08-28 18:27:56 -05:00
cdb7f0602c
Merge pull request #14889 from Security-Onion-Solutions/reyesj2-es-helper
...
only show data nodes in disk usage output
2025-07-29 14:45:30 -05:00
07305d8799
only show data nodes in disk usage output
2025-07-29 14:15:43 -05:00
fbf5bafae7
set 2m timeout
2025-07-28 15:17:04 -05:00
d49cd3cb85
increased timeout for so-elasticsearch-roles-load from default of 30s
2025-07-28 15:14:12 -05:00
84b38daf62
name destination_geo & source_geo to destination.as and source.as better aligning with ECS and linking other log sources already using .as for ASN geo data.
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-07-25 16:17:22 -05:00
3fc244ee85
8.18.4
2025-07-22 16:56:51 -05:00
47831eb300
Merge pull request #14856 from Security-Onion-Solutions/reyesj2-es-ts
...
elasticsearch troubleshoot script
2025-07-17 15:56:40 -05:00
0b1f2252ee
elasticsearch troubleshoot script
2025-07-17 13:27:54 -05:00
c29f11863e
ja4 ignore empty strings
2025-07-17 10:47:00 -05:00
b3eb06f53e
ja4
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-07-16 15:56:34 -05:00
317d7dea7d
check required files exist before loading map file
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-07-09 17:25:36 -05:00
b9d813cef2
typo
2025-07-08 18:26:46 -05:00
bef2fa9e8d
8.18.3 pipeline updates
2025-07-08 16:09:16 -05:00
d4f0cbcb67
changes for 'generic' integrations with no compoent templates assigned. Default to using the logs-filestream.generic@package componet template
2025-07-08 15:23:46 -05:00
d8be6e42e1
es 8.18.3
2025-07-07 12:58:00 -05:00
0602601655
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-06-20 16:25:16 -04:00
31cd5b1365
Add support for dns.resolved_ip
2025-06-20 15:02:59 -04:00
2ef89be67d
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-06-05 09:40:44 -04:00
d9790b04f6
Merge pull request #14676 from Security-Onion-Solutions/reyesj2/fixsystemtime
...
fix system integration time overwrite and delete unused ingest pipeline
2025-06-03 14:01:42 -05:00
d240fca721
remove usage of temp file
2025-06-03 08:45:04 -05:00
4d6171bde6
rename script
...
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com >
2025-06-03 07:32:12 -05:00
6238a5b3ed
tighten up search timeframe
2025-06-02 16:31:26 -05:00
061600fa7a
shebang line
2025-06-02 15:55:46 -05:00
1b89cc6818
so-elasticsearch-index-growth script
2025-06-02 15:41:03 -05:00
6e1e617124
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-06-02 14:06:00 -04:00
bf38055a6c
add echo to end of so-elasticsearch-ilm-stop
2025-05-30 11:41:50 -04:00
90b8d6b2f7
add echo to end of so-elasticsearch-ilm-start
2025-05-30 11:41:11 -04:00
45d541d4f2
FIX: so-elasticsearch-ilm-start needs shebang #14688
2025-05-30 09:55:53 -04:00
b3c48674c5
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-05-30 09:52:14 -04:00
58936b31d5
FIX: Improve annotation for Elasticsearch index deletion #14682
2025-05-29 15:19:21 -04:00
fcdacc3b0d
fix system integration time overwrite and delete unused ingest pipeline
2025-05-29 12:21:28 -05:00
d3ee5ed7b8
use zeek network.community_id when available
2025-05-28 09:20:41 -05:00
b2650da057
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-05-22 09:10:20 -04:00
b753d40861
Tighten parsing
2025-05-20 17:06:11 -04:00
b55cb257b6
Add parsing for Playbook
2025-05-19 13:25:27 -04:00
b0a8191f59
Merge remote-tracking branch 'origin/2.4/dev' into vlb2
2025-05-19 10:02:26 -04:00
df103b3dca
Spacing
2025-05-14 16:36:59 -04:00
Corey Ogburn
reyesj2
Josh Patterson
Josh Brower
Doug Burks