  Wes LambertandWilliam Wernert
|
7f64d57111
|
Reserve port for Wazuh API and check if port is already in use
|
2021-01-06 14:37:28 -05:00 |
|
|
Wes LambertandWilliam Wernert
|
e7db1a99bd
|
Set @timestamp to winlog.systemTime
|
2021-01-06 14:37:28 -05:00 |
|
|
weslambertandWilliam Wernert
|
c864cc607f
|
Remove multiple old so-yara-update cron jobs, if needed
|
2021-01-06 14:37:27 -05:00 |
|
|
weslambertandWilliam Wernert
|
958635b012
|
Remove old Strelka cron job
|
2021-01-06 14:37:27 -05:00 |
|
 weslambertandGitHub
|
f6a199156b
|
Merge pull request #2428 from Security-Onion-Solutions/feature/strelka_pillar_repos
Support setting rule repos via pillar
|
2020-12-22 10:38:01 -05:00 |
|
|
Wes Lambert
|
ac96ded2dc
|
Support setting rule repos via pillar
|
2020-12-22 15:36:15 +00:00 |
|
|
weslambertandGitHub
|
def08895d5
|
Merge pull request #2393 from Security-Onion-Solutions/fix/strelka_filestream
Fix/strelka filestream
|
2020-12-18 15:48:54 -05:00 |
|
|
weslambertandGitHub
|
2fee2ca143
|
Change identifier name to be more descriptive
|
2020-12-18 15:40:54 -05:00 |
|
|
weslambertandGitHub
|
7453626b06
|
Add identifier
|
2020-12-18 15:39:52 -05:00 |
|
|
weslambertandGitHub
|
1a463bccaf
|
Add cron.absent to remove old cron job if present
|
2020-12-18 11:25:14 -05:00 |
|
|
weslambertandGitHub
|
9493aad1a5
|
Read from dedicated unprocessed dir
|
2020-12-18 10:53:17 -05:00 |
|
|
weslambertandGitHub
|
bf76c1b58c
|
Create unprocessed dir and move Zeek extracted files there
|
2020-12-18 10:52:14 -05:00 |
|
|
weslambertandGitHub
|
24fce27e62
|
Merge pull request #2297 from Security-Onion-Solutions/feature/idstools_arg
Add ability to supply an arg, for example overriding 15 min limit
|
2020-12-10 09:31:50 -05:00 |
|
|
Wes Lambert
|
45faa7fda4
|
Add ability to supply an arg, for example overriding 15 min limit
|
2020-12-10 14:30:29 +00:00 |
|
|
weslambertandGitHub
|
c2cf2c4987
|
Merge pull request #2296 from Security-Onion-Solutions/fix/suricata_ftp_data
Add initial suricata.ftp_data pipeline
|
2020-12-10 09:17:01 -05:00 |
|
|
Wes Lambert
|
f689722559
|
Add initial suricata.ftp_data pipeline
|
2020-12-10 14:14:50 +00:00 |
|
|
weslambertandGitHub
|
d09daef094
|
Merge pull request #2288 from Security-Onion-Solutions/fix/strelka_rules
Expand STRELKARULES
|
2020-12-09 17:05:44 -05:00 |
|
|
weslambertandGitHub
|
0b2e2739bd
|
Expand STRELKARULES
|
2020-12-09 17:05:11 -05:00 |
|
|
weslambertandGitHub
|
c41d4373b7
|
Merge pull request #2192 from Security-Onion-Solutions/fix/elasticsearch_bool_query_clause_count
Add indices.query.bool.max_clause_count to allow for wildcard searche…
|
2020-12-03 09:30:24 -05:00 |
|
|
weslambertandGitHub
|
95570976a8
|
Add indices.query.bool.max_clause_count to allow for wildcard searches targeting more than 1024 fields
|
2020-12-03 09:29:44 -05:00 |
