  weslambertandGitHub
|
2cfbf30f05
|
Merge pull request #10070 from Security-Onion-Solutions/fix/cloud_test
Fix cloud sniffing interface configuration
|
2023-03-30 14:41:59 -04:00 |
|
|
weslambertandGitHub
|
3e08506c4e
|
Fix syntax for $is_cloud test
|
2023-03-30 13:26:36 -04:00 |
|
|
Wes
|
d4cba6908e
|
Use dynamic interface value instead of explicitly setting it to 'bond0'
|
2023-03-30 16:17:34 +00:00 |
|
|
Wes
|
dfd3456343
|
Add logging for cloud detection and interface settings
|
2023-03-30 16:15:41 +00:00 |
|
|
Wes
|
3cd1598067
|
Only perform bond interface operations if it is not a cloud installation
|
2023-03-30 16:11:50 +00:00 |
|
|
weslambertandGitHub
|
de902ebd02
|
Merge pull request #10024 from Security-Onion-Solutions/esspace
Manage disk-based index deletion via so-curator-cluster-delete
|
2023-03-28 12:25:19 -04:00 |
|
|
Wes
|
6099a04e41
|
Change how the size is determined, in case there a decimal value is provided
|
2023-03-28 16:04:54 +00:00 |
|
|
Wes
|
ed8f944638
|
Fix typo in GLOBALS reference
|
2023-03-28 15:55:33 +00:00 |
|
|
weslambertandGitHub
|
942182e826
|
Remove additional copyright in so-curator-cluster-delete-delete
|
2023-03-28 11:00:14 -04:00 |
|
|
weslambertandGitHub
|
303fec6302
|
Fix verbiage for so-curator-cluster-delete-delete
|
2023-03-28 10:59:39 -04:00 |
|
|
weslambertandGitHub
|
9411f5ca79
|
Fix closed index function and check
|
2023-03-28 10:54:21 -04:00 |
|
|
Wes
|
d494381e9d
|
Update verbiage for so-curator-cluster-delete
|
2023-03-28 14:18:49 +00:00 |
|
|
Wes
|
e1bda5acfd
|
Update verbiage for so-curator-cluster-delete-delete
|
2023-03-28 14:18:27 +00:00 |
|
|
Wes
|
138b312705
|
Fix script name
|
2023-03-28 13:52:59 +00:00 |
|
|
Wes
|
82efce0b31
|
Ensure so-curator-cluster-delete is run to manage so-curator-cluster-delete-delete
|
2023-03-28 13:23:23 +00:00 |
|
|
Wes
|
1ab253b8c3
|
Use explicit path to so-elasticsearch-query
|
2023-03-28 13:18:14 +00:00 |
|
|
Wes
|
a1394b9102
|
Use explicit path to so-elasticsearch-query
|
2023-03-28 13:18:00 +00:00 |
|
|
Wes
|
b3b030958c
|
Use explicit path to so-elasticsearch-query
|
2023-03-28 13:17:23 +00:00 |
|
|
Wes
|
adbc9df222
|
Changes for LOG_SIZE_LIMIT
|
2023-03-28 12:54:32 +00:00 |
|
|
Wes
|
f854d92cab
|
Remove the cluster space configuration script reference from the Elasticsearch state
|
2023-03-28 12:27:45 +00:00 |
|
|
Wes
|
22e8e3be28
|
Remove the cluster space configuration script
|
2023-03-28 12:27:12 +00:00 |
|
|
Wes
|
4352825ceb
|
Calculate log size limit every time so-curator-cluster-delete-delete runs
|
2023-03-28 12:25:49 +00:00 |
|
|
Wes
|
e2290d8a8e
|
Remove unncessary Salt logic for Elasticsearch
|
2023-03-28 12:19:36 +00:00 |
|
|
Wes
|
c68235c169
|
Fix Curator script name
|
2023-03-28 02:27:27 +00:00 |
|
|
Wes
|
a38aa903ac
|
Configure cluster space settings
|
2023-03-28 01:36:52 +00:00 |
|
|
Wes
|
fc0b9fa47c
|
Remove Curator closed index deletion scripts
|
2023-03-28 00:57:45 +00:00 |
|
|
Wes
|
32e92d10ad
|
Add new cluster space management scripts
|
2023-03-28 00:55:56 +00:00 |
|
|
Wes
|
7030f35561
|
Update Curator state
|
2023-03-28 00:54:36 +00:00 |
|
|
Wes
|
934b8894e2
|
Update Curator scripts
|
2023-03-28 00:54:04 +00:00 |
|
|
weslambertandGitHub
|
0f66645a89
|
Merge pull request #9990 from Security-Onion-Solutions/fix/elasticsearch_node_attrs_remove
Remove node attrs configuration since node roles will be used
|
2023-03-23 13:48:00 -04:00 |
|
|
weslambertandGitHub
|
0a9a064648
|
Remove node attrs configuration since node roles will be used
|
2023-03-23 13:45:51 -04:00 |
|
|
