CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-26 02:43:11 +01:00
Code Issues Packages Projects Releases Wiki Activity
8,432 Commits 19 Branches 120 Tags
e864bc54044362007b45f88562a06d385eaeb852
Commit Graph

4952 Commits

Author SHA1 Message Date
m0duspwnens
b877aa44bc update dict 2021-09-17 14:10:45 -04:00
m0duspwnens
d0c87cd317 allow for pillar override of defaults 2021-09-17 12:11:12 -04:00
m0duspwnens
0d074dafd4 add missing defaults 2021-09-17 09:52:50 -04:00
m0duspwnens
5b77dc109f Merge remote-tracking branch 'remotes/origin/dev' into issue/1257 2021-09-16 16:54:23 -04:00
m0duspwnens
3ce48acadd change cluster_settings to config 2021-09-16 16:44:31 -04:00
m0duspwnens
5526a2bc3a reduce defaults.yaml 2021-09-16 15:32:08 -04:00
weslambert
18d81352c6 Merge pull request #5537 from Security-Onion-Solutions/delta 
Add improved ignore functionality for YARA rules used by Strelka and add default ignored rules that break compilation
 2021-09-16 10:38:49 -04:00
m0duspwnens
889d235c45 no box type more manager in true cluster 2021-09-16 09:15:24 -04:00
m0duspwnens
782b01e76f seed_hosts to list 2021-09-15 17:07:52 -04:00
m0duspwnens
3bf9685df8 fix seed_hosts append 2021-09-15 17:00:16 -04:00
m0duspwnens
4cf91f6c86 fix dict update 2021-09-15 15:51:00 -04:00
m0duspwnens
a43b37f234 fix dict update 2021-09-15 15:49:18 -04:00
m0duspwnens
e0dc62b6e9 fix dict update 2021-09-15 15:43:47 -04:00
m0duspwnens
c213834316 update the dict 2021-09-15 15:24:40 -04:00
Josh Brower
c06668c68e Merge pull request #5527 from Security-Onion-Solutions/feature/so-import-evtx 
Feature/so import evtx
 2021-09-15 14:17:15 -04:00
Josh Brower
a75238bc3f so-import-evtx - fix ingest formatting 2021-09-15 14:13:16 -04:00
Josh Brower
ac417867ed so-import-evtx - final fixes 2021-09-15 14:06:08 -04:00
m0duspwnens
1614b70853 update cluster name if true cluster 2021-09-15 13:45:43 -04:00
m0duspwnens
1a03853a7c fix extend 2021-09-15 13:38:29 -04:00
Mike Reeves
aff571faf2 soup changes 2.3.80 2021-09-15 13:32:52 -04:00
m0duspwnens
e0faa4c75b Merge branch 'issue/1257' of https://github.com/Security-Onion-Solutions/securityonion into issue/1257 2021-09-15 13:09:35 -04:00
m0duspwnens
e3e2e1d851 logic for truecluster to map file 2021-09-15 13:09:04 -04:00
weslambert
39e5ded58d Refactor ignore list and only ignore for signature-base for now 2021-09-15 11:32:29 -04:00
weslambert
4d41d3aee1 Ignore these rules by default because they are causing issues with YARA compilation with Strelka 2021-09-15 10:29:11 -04:00
weslambert
5c8067728e Remove unnecessary logic 2021-09-15 10:22:17 -04:00
Josh Brower
e0a289182f Fix Fleet Link Logic 2021-09-15 09:28:23 -04:00
m0duspwnens
551dba955c set roles empty list 2021-09-15 09:20:33 -04:00
Mike Reeves
2ffb723bbd Rename so-common-template.json to so-common-template.json.jinja 2021-09-14 13:58:45 -04:00
Josh Brower
74b0b365bd Fleet SA - SOC Link Fix 2021-09-14 13:23:07 -04:00
Josh Brower
0b0d508585 so-import-evtx - tweaks 2021-09-14 12:01:14 -04:00
m0duspwnens
0534a2dda3 Merge remote-tracking branch 'remotes/origin/dev' into issue/1257 2021-09-13 15:04:50 -04:00
m0duspwnens
f8ab0ac8a9 config changes 2021-09-13 15:04:39 -04:00
m0duspwnens
0ae09cc630 config changes 2021-09-13 09:49:56 -04:00
Mike Reeves
332c4dda22 Merge pull request #5469 from Security-Onion-Solutions/fix/idstools-rule-clear 
Allow so-rule-update to accept any number of args
 2021-09-10 14:41:55 -04:00
William Wernert
679faddd52 Update so-rule-update to pass all args to docker exec 
Instead of passing $1, build a string from all args and add that to the command string for the docker exec statement
 2021-09-10 13:44:37 -04:00
William Wernert
0b42b19763 Update so-rule-update to source so-common 2021-09-10 13:41:58 -04:00
William Wernert
943bd3e902 Merge pull request #5468 from Security-Onion-Solutions/fix/idstools-rule-clear 
Add `--force` flag to idstools-rulecat under so-rule-update
 2021-09-10 13:17:16 -04:00
Mike Reeves
4af6a901a1 Merge pull request #5461 from Security-Onion-Solutions/truclusterrator 
Add new hunt fields
 2021-09-10 13:17:01 -04:00
William Wernert
9c310de459 Add --force flag to idstools-rulecat under so-rule-update 
This forces idstools to pull from the url each time, which prevents it from clearing all.rules if idstools-rulecat is run twice within 15 minutes by any method (either restarting the container or running so-rule-update)
 2021-09-10 13:15:09 -04:00
Mike Reeves
4f6a3269cb Add more detail to syscollector 2021-09-10 09:59:47 -04:00
Mike Reeves
c83f119cc0 Update so-raid-status 2021-09-09 10:59:35 -04:00
Mike Reeves
5d235e932c Fix Raid Status for cloud 2021-09-09 10:46:28 -04:00
m0duspwnens
93f2cd75a4 add the jinja template 2021-09-09 10:19:46 -04:00
m0duspwnens
f06ab8b77d testing defaults.yaml 2021-09-09 08:55:36 -04:00
weslambert
b8600be0f1 Incude server.publicBaseUrl 2021-09-08 12:12:09 -04:00
Jason Ertel
19a02baa7c Merge pull request #5425 from Security-Onion-Solutions/kilo 
Auth enhancements
 2021-09-07 13:10:36 -04:00
Jason Ertel
3c59579f99 Add maintenance privilege for analysts to refresh indices 2021-09-07 13:03:30 -04:00
Jason Ertel
72cff7ec7a Merge branch 'dev' into kilo 2021-09-07 10:49:08 -04:00
Mike Reeves
e3900606dc Enable index sorting by default but allow it to be disabled 2021-09-04 10:42:18 -04:00
Rob Waight
b7591093cf Add index sorting to so-common-template.json 
Add index sorting to so-common-template.json
 2021-09-04 09:45:03 -04:00