  weslambertandGitHub
|
e93c052d34
|
Add the new index format to the global delete action file for Curator
|
2023-03-07 15:21:53 -05:00 |
|
|
weslambertandGitHub
|
8c79d7e40d
|
Merge pull request #9905 from Security-Onion-Solutions/fix/curator_new_action_files
Add New Curator Action Files
|
2023-03-07 12:44:25 -05:00 |
|
|
Wes
|
f50639d2d2
|
Fix import and syslog actions
|
2023-03-07 17:41:48 +00:00 |
|
|
Wes
|
26c9813276
|
Add keys for new Curator actions to defaults.yaml
|
2023-03-07 17:29:07 +00:00 |
|
|
Wes
|
88d98af243
|
Add new Curator action files to Curator close and delete scripts
|
2023-03-07 17:21:03 +00:00 |
|
|
Wes
|
d636546871
|
Add new Curator action files
|
2023-03-07 17:15:25 +00:00 |
|
|
weslambertandGitHub
|
f0b7a75ae8
|
Merge pull request #9904 from Security-Onion-Solutions/fix/curator_clean_up_action_files
Clean Up Old Curator Action Files
|
2023-03-07 11:52:28 -05:00 |
|
|
Wes
|
073054b447
|
Remove 'so-curator-cluster-warm' and remove unncessary Curator default values
|
2023-03-07 16:21:55 +00:00 |
|
|
Wes
|
df94e830c5
|
Remove unnecessary Curator action files
|
2023-03-07 16:15:41 +00:00 |
|
|
weslambertandGitHub
|
deda0fa279
|
Merge pull request #9902 from Security-Onion-Solutions/fix/so-status_curator
Add Curator to so-status Output
|
2023-03-07 10:17:14 -05:00 |
|
|
Wes
|
086b3bf528
|
Add Curator to so-status output
|
2023-03-07 15:14:53 +00:00 |
|
|
weslambertandGitHub
|
196a6ce984
|
Merge pull request #9881 from Security-Onion-Solutions/fix/curator_configuration_update_8.0.x
Update Curator configuration to align with requirements for Curator 8.0.x
|
2023-03-02 08:51:14 -05:00 |
|
|
weslambertandGitHub
|
06d1f0f913
|
Update Curator configuration to align with requirements for Curator 8.0.x
|
2023-03-02 08:46:52 -05:00 |
|
|
weslambertandGitHub
|
a5c2c0fb20
|
Merge pull request #9866 from Security-Onion-Solutions/fix/soc_elasticsearch_ilm_annotations_verbiage
Various adjustments to descriptions
|
2023-02-28 16:46:53 -05:00 |
|
|
weslambertandGitHub
|
134caa7f58
|
Various adjustments to descriptions
|
2023-02-28 16:31:16 -05:00 |
|
|
weslambertandGitHub
|
ee311de9c8
|
Merge pull request #9841 from Security-Onion-Solutions/fix/soc_analyzers_analyzerNodeId
Change 'GLOBALS.minion_id' to 'GLOBALS.hostname' for 'analyzerNodeId' value to ensure SOC creates analyzer jobs in the correct directory
|
2023-02-22 16:26:03 -05:00 |
|
|
weslambertandGitHub
|
ecf70847fd
|
Change 'GLOBALS.minion_id' to 'GLOBALS.hostname' for 'analyzerNodeId' value to ensure SOC creates analyzer jobs in the correct directory
|
2023-02-22 16:23:48 -05:00 |
|
|
weslambertandGitHub
|
5e94a2cd74
|
Merge pull request #9790 from Security-Onion-Solutions/fix/kibana_default_data_view
Change default data view from '*:so-*' to 'logs-*'
|
2023-02-15 14:21:55 -05:00 |
|
|
weslambertandGitHub
|
b7ad4e0570
|
Change default data view from 'so-*' to 'logs-*'
|
2023-02-15 14:19:29 -05:00 |
|
|
weslambertandGitHub
|
967440f49f
|
