CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 21:03:10 +02:00
Code Issues Packages Projects Releases Wiki Activity
9,146 Commits 40 Branches 127 Tags
da30f6609682c8e86ea5b69e25cee67ea9b503cf
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub ff25d6f80b Merge pull request #6447 from Security-Onion-Solutions/eg_dashes 
Add initial EG dashboards
 2021-12-03 18:05:22 -05:00
Wes Lambert 0571612ea1 Add initial EG dashes 2021-12-03 22:38:30 +00:00
weslambertandGitHub 92131d4bb7 Merge pull request #6215 from Security-Onion-Solutions/fix/eg_spelling 
Fix spelling
 2021-11-12 21:13:28 -05:00
weslambertandGitHub 9ac1cb0e76 Fix spelling 2021-11-12 21:12:09 -05:00
weslambertandGitHub 8c46a2d1db Merge pull request #6210 from Security-Onion-Solutions/fix/soc_pillar_soup 
Add SOC pillar entry
 2021-11-12 13:35:46 -05:00
Wes Lambert 2fb9196604 Move logic above version declaration 2021-11-12 18:26:21 +00:00
Wes Lambert 48c71c8b12 Add soc pillar entry 2021-11-12 18:23:09 +00:00
weslambertandGitHub 8d185ced61 Merge pull request #6209 from Security-Onion-Solutions/fix/endgame_setup 
Adjust manager pillar config for Endgame and defaults
 2021-11-12 12:27:55 -05:00
weslambertandGitHub bc2e470da9 Fix indentation 2021-11-12 12:20:00 -05:00
weslambertandGitHub 0f817cd735 Merge pull request #6208 from Security-Onion-Solutions/fix/endgame_pivot 
Make Endgame pivot independent
 2021-11-12 12:17:24 -05:00
weslambertandGitHub df5901a65d Adjust how manager pillar is populated for ENDGAME and default SOC config 2021-11-12 12:16:26 -05:00
weslambertandGitHub 3cd1b5687e Make pivot condition independent for ENDGAMEHOST 2021-11-12 12:06:39 -05:00
weslambertandGitHub 6eb1a0b0ae Merge pull request #6169 from Security-Onion-Solutions/fix/ingest_dynamic_ref 
Add dynamic conf to config change check
 2021-11-09 16:11:38 -05:00
weslambertandGitHub 9301b8f5b9 Add dynamic conf to config change check 2021-11-09 15:56:52 -05:00
weslambertandGitHub 9597373e4a Merge pull request #6167 from Security-Onion-Solutions/ecs_pipeline_common 
Add config for dynamically formatted ingest pipelines
 2021-11-09 15:41:43 -05:00
Wes Lambert f80b70e008 Add config for dynamically formatted ingest pipelines 2021-11-09 20:07:53 +00:00
weslambertandGitHub 8bf88043ac Merge pull request #6149 from Security-Onion-Solutions/add_test_pipeline 
Add ECS testing pipeline
 2021-11-08 15:43:03 -05:00
Wes Lambert 46d3eb452d Add ECS testing pipeline 2021-11-08 20:08:56 +00:00
weslambertandGitHub 926551d398 Merge pull request #5998 from Security-Onion-Solutions/fix/hl_host_name 
Rename HTTP client headers and host
 2021-10-25 13:21:11 -04:00
weslambertandGitHub 3be0d05eea Update field removal based on HTTP input changes 2021-10-25 13:16:30 -04:00
weslambertandGitHub 7fa43a276a Rename default headers and host for HTTP input 2021-10-25 13:15:20 -04:00
weslambertandGitHub 40dd33affe Merge pull request #5971 from Security-Onion-Solutions/feature/es_templates 
Add .keyword subfield for conflict fields
 2021-10-21 15:07:00 -04:00
weslambertandGitHub 77ee1db44c Add .keyword subfield for conflict fields 2021-10-21 12:56:03 -04:00