weslambertandGitHub
|
d6bc20a2b8
|
Merge pull request #9986 from Security-Onion-Solutions/fix/elastic_agent_template_changes
Elastic Agent template changes
|
2023-03-23 13:07:22 -04:00 |
|
|
Wes
|
84360aa9bf
|
Set replicas for Osquery manager indices to 0
|
2023-03-22 21:47:49 +00:00 |
|
|
Wes
|
3fba27a0d4
|
Ensure component template files are in the correct directory
|
2023-03-22 20:45:33 +00:00 |
|
|
Wes
|
28f5dcd43b
|
Add managed generic Elastic Agent log component templates
|
2023-03-22 19:57:46 +00:00 |
|
|
Wes
|
eaaa028999
|
Update Elastic Agent template settings
|
2023-03-22 19:52:13 +00:00 |
|
|
weslambertandGitHub
|
bc2a84c631
|
Merge pull request #9982 from Security-Onion-Solutions/fix/elastic_integration_and_pipeline_strelka
Change data stream name and 'event.dataset' value for Strelka events
|
2023-03-22 11:08:58 -04:00 |
|
|
weslambertandGitHub
|
6d87620c6a
|
Explicitly set 'event.dataset' as 'file'
|
2023-03-22 11:04:18 -04:00 |
|
|
weslambertandGitHub
|
68380d7ecb
|
Change data_stream.dataset from 'file' to 'strelka'
|
2023-03-22 11:02:38 -04:00 |
|
|
weslambertandGitHub
|
4e0390963b
|
Merge pull request #9928 from Security-Onion-Solutions/fix/curator_elastic_agent_filebeat_actions_close
Fix Curator Action Files
|
2023-03-14 10:58:53 -04:00 |
|
|
weslambertandGitHub
|
8eba3426be
|
Remove extra dash for 'logs-elastic_agent-metricbeat-default' key
|
2023-03-14 10:51:50 -04:00 |
|
|
weslambertandGitHub
|
7c39938e14
|
Change 'elastic_agent.filebeat' to 'elastic_agent-filebeat'
|
2023-03-14 10:48:50 -04:00 |
|
|
weslambertandGitHub
|
123275ca35
|
Merge pull request #9926 from Security-Onion-Solutions/fix/curator_additional_elastic_agent_indices
Add more Elastic Agent Curator actions
|
2023-03-14 09:59:47 -04:00 |
|
|
Wes
|
766e6a7974
|
Add 'logs-windows-sysmon_operational-delete' for Windows Sysmon operational indices
|
2023-03-14 13:51:49 +00:00 |
|
|
Wes
|
f0d4c16b2b
|
Add more Elastic Agent index keys for Curator
|
2023-03-14 13:49:13 +00:00 |
|
|
Wes
|
412e5c0402
|
Add more Elastic Agent Curator action files
|
2023-03-14 13:46:08 +00:00 |
|
|
weslambertandGitHub
|
ebc943fcab
|
Merge pull request #9924 from Security-Onion-Solutions/fix/curator_action_file_system_syslog_delete
Fix Elastic Agent system syslog default delete file configuration
|
2023-03-13 17:28:38 -04:00 |
|
|
weslambertandGitHub
|
486de12ca5
|
Delete logs-system-auth-syslog-close.yaml
|
2023-03-13 17:27:52 -04:00 |
|
|
weslambertandGitHub
|
f4112b30c0
|
Fix index reference for system auth default
|
2023-03-13 17:27:06 -04:00 |
|
|
weslambertandGitHub
|
bab40de58d
|
Fix system auth default key value
|
2023-03-13 17:26:05 -04:00 |
|
|
weslambertandGitHub
|
785f100132
|
Fix system auth default key value
|
2023-03-13 17:25:33 -04:00 |
|
|
weslambertandGitHub
|
8ade7b85fc
|
Fix system syslog default key value
|
2023-03-13 17:24:40 -04:00 |
|
|
weslambertandGitHub
|
c2701f1835
|
Fix system syslog default key value
|
2023-03-13 17:24:12 -04:00 |
|
|
weslambertandGitHub
|
d5bb223235
|
Fix system syslog delete file configuration
|
2023-03-13 17:10:52 -04:00 |
|
|
weslambertandGitHub
|
bb711a2a15
|
Merge pull request #9923 from Security-Onion-Solutions/fix/curator_default_elastic_agent_logs
Add Elastic Agent default indices to be managed by Curator
|
2023-03-13 16:59:40 -04:00 |
|
|
Wes
|
efc5832499
|
Add Elastic Agent default log action files
|
2023-03-13 20:54:38 +00:00 |
|
|
Wes
|
8d395dc465
|
Add Elastic Agent default data stream backing indices for management by Curator
|
2023-03-13 20:54:13 +00:00 |
|
|
