CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,391 Commits 40 Branches 127 Tags
dde7e0bd119a13e2c2d4e5b59ed1fb193fcf91ef
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 8c6adc21a8 Merge pull request #1891 from Security-Onion-Solutions/syslog_cef 
Update syslog pipeline to allow for initial CEF parsing and pipeline …
 2020-11-11 16:40:55 -05:00
Wes Lambert 8258b782fc Update syslog pipeline to allow for initial CEF parsing and pipeline targeting 2020-11-11 21:39:40 +00:00
weslambertandGitHub 533a65205f Merge pull request #1885 from Security-Onion-Solutions/fix/syslog_application 
Add check for field
 2020-11-11 10:33:24 -05:00
weslambertandGitHub ea1f53b40c Add check for field 2020-11-11 10:29:58 -05:00
weslambertandGitHub 280fc501f9 Merge pull request #1882 from Security-Onion-Solutions/fix/extra_top_var 
Fix duplicate vars
 2020-11-11 08:53:43 -05:00
weslambertandGitHub 625307ac5f Fix duplicate vars 2020-11-11 08:52:39 -05:00
weslambertandGitHub 44677ad521 Merge pull request #1880 from Security-Onion-Solutions/disable_elastic 
Allow for disabling Elastic stack via pillar
 2020-11-11 08:29:23 -05:00
Wes Lambert 1c326f561b Allow for disabling Elastic stack via pillar 2020-11-11 13:26:59 +00:00
weslambertandGitHub 059c4e03e1 Merge pull request #1860 from Security-Onion-Solutions/strelka-parsing 
Pull out additional fields from Exif info
 2020-11-09 11:54:55 -05:00
Wes Lambert 7e578d2ce0 Pull out additional fields from Exif info 2020-11-09 16:53:53 +00:00
weslambertandGitHub 3abe8cb397 Merge pull request #1836 from Security-Onion-Solutions/fix/wazuh_agent_register 
Don't sleep if not registering agent
 2020-11-05 14:03:32 -05:00
weslambertandGitHub 2911e37b70 Don't sleep if not registering agent 2020-11-05 14:03:08 -05:00
weslambertandGitHub e040009d0b Merge pull request #1804 from Security-Onion-Solutions/fix/wazuh_api_creds_remove 
Remove Wazuh API creds after registering initial agent
 2020-11-03 09:57:58 -05:00
Wes Lambert 7dca988c11 Remove Wazuh API creds after registering intial agent 2020-11-03 14:53:50 +00:00
weslambertandGitHub bfe98433f6 Merge pull request #1789 from Security-Onion-Solutions/fix/zeek_intel 
Add Zeek intel.dat
 2020-11-02 16:38:16 -05:00
Wes Lambert 05549a2362 Add Zeek intel.dat 2020-11-02 21:36:44 +00:00
weslambertandGitHub 8a645edb34 Merge pull request #1788 from Security-Onion-Solutions/feature/nids_rules 
Allow for muliple files for rules
 2020-11-02 16:05:53 -05:00
Wes Lambert 24a54a326c Allow for muliple files for rules 2020-11-02 21:03:45 +00:00
weslambertandGitHub bb0cf9b8c7 Merge pull request #1784 from Security-Onion-Solutions/fix/strelka_exif_parsing 
Fix/strelka exif parsing
 2020-11-02 14:32:45 -05:00
Wes Lambert 3113d5fbdb Format scan.exiftool as text 2020-11-02 19:31:14 +00:00
Wes Lambert 6420ee0310 Update parsing for scan.exiftool 2020-11-02 19:28:12 +00:00
weslambertandGitHub 37c630d6ab Merge pull request #1776 from Security-Onion-Solutions/bugfix/af-packet-ring-size 
Match max-pending-packets size
 2020-11-02 08:39:21 -05:00
weslambertandGitHub 71a260a000 Match max-pending-packets size 2020-11-02 08:38:45 -05:00
weslambertandGitHub 7ea8dc84b6 Merge pull request #1696 from Security-Onion-Solutions/feature/wazuh-user-mods 
Add Wazuh user management scripts
 2020-10-28 08:24:15 -04:00
Wes Lambert 453247971e Add Wazuh user management scripts 2020-10-28 12:22:50 +00:00