|
|
weslambertandGitHub
|
a84f816eff
|
Merge pull request #2189 from Security-Onion-Solutions/feature/so-elastic-scripts
so-elastic scripts
|
2020-12-03 09:20:47 -05:00 |
|
|
Wes Lambert
|
4ce3ec7582
|
Make scripts executable
|
2020-12-03 14:18:22 +00:00 |
|
|
Wes Lambert
|
f96365baba
|
Add intial grouped Elastic start/stop/restart scripts
|
2020-12-03 14:17:32 +00:00 |
|
|
weslambertandGitHub
|
c819729cd6
|
Don't use max_files or time_to_live for shutdown params
|
2020-12-02 13:17:19 -05:00 |
|
|
weslambertandGitHub
|
0e8f547087
|
Merge pull request #2160 from Security-Onion-Solutions/fix/strelka_mmbot
Remove ScanMmbot
|
2020-12-01 11:26:14 -05:00 |
|
|
weslambertandGitHub
|
9517cb2a58
|
Remove ScanMmbot
|
2020-12-01 11:25:51 -05:00 |
|
|
weslambertandGitHub
|
0c4ee94472
|
Merge pull request #2077 from Security-Onion-Solutions/fix/thehive_upgrade_conf
Fix/thehive upgrade conf
|
2020-11-24 11:52:51 -05:00 |
|
|
weslambertandGitHub
|
39bf60feb7
|
Add digit
|
2020-11-24 11:52:20 -05:00 |
|
|
weslambertandGitHub
|
35653d2e66
|
Changes for ES7
|
2020-11-24 11:51:19 -05:00 |
|
|
weslambertandGitHub
|
eb2364b926
|
Changes for ES7
|
2020-11-24 11:49:08 -05:00 |
|
|
weslambertandGitHub
|
e3a41c2a94
|
Changes for ES7 elasticsearch.yml
|
2020-11-24 11:20:09 -05:00 |
|
|
weslambertandGitHub
|
04c6bed779
|
Merge pull request #1977 from Security-Onion-Solutions/fix/zeek_log_inode_cleanup
Change clean_removed to true to clean up tracking of Zeek logs removed fr…
|
2020-11-18 13:49:46 -05:00 |
|
|
weslambertandGitHub
|
6b4af30fc1
|
Change clean_removed to true cleanup tracking of Zeek logs removed from current
|
2020-11-18 13:47:32 -05:00 |
|
|
weslambertandGitHub
|
4fad0e3a98
|
Merge pull request #1914 from Security-Onion-Solutions/fix/syslog_parsing
Syslog updates
|
2020-11-13 11:07:53 -05:00 |
|
|
Wes Lambert
|
fddfb8eb92
|
Syslog updates
|
2020-11-13 16:06:22 +00:00 |
|
|
weslambertandGitHub
|
8c6adc21a8
|
Merge pull request #1891 from Security-Onion-Solutions/syslog_cef
Update syslog pipeline to allow for initial CEF parsing and pipeline …
|
2020-11-11 16:40:55 -05:00 |
|
|
Wes Lambert
|
8258b782fc
|
Update syslog pipeline to allow for initial CEF parsing and pipeline targeting
|
2020-11-11 21:39:40 +00:00 |
|
|
weslambertandGitHub
|
533a65205f
|
Merge pull request #1885 from Security-Onion-Solutions/fix/syslog_application
Add check for field
|
2020-11-11 10:33:24 -05:00 |
|
|
weslambertandGitHub
|
ea1f53b40c
|
Add check for field
|
2020-11-11 10:29:58 -05:00 |
|
|
weslambertandGitHub
|
280fc501f9
|
Merge pull request #1882 from Security-Onion-Solutions/fix/extra_top_var
Fix duplicate vars
|
2020-11-11 08:53:43 -05:00 |
|
|
weslambertandGitHub
|
625307ac5f
|
Fix duplicate vars
|
2020-11-11 08:52:39 -05:00 |
|
|
weslambertandGitHub
|
44677ad521
|