Merge pull request #9789 from Security-Onion-Solutions/fix/kibana_visualization_index-pattern_reference
Replace 'so-*' index-pattern reference with 'logs-*' for Kibana dashboard visualizations
|
2023-02-15 11:33:44 -05:00 |
|
|
Wes
|
790b3c5635
|
Replace 'so-*' index-pattern reference with 'logs-*' for Kibana dashboard visualizations
|
2023-02-15 16:30:56 +00:00 |
|
|
weslambertandGitHub
|
689ba5f341
|
Merge pull request #9778 from Security-Onion-Solutions/fix/filebeat_remove_docker_image
Remove 'so-filebeat' from list of trusted containers
|
2023-02-13 10:00:36 -05:00 |
|
|
weslambertandGitHub
|
40d3269db3
|
Remove 'so-filebeat' from list of trusted containers
|
2023-02-13 09:58:39 -05:00 |
|
|
weslambertandGitHub
|
21ca8a9c50
|
Merge pull request #9770 from Security-Onion-Solutions/fix/elasticsearch_ilm_soc_annotations_settings
Add SOC annotation settings for Elasticsearch's ILM feature
|
2023-02-10 15:51:29 -05:00 |
|
|
weslambertandGitHub
|
acda03ce40
|
Add annotation settings for Elasticsearch's ILM feature, and remove various index keys
|
2023-02-10 14:57:11 -05:00 |
|
|
weslambertandGitHub
|
f2f318982e
|
Merge pull request #9768 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_load_additions
Manage Elasticsearch index lifecycle management policies in Elasticsearch state
|
2023-02-10 14:16:32 -05:00 |
|
|
Wes
|
1255c60317
|
Move policy load script into Elasticsearch state script directory
|
2023-02-10 18:59:45 +00:00 |
|
|
Wes
|
994eabae1b
|
Manage policy loading in Elasticsearch state
|
2023-02-10 18:57:19 +00:00 |
|
|
weslambertandGitHub
|
82119b0247
|
Merge pull request #9765 from Security-Onion-Solutions/fix/elastic_utility_scripts_permissions
Ensure Elastic utility scripts have the correct permissions
|
2023-02-10 10:30:14 -05:00 |
|
|
Wes
|
1d0e09bdf7
|
Ensure Elastic utility scripts have the correct permissions
|
2023-02-10 15:26:46 +00:00 |
|
|
weslambertandGitHub
|
7564a82b52
|
Merge pull request #9764 from Security-Onion-Solutions/fix/elasticsearch_ilm_dynamic_policy_loadiing
ILM Policy Changes
|
2023-02-10 10:17:14 -05:00 |
|
|
Wes
|
c9118699a9
|
Add index management lifecycle policy defintion and reference in index template
|
2023-02-10 15:10:30 +00:00 |
|
|
Wes
|
d17cf89c68
|
Fix Bash shebang
|
2023-02-10 15:01:09 +00:00 |
|
|
Wes
|
7b7461ef01
|
Dynamically load index management lifecycle policies based on pillar values
|
2023-02-10 14:59:29 +00:00 |
|
|
weslambertandGitHub
|
84c5d2fee9
|
Merge pull request #9753 from Security-Onion-Solutions/fix/elasticsearch_ilm_policy_load_additional_policies
Add index lifecycle policy templates for other logs
|
2023-02-09 10:59:24 -05:00 |
|
|
Wes
|
ee7f299e6d
|
Fix typo - 'Kratos' to 'Kibana'
|
2023-02-09 15:56:36 +00:00 |
|
|
Wes
|
bb6fc8da19
|
Add policy templates for other logs
|
2023-02-09 15:51:58 +00:00 |
|
|
weslambertandGitHub
|
364799dcc5
|
Merge pull request #9751 from Security-Onion-Solutions/fix/elastic_fleet_output_temp_change
Temporarily use Elasticsearch output for standalone installations