weslambertandGitHub e2d95e0deb Merge pull request #1576 from Security-Onion-Solutions/fix/comon_nids_rule_ruleset 
Change rule_ruleset to rule.ruleset
 2020-10-20 22:15:00 -04:00
weslambertandGitHub 4765ef5f5c Change rule_ruleset to rule.ruleset 2020-10-20 22:14:23 -04:00
weslambertandGitHub 657e251f51 Merge pull request #1528 from Security-Onion-Solutions/fix/kibana_ack 
Update Kibana mappings for event ack/eslacation
 2020-10-15 14:48:00 -04:00
Wes Lambert d863f26f9d Update Kibana mappings for event ack/eslacation 2020-10-15 18:46:37 +00:00
weslambertandGitHub 36b9450a39 Merge pull request #1526 from Security-Onion-Solutions/fix/kibana_things 
Intel mapping enforcement and winlog.verion
 2020-10-15 08:43:34 -04:00
Wes Lambert af9daa4d71 Intel mapping enforcement and winlog.verion 2020-10-15 12:42:33 +00:00
weslambertandGitHub c81ee9621d Merge pull request #1525 from Security-Onion-Solutions/fix/kibana_discover_default 
Fix default discover query
 2020-10-14 17:44:55 -04:00
Wes Lambert e7401b3e0c Fix default discover query 2020-10-14 21:43:19 +00:00
weslambertandGitHub f2125242f9 Merge pull request #1523 from Security-Onion-Solutions/fix/strelka_file_mime_type 
Rename file.flavors.mime to file.mime_type
 2020-10-14 14:58:15 -04:00
Wes Lambert 54c4ee796f Rename file.flavors.mime to file.mime_type 2020-10-14 18:56:44 +00:00
weslambertandGitHub 8d4fd6c18d Merge pull request #1522 from Security-Onion-Solutions/fix/pipeline_commmon_remove_ignore_missing 
Fix common pipeline field removal so won't fail for missing fields
 2020-10-14 09:56:34 -04:00
Wes Lambert 3c820365ab Fix common pipeline field removal so won't fail for missing fields 2020-10-14 13:55:24 +00:00
weslambertandGitHub 4fff105986 Merge pull request #1514 from Security-Onion-Solutions/fix/replay_verbiage 
Replay verbiage -- let users know when preparing to replay
 2020-10-13 14:14:41 -04:00
Wes Lambert 3f8f0da468 Replay verbiage -- let users know when preparing to replay 2020-10-13 18:13:36 +00:00
weslambertandGitHub a17a2ad3de Merge pull request #1507 from Security-Onion-Solutions/fix/zeek_smb_ts_common 
Ensure Zeek logs without ts field have an @timestamp field associated
 2020-10-12 13:21:15 -04:00
Wes Lambert 14559b081d Ensure Zeek logs without ts field have an @timestamp field associated 2020-10-12 17:19:23 +00:00
weslambertandGitHub 748ff0dbeb Merge pull request #1506 from Security-Onion-Solutions/fix/index_dates 
Fix/index dates
 2020-10-12 11:45:08 -04:00
Wes Lambert 4fc4913d1e Don't predefine index date for Filebeat ES outputs 2020-10-12 15:44:00 +00:00
Wes Lambert 884cc2d054 Don't predefine index date for Logstash outputs 2020-10-12 15:41:47 +00:00
weslambertandGitHub 12c3c351d8 Merge pull request #1498 from Security-Onion-Solutions/feature/filterlog 
Feature/filterlog
 2020-10-09 20:05:21 -04:00
Wes Lambert 28a1f7f88a Remove pfsense tag 2020-10-10 00:03:51 +00:00
Wes Lambert b55ffa44f8 Fix module,dataset rename 2020-10-10 00:01:37 +00:00
Wes Lambert 69a04dedd3 Filterlog config changes 2020-10-09 23:56:52 +00:00
weslambertandGitHub 993aabedf2 Merge pull request #1491 from Security-Onion-Solutions/fix/so-elasticsearch-pipeline-stats-dots 
Ensure pipelines with dots in names can be referenced
 2020-10-08 15:41:44 -04:00
weslambertandGitHub 06706d29f2 Ensure pipelines with dots in names can be referenced 2020-10-08 15:41:17 -04:00