Merge pull request #1880 from Security-Onion-Solutions/disable_elastic
Allow for disabling Elastic stack via pillar
|
2020-11-11 08:29:23 -05:00 |
|
|
Wes Lambert
|
1c326f561b
|
Allow for disabling Elastic stack via pillar
|
2020-11-11 13:26:59 +00:00 |
|
|
weslambertandGitHub
|
059c4e03e1
|
Merge pull request #1860 from Security-Onion-Solutions/strelka-parsing
Pull out additional fields from Exif info
|
2020-11-09 11:54:55 -05:00 |
|
|
Wes Lambert
|
7e578d2ce0
|
Pull out additional fields from Exif info
|
2020-11-09 16:53:53 +00:00 |
|
|
weslambertandGitHub
|
3abe8cb397
|
Merge pull request #1836 from Security-Onion-Solutions/fix/wazuh_agent_register
Don't sleep if not registering agent
|
2020-11-05 14:03:32 -05:00 |
|
|
weslambertandGitHub
|
2911e37b70
|
Don't sleep if not registering agent
|
2020-11-05 14:03:08 -05:00 |
|
|
weslambertandGitHub
|
e040009d0b
|
Merge pull request #1804 from Security-Onion-Solutions/fix/wazuh_api_creds_remove
Remove Wazuh API creds after registering initial agent
|
2020-11-03 09:57:58 -05:00 |
|
|
Wes Lambert
|
7dca988c11
|
Remove Wazuh API creds after registering intial agent
|
2020-11-03 14:53:50 +00:00 |
|
|
weslambertandGitHub
|
bfe98433f6
|
Merge pull request #1789 from Security-Onion-Solutions/fix/zeek_intel
Add Zeek intel.dat
|
2020-11-02 16:38:16 -05:00 |
|
|
Wes Lambert
|
05549a2362
|
Add Zeek intel.dat
|
2020-11-02 21:36:44 +00:00 |
|
|
weslambertandGitHub
|
8a645edb34
|
Merge pull request #1788 from Security-Onion-Solutions/feature/nids_rules
Allow for muliple files for rules
|
2020-11-02 16:05:53 -05:00 |
|
|
Wes Lambert
|
24a54a326c
|
Allow for muliple files for rules
|
2020-11-02 21:03:45 +00:00 |
|
|
weslambertandGitHub
|
bb0cf9b8c7
|
Merge pull request #1784 from Security-Onion-Solutions/fix/strelka_exif_parsing
Fix/strelka exif parsing
|
2020-11-02 14:32:45 -05:00 |
|
|
Wes Lambert
|
3113d5fbdb
|
Format scan.exiftool as text
|
2020-11-02 19:31:14 +00:00 |
|
|
Wes Lambert
|
6420ee0310
|
Update parsing for scan.exiftool
|
2020-11-02 19:28:12 +00:00 |
|
|
weslambertandGitHub
|
37c630d6ab
|
Merge pull request #1776 from Security-Onion-Solutions/bugfix/af-packet-ring-size
Match max-pending-packets size
|
2020-11-02 08:39:21 -05:00 |
|
|
weslambertandGitHub
|
71a260a000
|
Match max-pending-packets size
|
2020-11-02 08:38:45 -05:00 |
|
|
weslambertandGitHub
|
7ea8dc84b6
|
Merge pull request #1696 from Security-Onion-Solutions/feature/wazuh-user-mods
Add Wazuh user management scripts
|
2020-10-28 08:24:15 -04:00 |
|
|
Wes Lambert
|
453247971e
|
Add Wazuh user management scripts
|
2020-10-28 12:22:50 +00:00 |
|
|
weslambertandGitHub
|
e2d95e0deb
|
Merge pull request #1576 from Security-Onion-Solutions/fix/comon_nids_rule_ruleset
Change rule_ruleset to rule.ruleset
|
2020-10-20 22:15:00 -04:00 |
|
|
weslambertandGitHub
|