|
2023-02-09 09:37:14 -05:00 |
|
|
weslambertandGitHub
|
b744dc0641
|
Add so-eval to list of modes using the Elasticsearch output for Elastic Agent and Fleet
|
2023-02-09 09:35:29 -05:00 |
|
|
weslambertandGitHub
|
613793ad9b
|
Temporarily use Elasticsearch output for Standalone installations
|
2023-02-09 09:32:04 -05:00 |
|
|
weslambertandGitHub
|
32823ef640
|
Merge pull request #9746 from Security-Onion-Solutions/feature/elasticsearch_ilm_utility_scripts
Add Elasticsearch ILM utility scripts
|
2023-02-08 16:43:44 -05:00 |
|
|
Wes
|
b319b50fa1
|
Add initial ILM status script
|
2023-02-08 21:39:33 +00:00 |
|
|
Wes
|
1d6c03feb1
|
Rename initial ILM lifecycle status explanation script
|
2023-02-08 21:34:39 +00:00 |
|
|
Wes
|
91d24d36f9
|
Add initial ILM lifecycle status explanation script
|
2023-02-08 21:34:15 +00:00 |
|
|
Wes
|
3e31bda285
|
Fix typo in Elasticsearch portion of script names
|
2023-02-08 21:32:17 +00:00 |
|
|
Wes
|
1de3871ee9
|
Add initial ILM service restart script
|
2023-02-08 21:30:25 +00:00 |
|
|
Wes
|
03849b0659
|
Add initial ILM service start script
|
2023-02-08 21:29:38 +00:00 |
|
|
Wes
|
b38f4ca766
|
Add initial ILM service stop script
|
2023-02-08 21:29:16 +00:00 |
|
|
Wes
|
8027055086
|
Add initial ILM policy delete script
|
2023-02-08 21:09:42 +00:00 |
|
|
Wes
|
d6d01f8542
|
Add initial ILM policy view script
|
2023-02-08 21:01:02 +00:00 |
|
|
Wes
|
713e9ee215
|
Create initial template for ILM policy load script
|
2023-02-08 20:10:41 +00:00 |
|
|
weslambertandGitHub
|
bee5a1e9e8
|
Merge pull request #9711 from Security-Onion-Solutions/fix/so_import_pcap_suricata_metadata_disable_zeek
Only run Zeek if it is defined as the metadata engine
|
2023-02-02 13:27:35 -05:00 |
|
|
Wes
|
bc082dff99
|
Only run Zeek if it is defined as 'mdengine'
|
2023-02-02 16:22:42 +00:00 |
|
|
weslambertandGitHub
|
395cbf330a
|
Merge pull request #9706 from Security-Onion-Solutions/fix/suricata_metadata
Add Suricata metadata configuration
|
2023-02-02 09:54:49 -05:00 |
|
|
Wes
|
5fba3c5872
|
Add Suricata metadata configuration
|
2023-02-02 14:48:01 +00:00 |
|
|
weslambertandGitHub
|
eb7b6e78b9
|
Merge pull request #9702 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_disable
Disable loading of Kibana and Logstash integration policies
|
2023-02-01 16:02:56 -05:00 |
|
|
weslambertandGitHub
|
d242050627
|
Disable loading of Kibana and Logstash logs for now since there are issues with the packages from the registry
|
2023-02-01 15:59:35 -05:00 |
|
|
weslambertandGitHub
|
3dfa7959b3
|
Merge pull request #9698 from Security-Onion-Solutions/fix/strelka_yara_exclusion_2_4
Add 'configured_vulns_ext_vars.yar' to exclusion list
|
2023-02-01 14:38:38 -05:00 |
|
|
weslambertandGitHub
|
2101ca60e9
|
Add 'configured_vulns_ext_vars.yar' to exclusion list
|
2023-02-01 14:25:46 -05:00 |
|
|
weslambertandGitHub
|
056bcd0121
|
Merge pull request #9683 from Security-Onion-Solutions/fix/kibana_osquery_live_query_link_remove
Remove OSQuery live query link