weslambertandGitHub
|
1774d16d9a
|
Merge pull request #9921 from Security-Onion-Solutions/fix/elasticsearch_template_data_stream_configuration
Move data stream configuration outside of ILM policy definition
|
2023-03-13 09:29:42 -04:00 |
|
|
Wes
|
e105e56fac
|
Move data stream configuration outside of ILM policy definition
|
2023-03-13 13:27:02 +00:00 |
|
|
weslambertandGitHub
|
a844819261
|
Merge pull request #9919 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_elastic_agent_default
Add index lifecycle management policy definitions for default Elastic Agent data streams
|
2023-03-10 17:02:27 -05:00 |
|
|
weslambertandGitHub
|
16d9478196
|
Add index lifecycle management policy definitions for default Elastic Agent data streams
|
2023-03-10 16:54:47 -05:00 |
|
|
weslambertandGitHub
|
7ad34ee8d7
|
Merge pull request #9910 from Security-Onion-Solutions/fix/curator_so_curator_cluster_warm
Remove reference to 'so-curator-cluster-warm' script since it has been removed
|
2023-03-07 16:18:05 -05:00 |
|
|
weslambertandGitHub
|
2d7ce41a70
|
Remove reference to 'so-curator-cluster-warm' script since it has been removed
|
2023-03-07 16:16:55 -05:00 |
|
|
weslambertandGitHub
|
a738c7c36d
|
Merge pull request #9907 from Security-Onion-Solutions/fix/curator_global_delete_action
Add the new Security Onion index format to the global delete action file for Curator
|
2023-03-07 16:03:28 -05:00 |
|
|
weslambertandGitHub
|
e93c052d34
|
Add the new index format to the global delete action file for Curator
|
2023-03-07 15:21:53 -05:00 |
|
|
weslambertandGitHub
|
8c79d7e40d
|
Merge pull request #9905 from Security-Onion-Solutions/fix/curator_new_action_files
Add New Curator Action Files
|
2023-03-07 12:44:25 -05:00 |
|
|
Wes
|
f50639d2d2
|
Fix import and syslog actions
|
2023-03-07 17:41:48 +00:00 |
|
|
Wes
|
26c9813276
|
Add keys for new Curator actions to defaults.yaml
|
2023-03-07 17:29:07 +00:00 |
|
|
Wes
|
88d98af243
|
Add new Curator action files to Curator close and delete scripts
|
2023-03-07 17:21:03 +00:00 |
|
|
Wes
|
d636546871
|
Add new Curator action files
|
2023-03-07 17:15:25 +00:00 |
|
|
weslambertandGitHub
|
f0b7a75ae8
|
Merge pull request #9904 from Security-Onion-Solutions/fix/curator_clean_up_action_files
Clean Up Old Curator Action Files
|
2023-03-07 11:52:28 -05:00 |
|
|
Wes
|
073054b447
|
Remove 'so-curator-cluster-warm' and remove unncessary Curator default values
|
2023-03-07 16:21:55 +00:00 |
|
|
Wes
|
df94e830c5
|
Remove unnecessary Curator action files
|
2023-03-07 16:15:41 +00:00 |
|
|
weslambertandGitHub
|
deda0fa279
|
Merge pull request #9902 from Security-Onion-Solutions/fix/so-status_curator
Add Curator to so-status Output
|
2023-03-07 10:17:14 -05:00 |
|
|
Wes
|
086b3bf528
|
Add Curator to so-status output
|
2023-03-07 15:14:53 +00:00 |
|
|
weslambertandGitHub
|
196a6ce984
|
Merge pull request #9881 from Security-Onion-Solutions/fix/curator_configuration_update_8.0.x
Update Curator configuration to align with requirements for Curator 8.0.x
|
2023-03-02 08:51:14 -05:00 |
|
|
weslambertandGitHub
|
06d1f0f913
|
Update Curator configuration to align with requirements for Curator 8.0.x
|
2023-03-02 08:46:52 -05:00 |
|
|
weslambertandGitHub
|
a5c2c0fb20
|
Merge pull request #9866 from Security-Onion-Solutions/fix/soc_elasticsearch_ilm_annotations_verbiage
Various adjustments to descriptions
|
2023-02-28 16:46:53 -05:00 |
|
|
weslambertandGitHub
|
134caa7f58
|
Various adjustments to descriptions
|
2023-02-28 16:31:16 -05:00 |
|
|
weslambertandGitHub
|
ee311de9c8
|