weslambertandGitHub 6f3e441bf7 Merge pull request #5945 from Security-Onion-Solutions/fix/soc_index_pattern 
Remove space to allow pattern(s) to be correctly interpreted
 2021-10-19 13:05:40 -04:00
weslambertandGitHub 9453ed7fa1 Remove space to allow pattern(s) to be correctly interpreted 2021-10-19 13:01:40 -04:00
weslambertandGitHub 7590728a0b Merge pull request #5915 from Security-Onion-Solutions/feature/ti_module 
Add TI module
 2021-10-15 17:17:33 -04:00
weslambertandGitHub bb36fc1ed8 Add TI module defaults 2021-10-15 17:16:38 -04:00
weslambertandGitHub d0a6dafc8b Add TI module 2021-10-15 17:09:59 -04:00
weslambertandGitHub 59852841ff Add keyword subfield for event.module 2021-10-15 13:29:50 -04:00
weslambertandGitHub 6f1f7d2a63 Merge pull request #5905 from Security-Onion-Solutions/feature/soc_es_index_pattern 
Allow setting ES index patterns for SOC in pillar
 2021-10-15 13:28:04 -04:00
Wes Lambert 8feeff97b5 Add EG index pattern during setup (if enabled) 2021-10-15 16:19:19 +00:00
Wes Lambert 032373187c Allow setting ES index patterns for SOC in pillar 2021-10-15 16:02:53 +00:00
weslambertandGitHub 490f7eaf81 Merge pull request #5886 from Security-Onion-Solutions/feature/eg_pivot 
Add EG pivot
 2021-10-14 14:49:38 -04:00
Wes Lambert f1fafa015e Add EG to list of groups to include 127.0.0.1 2021-10-14 16:27:28 +00:00
Wes Lambert 6cdc214582 Add pillar in setup and change name of EG variable 2021-10-14 15:33:37 +00:00
Wes Lambert 15049f44b9 Add EG pivot 2021-10-14 15:15:23 +00:00
weslambertandGitHub 3b45e68ead Merge pull request #5885 from Security-Onion-Solutions/feature/jinjafy_soc_actions 
Allow SOC actions to use Jinja
 2021-10-14 10:03:12 -04:00
Wes Lambert 5ee0ea3fe7 Allow SOC actions to use Jinja 2021-10-14 13:59:55 +00:00
weslambertandGitHub 55c60f485c Merge pull request #5884 from Security-Onion-Solutions/feature/hl_eg 
Add EG firewall allowance via setup
 2021-10-14 09:55:07 -04:00
Wes Lambert 78e88e0765 Add EG firewall allowance via setup 2021-10-13 21:42:54 +00:00
Wes Lambert a9b250c0f4 Add EG firewall config 2021-10-13 21:37:59 +00:00
weslambertandGitHub f9001654bb Merge pull request #5871 from Security-Onion-Solutions/feature/hl_eg 
Initial EG stuff
 2021-10-13 15:07:03 -04:00
Wes Lambert 2a504a061b Add Curator action files for EG indices 2021-10-13 18:40:34 +00:00
Wes Lambert e1629d7ec4 Initial EG stuff 2021-10-13 17:13:07 +00:00
weslambertandGitHub 18d81352c6 Merge pull request #5537 from Security-Onion-Solutions/delta 
Add improved ignore functionality for YARA rules used by Strelka and add default ignored rules that break compilation
 2021-09-16 10:38:49 -04:00
weslambertandGitHub 2affaf07a2 Merge pull request #5521 from Security-Onion-Solutions/fix/strelka-yara 
Fix/strelka yara
 2021-09-15 11:33:44 -04:00
weslambertandGitHub 39e5ded58d Refactor ignore list and only ignore for signature-base for now 2021-09-15 11:32:29 -04:00
weslambertandGitHub 4d41d3aee1 Ignore these rules by default because they are causing issues with YARA compilation with Strelka 2021-09-15 10:29:11 -04:00
weslambertandGitHub 5c8067728e Remove unnecessary logic 2021-09-15 10:22:17 -04:00