|
2023-01-31 13:38:07 -05:00 |
|
|
weslambertandGitHub
|
98bea0322e
|
Merge pull request #9688 from Security-Onion-Solutions/fix/elastic_agent_elasticsearch_output_typo_fix
Fix Elastic Agent Elasticsearch output typo
|
2023-01-31 12:57:38 -05:00 |
|
|
weslambertandGitHub
|
74eed31eec
|
Change Elasticsearch output name from 'so-manager_elasticsearch2' to 'so-manager_elasticsearch'
|
2023-01-31 12:55:03 -05:00 |
|
|
weslambertandGitHub
|
cbf2bd1373
|
Remove OSQuery live query link
|
2023-01-31 10:59:17 -05:00 |
|
|
weslambertandGitHub
|
bde828cd4f
|
Merge pull request #9676 from Security-Onion-Solutions/fix/so-import-evtx_updates
Updates to so-import-evtx
|
2023-01-31 08:17:02 -05:00 |
|
|
weslambertandGitHub
|
0436f885b8
|
Set values for '@timestamp' and 'event.ingested'
|
2023-01-31 08:04:49 -05:00 |
|
|
Wes
|
5472f53c9f
|
Remove bind mount and reference the correctly named entrypoint script
|
2023-01-30 21:24:30 +00:00 |
|
|
Wes
|
0156784687
|
Add EVTX integration policy for 'so-import-evtx'
|
2023-01-30 21:22:37 +00:00 |
|
|
Wes
|
cc100e50cd
|
Update so-import-evtx to convert EVTX to a JSON file instead of streaming to Elasticsearch
|
2023-01-30 21:09:58 +00:00 |
|
|
weslambertandGitHub
|
b1eb16d3a2
|
Merge pull request #9670 from Security-Onion-Solutions/fix/elastic_agent_integration_policies_zeek_exclude_files
Remove 'prospector.scanner' prefix from 'exclude_files' configuration
|
2023-01-27 16:53:02 -05:00 |
|
|
weslambertandGitHub
|
8240e5b20d
|
Remove 'prospector.scanner' prefix from 'exclude_files' configuration
|
2023-01-27 16:46:43 -05:00 |
|
|
weslambertandGitHub
|
68fac4488e
|
Fix syntax for Zeek integration policies
|
2023-01-27 15:27:15 -05:00 |
|
|
weslambertandGitHub
|
fa9e62a816
|
Merge pull request #9665 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_import_suricata_event.category
Change event.category from 'file' to 'network' in Import Suricata integration policy
|
2023-01-27 12:03:34 -05:00 |
|
|
weslambertandGitHub
|
e47f64bd04
|
Change event.category from 'file' to 'network'
|
2023-01-27 12:00:30 -05:00 |
|
|
weslambertandGitHub
|
6d2f379ba5
|
Merge pull request #9664 from Security-Onion-Solutions/fix/elastic_agent_integration_policies_zeek_exclude_files
Update Zeek file exclusions and add a minor output formatting change
|
2023-01-27 11:58:19 -05:00 |
|
|
weslambertandGitHub
|
f49627cec1
|
Update Zeek file exclusions and add a minor output formatting change
|
2023-01-27 11:47:14 -05:00 |
|
|
weslambertandGitHub
|
5ab3d1e8f1
|
Merge pull request #9663 from Security-Onion-Solutions/fix/elastic_agent_integration_policy_zeek_import_ics_tag
Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field
|
2023-01-27 11:34:28 -05:00 |
|
|
weslambertandGitHub
|
6b251a2596
|
Change 'pipeline' to 'import.file' so that ICS tag conditional is applied to the correct field
|
2023-01-27 11:30:06 -05:00 |
|
|
weslambertandGitHub
|
5468aa82b0
|
Merge pull request #9662 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_event.dataset_rename