4765ef5f5c
|
Change rule_ruleset to rule.ruleset
|
2020-10-20 22:14:23 -04:00 |
|
|
weslambertandGitHub
|
657e251f51
|
Merge pull request #1528 from Security-Onion-Solutions/fix/kibana_ack
Update Kibana mappings for event ack/eslacation
|
2020-10-15 14:48:00 -04:00 |
|
|
Wes Lambert
|
d863f26f9d
|
Update Kibana mappings for event ack/eslacation
|
2020-10-15 18:46:37 +00:00 |
|
|
weslambertandGitHub
|
36b9450a39
|
Merge pull request #1526 from Security-Onion-Solutions/fix/kibana_things
Intel mapping enforcement and winlog.verion
|
2020-10-15 08:43:34 -04:00 |
|
|
Wes Lambert
|
af9daa4d71
|
Intel mapping enforcement and winlog.verion
|
2020-10-15 12:42:33 +00:00 |
|
|
weslambertandGitHub
|
c81ee9621d
|
Merge pull request #1525 from Security-Onion-Solutions/fix/kibana_discover_default
Fix default discover query
|
2020-10-14 17:44:55 -04:00 |
|
|
Wes Lambert
|
e7401b3e0c
|
Fix default discover query
|
2020-10-14 21:43:19 +00:00 |
|
|
weslambertandGitHub
|
f2125242f9
|
Merge pull request #1523 from Security-Onion-Solutions/fix/strelka_file_mime_type
Rename file.flavors.mime to file.mime_type
|
2020-10-14 14:58:15 -04:00 |
|
|
Wes Lambert
|
54c4ee796f
|
Rename file.flavors.mime to file.mime_type
|
2020-10-14 18:56:44 +00:00 |
|
|
weslambertandGitHub
|
8d4fd6c18d
|
Merge pull request #1522 from Security-Onion-Solutions/fix/pipeline_commmon_remove_ignore_missing
Fix common pipeline field removal so won't fail for missing fields
|
2020-10-14 09:56:34 -04:00 |
|
|
Wes Lambert
|
3c820365ab
|
Fix common pipeline field removal so won't fail for missing fields
|
2020-10-14 13:55:24 +00:00 |
|
|
weslambertandGitHub
|
4fff105986
|
Merge pull request #1514 from Security-Onion-Solutions/fix/replay_verbiage
Replay verbiage -- let users know when preparing to replay
|
2020-10-13 14:14:41 -04:00 |
|
|
Wes Lambert
|
3f8f0da468
|
Replay verbiage -- let users know when preparing to replay
|
2020-10-13 18:13:36 +00:00 |
|
|
weslambertandGitHub
|
a17a2ad3de
|
Merge pull request #1507 from Security-Onion-Solutions/fix/zeek_smb_ts_common
Ensure Zeek logs without ts field have an @timestamp field associated
|
2020-10-12 13:21:15 -04:00 |
|
|
Wes Lambert
|
14559b081d
|
Ensure Zeek logs without ts field have an @timestamp field associated
|
2020-10-12 17:19:23 +00:00 |
|
|
weslambertandGitHub
|
748ff0dbeb
|
Merge pull request #1506 from Security-Onion-Solutions/fix/index_dates
Fix/index dates
|
2020-10-12 11:45:08 -04:00 |
|
|
Wes Lambert
|
4fc4913d1e
|
Don't predefine index date for Filebeat ES outputs
|
2020-10-12 15:44:00 +00:00 |
|
|
Wes Lambert
|
884cc2d054
|
Don't predefine index date for Logstash outputs
|
2020-10-12 15:41:47 +00:00 |
|
|
weslambertandGitHub
|
12c3c351d8
|
Merge pull request #1498 from Security-Onion-Solutions/feature/filterlog
Feature/filterlog
|