weslambertandGitHub 03b45512fa Merge pull request #5436 from Security-Onion-Solutions/fix/kibana_server_url 
Incude server.publicBaseUrl
 2021-09-08 12:13:48 -04:00
weslambertandGitHub b8600be0f1 Incude server.publicBaseUrl 2021-09-08 12:12:09 -04:00
weslambertandGitHub 72542322ca Merge pull request #4857 from Security-Onion-Solutions/fix/beats_output_fb_modules 
Check if Filebeat modules are being used for incoming (external) Beats
 2021-07-19 13:11:06 -04:00
weslambertandGitHub fea4f3f973 Check if Filebeat modules are being used for incoming Beats 2021-07-19 12:57:42 -04:00
weslambertandGitHub bde86e0383 Use http_auth instead of username/password until Curator is upgraded to next version 2021-07-19 12:42:46 -04:00
weslambertandGitHub 7e1be8a3a4 Merge pull request #4798 from Security-Onion-Solutions/fix/strelka_filepath_mapping 
Replace staging with processed in Strelka file path mapping
 2021-07-14 11:16:15 -04:00
Wes Lambert 05aad07bfc Replace staging path with processed path for analyzed files 2021-07-14 15:04:46 +00:00
weslambertandGitHub 42ba9888d7 Merge pull request #4797 from Security-Onion-Solutions/fix/wazuh_data_port 
Change field name and mapping for Wazuh's data.port
 2021-07-14 10:14:53 -04:00
Wes Lambert 723172bc1f Add path_unmatch for data.port so it is not mapped as integer 2021-07-14 13:45:09 +00:00
Wes Lambert 323b5d6694 Add dynamic mapping for wazuh 2021-07-14 13:43:34 +00:00
Wes Lambert 441cd3fc59 Move Wazuh-specific data to wazuh.data 2021-07-14 13:42:51 +00:00
weslambertandGitHub 7cdb967810 Only route to FB module pipeline if filebeat in metadata 2021-07-13 11:36:18 -04:00
weslambertandGitHub c0f3c5b3db Merge pull request #4773 from Security-Onion-Solutions/feature/filebeat-logging-level 
Allow setting Filebeat logging level in pillar
 2021-07-12 10:55:43 -04:00
weslambertandGitHub a895270bc8 Allow setting Filebeat logging level in pillar 2021-07-12 10:27:43 -04:00
weslambertandGitHub ce0b064972 Add conditional for heavynode for redis and elasticsearch 2021-07-06 14:21:29 -04:00
weslambertandGitHub 2f3f04e4ca Change from nodename to host 2021-07-06 14:18:39 -04:00
weslambertandGitHub 2e91f27336 Add conditional for heavynode 2021-07-06 14:17:49 -04:00
weslambertandGitHub 10b1829830 Add conditional for heavynode 2021-07-06 14:16:34 -04:00
weslambertandGitHub 4946f32d88 Add extra_hosts entry for local instance when running as heavy node 2021-07-06 14:14:58 -04:00
weslambertandGitHub fcbacd473d Add ELK, redis 2021-06-30 09:34:56 -04:00
weslambertandGitHub 06d77d9972 Update so-common-template.json 2021-06-30 09:31:32 -04:00
weslambertandJason Ertel c5b81f2f4b Fix output so that it can be redirected to local file with appropriate syntax 2021-06-23 14:41:38 -04:00
weslambertandGitHub d411a9e1ff Merge pull request #4597 from Security-Onion-Solutions/fix/pipeline-view-output 
Fix output so that it can be redirected to local file with appropriat…
 2021-06-23 09:24:41 -04:00
weslambertandGitHub 3fbc850774 Fix output so that it can be redirected to local file with appropriate syntax 2021-06-23 09:17:37 -04:00
weslambertandGitHub 1bef1d5652 Update to apply to any so-prefixed index 2021-06-10 08:16:00 -04:00