Change event.dataset value for zeek.files and zeek.tunnels ingest pipelines
|
2023-01-27 11:19:45 -05:00 |
|
|
weslambertandGitHub
|
2772b03dca
|
Change event.dataset value from 'tunnels' to 'tunnel'
|
2023-01-27 11:03:49 -05:00 |
|
|
weslambertandGitHub
|
716ec7f936
|
Change event.dataset value from 'files' to 'file'
|
2023-01-27 11:02:44 -05:00 |
|
|
weslambertandGitHub
|
27b1f1bd07
|
Merge pull request #9654 from Security-Onion-Solutions/fix/logstash_cleanup
FIX: Logstash Pipeline Cleanup
|
2023-01-26 13:19:50 -05:00 |
|
|
Wes
|
e4271043c6
|
Remove unnecessary Logstash pipelines
|
2023-01-26 18:05:14 +00:00 |
|
|
Wes
|
b3123f7895
|
Remove unnecessary Logstash pipelines from the pillar
|
2023-01-26 17:57:07 +00:00 |
|
|
weslambertandGitHub
|
a8d2631d75
|
Merge pull request #9650 from Security-Onion-Solutions/fix/elastic_agent_add_import_mode
Elastic Agent - Import Mode
|
2023-01-26 11:33:20 -05:00 |
|
|
Wes
|
b381c5424e
|
Remove extra whitespace after 'so-elastic-agent-builder' line in 'so-image-common'
|
2023-01-26 16:13:23 +00:00 |
|
|
Wes
|
f1db1bc273
|
Ensure Kratos events are sent to a data stream instead of an index
|
2023-01-26 16:12:06 +00:00 |
|
|
Wes
|
7d68ef0e8b
|
Add Elastic Agent and Fleet to firewall configuration for Import Mode
|
2023-01-26 16:07:31 +00:00 |
|
|
Wes
|
43ffcb1d63
|
Allow setup to set up Elastic Fleet for Import Mode
|
2023-01-26 16:05:16 +00:00 |
|
|
Wes
|
8051fc70eb
|
Temporarily disable the loading of the RITA package policy
|
2023-01-26 16:03:59 +00:00 |
|
|
Wes
|
a9a119f1ab
|
Add Elasticsearch output to 'so-elastic-fleet-setup' for Import Mode
|
2023-01-26 16:02:27 +00:00 |
|
|
Wes
|
6a803dfe35
|
Add Elastic Fleet to top file configuration for Import Mode
|
2023-01-26 16:01:03 +00:00 |
|
|
Wes
|
1fb6cf7bfe
|
Add Elastic Fleet to allowed states for Import Mode
|
2023-01-26 15:59:49 +00:00 |
|
|
weslambertandGitHub
|
211b87e7ae
|
Merge pull request #9644 from Security-Onion-Solutions/revert-9640-fix/elastic_agent_import_mode
Revert "Elastic Agent and Fleet - Import Mode"
|
2023-01-25 17:23:27 -05:00 |
|
|
weslambertandGitHub
|
6ee66a34bc
|
Revert "Elastic Agent and Fleet - Import Mode"
|
2023-01-25 17:12:03 -05:00 |
|
|
weslambertandGitHub
|
6785e0ec9e
|
Merge pull request #9640 from Security-Onion-Solutions/fix/elastic_agent_import_mode
Elastic Agent and Fleet - Import Mode
|
2023-01-25 17:01:33 -05:00 |
|
|
weslambertandGitHub
|
c73cd78f08
|
Merge pull request #9643 from Security-Onion-Solutions/2.4/dev
Merge Dev
|
2023-01-25 16:59:47 -05:00 |
|
|
Wes
|
5c58cda872
|
Move certificate configuration outside of conditional logic
|
2023-01-25 19:29:50 +00:00 |
|
|
Wes
|
c3717dae67
|
Add Elastic Fleet firewall configuration for Import Mode
|
2023-01-25 18:27:00 +00:00 |
|
|
Wes
|
86a925e1c7
|
Download Elastic Agent images for Import Mode
|
2023-01-25 16:09:12 +00:00 |
|
|
Wes
|
838beabae5
|
Add missing single quote for Elastic Agent Elasticsearch output
|
2023-01-25 15:58:06 +00:00 |
|