1321 Commits

Author	SHA1	Message	Date
Jorge Reyes	d2aa60b961	log4j2 settings	2025-10-17 07:40:44 -05:00
reyesj2	e910de0a06	update log4j2 policy for ES json output ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-10-16 16:19:55 -05:00
reyesj2	3e22043ea6	es logging retention	2025-10-14 15:08:51 -05:00
reyesj2	2baf2478da	add additional elasticsearch log output in json format for elasticsearch log integration to parse	2025-10-14 12:47:03 -05:00
reyesj2	378d37d74e	add event.module to elasticsearch server logs	2025-10-14 12:44:51 -05:00
reyesj2	8675193d1f	elasticsearch upgrade 8.18.8	2025-10-06 12:56:31 -05:00
Jorge Reyes	4d24c57903	Merge pull request #15028 from Security-Onion-Solutions/reyesj2/ea-alerter ... agent monitor template & dataset name update	2025-09-12 14:45:20 -05:00
reyesj2	0606c0a454	agent monitor template & dataset name update	2025-09-12 14:26:22 -05:00
Jorge Reyes	b35b0aaf2c	Merge pull request #14941 from Security-Onion-Solutions/reyesj2/lgest ... zeek dns.resolved_ip	2025-09-12 13:22:40 -05:00
Josh Brower	d89df5f0dd	Merge pull request #15025 from Security-Onion-Solutions/2.4/fixes ... Parsing fix	2025-09-12 13:44:03 -04:00
DefensiveDepth	f0c1922600	Support endpoint logs with no host.ip field	2025-09-12 13:31:34 -04:00
DefensiveDepth	ab2cdd18ed	Support endpoint logs with no host.ip field	2025-09-12 13:29:43 -04:00
reyesj2	588a1b86d1	suricata metadata index rollover 1d -> 30d	2025-09-11 15:46:45 -05:00
Corey Ogburn	2535ae953d	Fix Index Patterns ... so-assistant-chat and so-assistant-session both had templates with a trailing dash that prevented the pattern from applying to the name of the indices.	2025-09-09 14:00:01 -06:00
reyesj2	855b489c4b	datastream	2025-09-08 09:13:24 -06:00
Corey Ogburn	673f9cb544	Responding to Feedback	2025-09-08 09:13:24 -06:00
Corey Ogburn	73776f8d11	Cleaning up New ES Indexes	2025-09-08 09:13:23 -06:00
Corey Ogburn	cea4eaf081	Updated Assistant Mapping	2025-09-08 09:13:22 -06:00
Corey Ogburn	b1753f86f9	New Message Structure	2025-09-08 09:13:22 -06:00
Corey Ogburn	6323fbf46b	Content Object	2025-09-08 09:13:21 -06:00
Corey Ogburn	ba601c39b3	Rough Go at New Mappings/Settings	2025-09-08 09:13:21 -06:00
reyesj2	dfec29d18e	custom kquery	2025-09-04 15:37:28 -05:00
reyesj2	1a32a0897c	Merge remote-tracking branch 'origin/2.4/dev' into reyesj2/ea-alerter	2025-09-02 17:11:21 -05:00
reyesj2	e26310d172	elastic agent offline alerter ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-09-02 17:00:03 -05:00
reyesj2	a5675a79fe	es 8.18.6 pipeline upd	2025-08-28 19:45:17 -05:00
reyesj2	1ea7b3c09f	es 8.18.6	2025-08-28 18:27:56 -05:00
reyesj2	d0ba6df2fc	remove any "" from dns.resolved_ip	2025-08-19 13:44:24 -05:00
reyesj2	95bee91b12	zeek dns.resolved_ip	2025-08-19 11:20:59 -05:00
Jorge Reyes	cdb7f0602c	Merge pull request #14889 from Security-Onion-Solutions/reyesj2-es-helper ... only show data nodes in disk usage output	2025-07-29 14:45:30 -05:00
reyesj2	07305d8799	only show data nodes in disk usage output	2025-07-29 14:15:43 -05:00
reyesj2	fbf5bafae7	set 2m timeout	2025-07-28 15:17:04 -05:00
reyesj2	d49cd3cb85	increased timeout for so-elasticsearch-roles-load from default of 30s	2025-07-28 15:14:12 -05:00
reyesj2	84b38daf62	name destination_geo & source_geo to destination.as and source.as better aligning with ECS and linking other log sources already using .as for ASN geo data. ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-07-25 16:17:22 -05:00
reyesj2	3fc244ee85	8.18.4	2025-07-22 16:56:51 -05:00
Jorge Reyes	47831eb300	Merge pull request #14856 from Security-Onion-Solutions/reyesj2-es-ts ... elasticsearch troubleshoot script	2025-07-17 15:56:40 -05:00
reyesj2	0b1f2252ee	elasticsearch troubleshoot script	2025-07-17 13:27:54 -05:00
reyesj2	c29f11863e	ja4 ignore empty strings	2025-07-17 10:47:00 -05:00
reyesj2	b3eb06f53e	ja4 ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-07-16 15:56:34 -05:00
reyesj2	317d7dea7d	check required files exist before loading map file ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-07-09 17:25:36 -05:00
reyesj2	b9d813cef2	typo	2025-07-08 18:26:46 -05:00
reyesj2	bef2fa9e8d	8.18.3 pipeline updates	2025-07-08 16:09:16 -05:00
reyesj2	d4f0cbcb67	changes for 'generic' integrations with no compoent templates assigned. Default to using the logs-filestream.generic@package componet template	2025-07-08 15:23:46 -05:00
reyesj2	d8be6e42e1	es 8.18.3	2025-07-07 12:58:00 -05:00
Josh Patterson	0602601655	Merge remote-tracking branch 'origin/2.4/dev' into vlb2	2025-06-20 16:25:16 -04:00
Josh Brower	31cd5b1365	Add support for dns.resolved_ip	2025-06-20 15:02:59 -04:00
Josh Patterson	2ef89be67d	Merge remote-tracking branch 'origin/2.4/dev' into vlb2	2025-06-05 09:40:44 -04:00
Jorge Reyes	d9790b04f6	Merge pull request #14676 from Security-Onion-Solutions/reyesj2/fixsystemtime ... fix system integration time overwrite and delete unused ingest pipeline	2025-06-03 14:01:42 -05:00
reyesj2	d240fca721	remove usage of temp file	2025-06-03 08:45:04 -05:00
reyesj2	4d6171bde6	rename script ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2025-06-03 07:32:12 -05:00
reyesj2	6238a5b3ed	tighten up search timeframe	2025-06-02 16:31:26 -05:00