weslambertandGitHub cba719b3a0 Remove extra comma 2021-06-02 16:42:09 -04:00
weslambertandGitHub 4241bb08b8 Add suricata/zeek until we migrate templates 2021-06-02 16:37:43 -04:00
weslambertandGitHub 4c74e7f308 Add event.kind and set name to module[dot]dataset 2021-06-02 15:35:26 -04:00
weslambertandGitHub db48c15f1d Create event.kind field and rename dataset to be module[dot]dataset 2021-06-02 15:33:18 -04:00
weslambertandGitHub a1b34e7a88 Fix Suricata index name 2021-06-02 15:30:14 -04:00
Wes Lambert 728d1f7540 Make Zeek and Suricata great again 2021-05-06 14:06:17 +00:00
Wes Lambert ee92ba20b0 Add modules path reference 2021-05-06 13:56:39 +00:00
Wes Lambert 1b749cf004 Additional config 2021-05-06 13:55:07 +00:00
Wes Lambert 37929dbd7d Add additional config for Filebeat modules 2021-05-06 13:54:28 +00:00
Wes Lambert 865ba912f8 Merge remote-tracking branch 'remotes/origin/dev' into pipeline 2021-05-06 13:19:31 +00:00
weslambertandGitHub c867d6648a Merge pull request #4098 from Security-Onion-Solutions/delta 
Add ignore above for message keyword field
 2021-05-05 08:53:39 -04:00
Wes Lambert a1a79719fc Add ignore above for message keyword field 2021-05-05 12:07:30 +00:00
weslambertandGitHub d4e8ea8e72 Merge pull request #4079 from Security-Onion-Solutions/delta 
Add event_data to common template so elastalert/playbook event_data f…
 2021-05-03 13:45:17 -04:00
Wes Lambert 619402cc67 Add event_data to common template so elastalert/playbook event_data fields can be indexed and searchable 2021-05-03 17:03:30 +00:00
weslambertandGitHub 427dd31fcb Merge pull request #3876 from Security-Onion-Solutions/delta 
FIX:Remove ESUSER/ESPASS for now to prevent issues with attempting Elasti…
 2021-04-15 08:11:15 -04:00
Wes Lambert f61bf73f97 Remove ESUSER/ESPASS for now to prevent issues with attempting Elastic Auth when connecting to ES. 2021-04-15 11:59:34 +00:00
weslambertandGitHub 5eb0137c21 Merge pull request #3705 from Security-Onion-Solutions/delta 
Enforce date type for ingest.timestamp
 2021-03-31 08:40:41 -04:00
Wes Lambert 942de130ca Enforce date type for ingest.timestamp 2021-03-31 12:24:51 +00:00
weslambertandGitHub ff317cdcf1 Merge pull request #3684 from Security-Onion-Solutions/delta 
Add Elastic scripts
 2021-03-30 12:06:00 -04:00
Wes Lambert 7049383ba6 Add Elastic scripts 2021-03-30 15:47:05 +00:00
Wes Lambert b481cf885b Update saved objects and remove index patterns because this is now handled by Field Caps API 2021-03-19 18:30:42 +00:00
weslambertandGitHub 8d29f757b1 Merge pull request #3471 from Security-Onion-Solutions/kilo 
Reverse Zeek index close/delete count for Curator
 2021-03-16 14:34:46 -04:00
Wes Lambert 7a02150389 Reverse Zeek index close/delete count for Curator 2021-03-16 17:16:55 +00:00
weslambertandGitHub 5fd483a99d Merge pull request #3466 from Security-Onion-Solutions/soup2340 
Soup for 2.3.40
 2021-03-16 13:03:33 -04:00
Wes Lambert 038c58f3d5 Ignore TIME_WAIT when checking for Strelka frontend port reservation 2021-03-16 14:51:16 +00:00
Wes Lambert f142b754dc Add Strelka files.processed directory so files will be moved from staging to processed 2021-03-15 15:43:31 +00:00