weslambertandGitHub f41987024f Merge pull request #1490 from Security-Onion-Solutions/feature/so-elastic-pipeline-stats 
Add pipeline stats script
 2020-10-08 15:12:55 -04:00
Wes Lambert 1efb39a71b Add pipeline stats script 2020-10-08 19:11:41 +00:00
weslambertandGitHub 0f5f781024 Merge pull request #1484 from Security-Onion-Solutions/fix/strelka_rule_null_safe_2 
More fixes for rule field
 2020-10-08 09:37:44 -04:00
Wes Lambert a6d3dcf398 More fixes for rule field 2020-10-08 13:36:47 +00:00
weslambertandGitHub 5e4bbcd4ca Merge pull request #1483 from Security-Onion-Solutions/fix/strelka_rule_null_safe 
Add null safe check for rule
 2020-10-08 09:15:29 -04:00
Wes Lambert a2e2f23a8d Add null safe check for rule 2020-10-08 13:14:39 +00:00
weslambertandGitHub 3ec9206b17 Merge pull request #1482 from Security-Onion-Solutions/fix/network_transport_kibana_viz 
Fix network transport Kibana viz
 2020-10-08 08:18:12 -04:00
Wes Lambert adf0ef87c9 Fix network transport Kibana viz 2020-10-08 12:17:15 +00:00
weslambertandGitHub 7767d3897b Merge pull request #1481 from Security-Onion-Solutions/fix/network_transport_lower 
Lowercase network.transport
 2020-10-08 08:00:22 -04:00
weslambertandGitHub 5ada85942b Lowercase network.transport 2020-10-08 07:59:57 -04:00
weslambertandGitHub 7befff3baa Merge pull request #1474 from Security-Onion-Solutions/fix/common_nids 
Don't use regex for determining rule type
 2020-10-07 12:16:55 -04:00
Wes Lambert 7543144afe Don't use regex for determining rule type 2020-10-07 16:15:43 +00:00
weslambertandGitHub 7787f81bdd Merge pull request #1473 from Security-Onion-Solutions/fix/logstash_output_wazuh 
Remove dataset name since pipeline no longer in use
 2020-10-07 11:49:40 -04:00
weslambertandGitHub 8e829b47ae Remove dataset name since pipeline no longer in use 2020-10-07 11:48:56 -04:00
weslambertandGitHub 8015676e01 Merge pull request #1472 from Security-Onion-Solutions/fix/rename-signature_info 
Change rule.signature_info to rule.reference and ensure common.nids e…
 2020-10-07 11:21:18 -04:00
Wes Lambert 015a441e79 Change rule.signature_info to rule.reference and ensure common.nids exists 2020-10-07 15:20:26 +00:00
weslambertandGitHub a1866e5229 Merge pull request #1471 from Security-Onion-Solutions/fix/ingest-updates 
Fix/ingest updates
 2020-10-07 11:15:55 -04:00
Wes Lambert f0a1457ffd Update common.nids 2020-10-07 15:14:08 +00:00
Wes Lambert 8c07c098f6 Pipeline cleanup 2020-10-06 20:14:15 +00:00
Wes Lambert 350cc41740 Let zeek.common handle common fields for zeek.tunnels 2020-10-06 20:12:23 +00:00
weslambertandGitHub a16419b997 Merge pull request #1466 from Security-Onion-Solutions/fix/so-elasticsearch-templates-load 
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
 2020-10-06 13:19:54 -04:00
Wes Lambert a6a69c57d1 Rename so-elasticsearch-templates to so-elasticsearch-templates-load 2020-10-06 17:18:42 +00:00
weslambertandGitHub 6cdff854f3 Merge pull request #1465 from Security-Onion-Solutions/feature/so-elasticsearch-templates-list 
Add so-elasticsearch-templates-list
 2020-10-06 13:16:11 -04:00
Wes Lambert 787f1d8732 Add so-elasticsearch-templates-list 2020-10-06 17:15:27 +00:00
weslambertandGitHub 1a2921c2bc Merge pull request #1463 from Security-Onion-Solutions/feature/so-elasticsearch-pipelines-list 
Add so-elasticsearch-pipelines-list and fix common script perms
 2020-10-06 13:04:24 -04:00