Merge pull request #9841 from Security-Onion-Solutions/fix/soc_analyzers_analyzerNodeId
Change 'GLOBALS.minion_id' to 'GLOBALS.hostname' for 'analyzerNodeId' value to ensure SOC creates analyzer jobs in the correct directory
|
2023-02-22 16:26:03 -05:00 |
|
|
weslambertandGitHub
|
ecf70847fd
|
Change 'GLOBALS.minion_id' to 'GLOBALS.hostname' for 'analyzerNodeId' value to ensure SOC creates analyzer jobs in the correct directory
|
2023-02-22 16:23:48 -05:00 |
|
|
weslambertandGitHub
|
5e94a2cd74
|
Merge pull request #9790 from Security-Onion-Solutions/fix/kibana_default_data_view
Change default data view from '*:so-*' to 'logs-*'
|
2023-02-15 14:21:55 -05:00 |
|
|
weslambertandGitHub
|
b7ad4e0570
|
Change default data view from 'so-*' to 'logs-*'
|
2023-02-15 14:19:29 -05:00 |
|
|
weslambertandGitHub
|
967440f49f
|
Merge pull request #9789 from Security-Onion-Solutions/fix/kibana_visualization_index-pattern_reference
Replace 'so-*' index-pattern reference with 'logs-*' for Kibana dashboard visualizations
|
2023-02-15 11:33:44 -05:00 |
|
|
Wes
|
790b3c5635
|
Replace 'so-*' index-pattern reference with 'logs-*' for Kibana dashboard visualizations
|
2023-02-15 16:30:56 +00:00 |
|
|
weslambertandGitHub
|
689ba5f341
|
Merge pull request #9778 from Security-Onion-Solutions/fix/filebeat_remove_docker_image
Remove 'so-filebeat' from list of trusted containers
|
2023-02-13 10:00:36 -05:00 |
|
|
weslambertandGitHub
|
40d3269db3
|
Remove 'so-filebeat' from list of trusted containers
|
2023-02-13 09:58:39 -05:00 |
|
|
weslambertandGitHub
|
21ca8a9c50
|
Merge pull request #9770 from Security-Onion-Solutions/fix/elasticsearch_ilm_soc_annotations_settings
Add SOC annotation settings for Elasticsearch's ILM feature
|
2023-02-10 15:51:29 -05:00 |
|
|
weslambertandGitHub
|
acda03ce40
|
Add annotation settings for Elasticsearch's ILM feature, and remove various index keys
|
2023-02-10 14:57:11 -05:00 |
|
|
weslambertandGitHub
|
f2f318982e
|
Merge pull request #9768 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_load_additions
Manage Elasticsearch index lifecycle management policies in Elasticsearch state
|
2023-02-10 14:16:32 -05:00 |
|
|
Wes
|
1255c60317
|
Move policy load script into Elasticsearch state script directory
|
2023-02-10 18:59:45 +00:00 |
|
|
Wes
|
994eabae1b
|
Manage policy loading in Elasticsearch state
|
2023-02-10 18:57:19 +00:00 |
|
|
weslambertandGitHub
|
82119b0247
|
Merge pull request #9765 from Security-Onion-Solutions/fix/elastic_utility_scripts_permissions
Ensure Elastic utility scripts have the correct permissions
|
2023-02-10 10:30:14 -05:00 |
|
|
Wes
|
1d0e09bdf7
|
Ensure Elastic utility scripts have the correct permissions
|
2023-02-10 15:26:46 +00:00 |
|
|
weslambertandGitHub
|
7564a82b52
|
Merge pull request #9764 from Security-Onion-Solutions/fix/elasticsearch_ilm_dynamic_policy_loadiing
ILM Policy Changes
|
2023-02-10 10:17:14 -05:00 |
|
|
Wes
|
c9118699a9
|
Add index management lifecycle policy defintion and reference in index template
|
2023-02-10 15:10:30 +00:00 |
|
|
Wes
|
d17cf89c68
|
Fix Bash shebang
|
2023-02-10 15:01:09 +00:00 |
|
|
Wes
|
7b7461ef01
|
Dynamically load index management lifecycle policies based on pillar values
|
2023-02-10 14:59:29 +00:00 |
|
|
weslambertandGitHub
|
84c5d2fee9
|
Merge pull request #9753 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_load_additional_policies
Add index lifecycle policy templates for other logs
|
2023-02-09 10:59:24 -05:00 |
|
|
Wes
|
ee7f299e6d
|
Fix typo - 'Kratos' to 'Kibana'
|
2023-02-09 15:56:36 +00:00 |
|