2020-10-09 20:05:21 -04:00 |
|
|
Wes Lambert
|
28a1f7f88a
|
Remove pfsense tag
|
2020-10-10 00:03:51 +00:00 |
|
|
Wes Lambert
|
b55ffa44f8
|
Fix module,dataset rename
|
2020-10-10 00:01:37 +00:00 |
|
|
Wes Lambert
|
69a04dedd3
|
Filterlog config changes
|
2020-10-09 23:56:52 +00:00 |
|
|
weslambertandGitHub
|
993aabedf2
|
Merge pull request #1491 from Security-Onion-Solutions/fix/so-elasticsearch-pipeline-stats-dots
Ensure pipelines with dots in names can be referenced
|
2020-10-08 15:41:44 -04:00 |
|
|
weslambertandGitHub
|
06706d29f2
|
Ensure pipelines with dots in names can be referenced
|
2020-10-08 15:41:17 -04:00 |
|
|
weslambertandGitHub
|
f41987024f
|
Merge pull request #1490 from Security-Onion-Solutions/feature/so-elastic-pipeline-stats
Add pipeline stats script
|
2020-10-08 15:12:55 -04:00 |
|
|
Wes Lambert
|
1efb39a71b
|
Add pipeline stats script
|
2020-10-08 19:11:41 +00:00 |
|
|
weslambertandGitHub
|
0f5f781024
|
Merge pull request #1484 from Security-Onion-Solutions/fix/strelka_rule_null_safe_2
More fixes for rule field
|
2020-10-08 09:37:44 -04:00 |
|
|
Wes Lambert
|
a6d3dcf398
|
More fixes for rule field
|
2020-10-08 13:36:47 +00:00 |
|
|
weslambertandGitHub
|
5e4bbcd4ca
|
Merge pull request #1483 from Security-Onion-Solutions/fix/strelka_rule_null_safe
Add null safe check for rule
|
2020-10-08 09:15:29 -04:00 |
|
|
Wes Lambert
|
a2e2f23a8d
|
Add null safe check for rule
|
2020-10-08 13:14:39 +00:00 |
|
|
weslambertandGitHub
|
3ec9206b17
|
Merge pull request #1482 from Security-Onion-Solutions/fix/network_transport_kibana_viz
Fix network transport Kibana viz
|
2020-10-08 08:18:12 -04:00 |
|
|
Wes Lambert
|
adf0ef87c9
|
Fix network transport Kibana viz
|
2020-10-08 12:17:15 +00:00 |
|
|
weslambertandGitHub
|
7767d3897b
|
Merge pull request #1481 from Security-Onion-Solutions/fix/network_transport_lower
Lowercase network.transport
|
2020-10-08 08:00:22 -04:00 |
|
|
weslambertandGitHub
|
5ada85942b
|
Lowercase network.transport
|
2020-10-08 07:59:57 -04:00 |
|
|
weslambertandGitHub
|
7befff3baa
|
Merge pull request #1474 from Security-Onion-Solutions/fix/common_nids
Don't use regex for determining rule type
|
2020-10-07 12:16:55 -04:00 |
|
|
Wes Lambert
|
7543144afe
|
Don't use regex for determining rule type
|
2020-10-07 16:15:43 +00:00 |
|
|
weslambertandGitHub
|
7787f81bdd
|
Merge pull request #1473 from Security-Onion-Solutions/fix/logstash_output_wazuh
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:49:40 -04:00 |
|
|
weslambertandGitHub
|
8e829b47ae
|
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:48:56 -04:00 |
|
|
weslambertandGitHub
|
8015676e01
|
Merge pull request #1472 from Security-Onion-Solutions/fix/rename-signature_info
Change rule.signature_info to rule.reference and ensure common.nids e…
|
2020-10-07 11:21:18 -04:00 |
|