Wes Lambert 4a5d50cf80 Add so-elasticsearch-pipelines-list and fix common script perms 2020-10-06 17:01:58 +00:00
weslambertandGitHub 706c81daca Merge pull request #1459 from Security-Onion-Solutions/feature/strelka_yara_alert 
Add Strelka YARA matches as alerts
 2020-10-06 08:23:16 -04:00
Wes Lambert 019bec992d Add Strelka YARA matches as alerts 2020-10-06 12:19:44 +00:00
weslambertandGitHub 9f4cb42c4f Merge pull request #1452 from Security-Onion-Solutions/fix/kibana_case_create 
Change alert to case
 2020-10-05 11:46:14 -04:00
Wes Lambert 575da0f9d3 Change alert to case 2020-10-05 15:45:10 +00:00
weslambertandGitHub f4fcc052ca Merge pull request #1451 from Security-Onion-Solutions/fix/wazuh_rule_cat 
Put back rule.category for Wazuh alerts
 2020-10-05 11:35:20 -04:00
weslambertandGitHub bc31e19e37 Put back rule.category for Wazuh alerts 2020-10-05 11:34:29 -04:00
weslambertandGitHub 6e2319f6da Merge pull request #1449 from Security-Onion-Solutions/fix/wazuh_logging 
Adjust Wazuh logging so we don't log alerts to a separate file and so…
 2020-10-05 10:04:01 -04:00
weslambertandGitHub 968dce0aee Adjust Wazuh logging so we don't log alerts to a separate file and so we don't write a separate log file for non-JSON for archives 2020-10-05 10:03:40 -04:00
weslambertandGitHub 6b292ea62b Merge pull request #1448 from Security-Onion-Solutions/fix/so_elastic_clear 
Fix/so elastic clear
 2020-10-05 09:40:04 -04:00
Wes Lambert da8957b4f4 Use Elasticsearch pillar vs manager IP for so-elastic-clear 2020-10-05 13:37:06 +00:00
Wes Lambert 1970d95d5f Make Filebeat registry persistent to avoid re-reading old data 2020-10-05 13:30:04 +00:00
weslambertandGitHub 771d091d6e Merge pull request #1446 from Security-Onion-Solutions/feature/wazuh_severity 
Add event.severity and event.severity_label config for Wazuh alerts
 2020-10-05 08:52:20 -04:00
Wes Lambert 77d31cb289 Add event.severity and event.severity_label config for Wazuh alerts 2020-10-05 12:50:29 +00:00
weslambertandGitHub 203e84d2cf Update comma verbiage for HOME_NET in whiptail menu 2020-10-05 08:08:22 -04:00
weslambertandGitHub 2d2f4de337 Merge pull request #1437 from Security-Onion-Solutions/fix/kib_scripted_thehive 
Update scripted field for TheHive case
 2020-10-01 16:54:02 -04:00
Wes Lambert 8a81a5148b Update scripted field for TheHive case 2020-10-01 20:52:57 +00:00
weslambertandGitHub 98bef8fb9d Merge pull request #1436 from Security-Onion-Solutions/fix/kibana_soc_thehive_case 
Add SOC url for api integration
 2020-10-01 16:47:11 -04:00
Wes Lambert eced18c3cc Add SOC url for api integration 2020-10-01 20:29:28 +00:00
weslambertandGitHub 6818de9e64 Merge pull request #1431 from Security-Onion-Solutions/fix/elastlert_rules 
Remove rule sync, since we don't have any rules to sync
 2020-09-30 18:36:11 -04:00
weslambertandGitHub 887937a75d Remove rule sync, since we don't have any rules to sync 2020-09-30 18:35:35 -04:00
weslambertandGitHub 5b16a65422 Merge pull request #1429 from Security-Onion-Solutions/fix/zeek_server_ip 
Fix issue with null Zeek server IP
 2020-09-30 13:54:50 -04:00
Wes Lambert 02d2e5e2c6 Fix isue with null Zeek server IP 2020-09-30 17:53:30 +00:00
weslambertandGitHub defe832121 Merge pull request #1427 from Security-Onion-Solutions/fix/wazuh_filebeat 
Fix Filebeat config for Wazuh
 2020-09-30 10:59:01 -04:00
Wes Lambert d8f70397f7 Fix Filebeat config for Wazuh 2020-09-30 14:57:56 +00:00