6494 Commits

Author	SHA1	Message	Date
Wes	eae05e83e6	Use new list verification function for 'file_path'	2022-12-13 16:28:50 +00:00
Wes	117d230b9d	Add new test for list value verification function	2022-12-13 16:28:22 +00:00
Wes	5422c5b3e2	Add new function to verify list value	2022-12-13 16:27:58 +00:00
Doug Burks	3dd4e31f49	Upgrade to Elastic 8.5.3 in config_saved_objects.ndjson	2022-12-13 10:07:52 -05:00
Doug Burks	2004184b72	Upgrade to Elastic 8.5.3 in so-kibana-config-load	2022-12-13 10:06:23 -05:00
Doug Burks	e1d200e6ce	Remove duplicate TDS dashboard from defaults.yaml	2022-12-11 14:39:08 -05:00
Doug Burks	72f71ba695	Fix TDS dashboard in defaults.yaml	2022-12-11 14:36:27 -05:00
Doug Burks	be75062612	Update so-import-pcap	2022-12-10 15:17:02 -05:00
Doug Burks	da8e098655	update so-import-evtx	2022-12-10 15:16:32 -05:00
Doug Burks	cb16bd36fb	fix descriptions in defaults.yaml	2022-12-10 14:31:59 -05:00
Doug Burks	cf7d8076e9	remove old Wazuh Hunt queries in defaults.yaml	2022-12-10 14:21:58 -05:00
Doug Burks	cd664b2d39	remove old Modbus dashboard from defaults.yaml	2022-12-10 14:16:39 -05:00
Doug Burks	7f07a94a98	remove old DNP3 and Wazuh dashboards from defaults.yaml	2022-12-10 14:14:24 -05:00
Doug Burks	de2427cabe	add -p option to mkdir in so-elastic-fleet-setup	2022-12-10 08:20:38 -05:00
Doug Burks	187ca4c453	Update soc defaults.yaml to include dnp3_control and dnp3_objects eventfields	2022-12-10 07:33:09 -05:00
Doug Burks	c4ea39d1ba	Merge pull request #9349 from Security-Onion-Solutions/fix/2.4-ics ... 2.4: Fix multiple ICS issues and keep import indices open as in 2.3	2022-12-09 15:09:49 -05:00
doug	565ca4e94f	keep so-import indices open as in 2.3	2022-12-09 08:49:25 -05:00
weslambert	9477f29432	Remove double quotes to fix issue with file path sourcing from 'localfile.py'	2022-12-08 17:06:43 -05:00
doug	5c00ab7b7f	correct order in defaults.yaml	2022-12-08 16:50:34 -05:00
doug	07a4919cd3	remove old opcua files	2022-12-08 16:43:11 -05:00
doug	7cfb688890	update defaults.yaml	2022-12-08 16:32:04 -05:00
Jason Ertel	0bbc68edae	Switch back to older style redirect due to incompatibility with Ub 18	2022-12-07 14:08:11 -05:00
Jason Ertel	ef3def156d	Switch back to older style redirect due to incompatibility with Ubuntu 18	2022-12-07 14:03:31 -05:00
Jason Ertel	9f72cfa1fc	roll back to grep instead of pgrep due to cron issue	2022-12-07 12:08:31 -05:00
Jason Ertel	fde33de030	Use original style due to pgrep conflict with cron	2022-12-07 11:51:49 -05:00
Jason Ertel	e849783a86	Reduce cron noise; ensure filecheck is restarted if modified	2022-12-07 08:36:56 -05:00
weslambert	def0c85349	Disable Filebeat input for 'ecat_arp_info' Zeek logs	2022-12-07 08:00:21 -05:00
weslambert	7ce0924382	Ignore additional rules causing compilation errors	2022-12-06 13:59:21 -05:00
weslambert	73304e049c	Merge pull request #9304 from Security-Onion-Solutions/feature/ics_scada_additions ... Port STUN, TDS, WireGuard, and ICS/SCADA Changes from 2.3 to 2.4	2022-12-06 13:14:47 -05:00
weslambert	a626acced0	Add new ICS/SCADA event fields to the dashboards section of the configuration and remove extra space in key names.	2022-12-06 13:11:55 -05:00
Jason Ertel	88410bc8f8	Merge branch '2.4/dev' into config	2022-12-06 12:38:43 -05:00
Jason Ertel	168cd00e1b	Handle suricata extracted with filecheck	2022-12-06 12:34:02 -05:00
Wes	1b5c1fecd4	Revert SOC default 'alerts' event fields and specify additional event fields for ICS/SCADA events	2022-12-06 17:28:30 +00:00
Wes	b048eec3c0	Add STUN, TDS, WireGuard, and ICS/SCADA dashboard queries	2022-12-06 17:17:49 +00:00
Wes	f44eee134a	Add default queries and ICS/SCADA queries	2022-12-06 16:52:20 +00:00
Wes	c741fe6b4d	Ensure ICS/SCADA plugins/scripts are enabled	2022-12-06 16:23:26 +00:00
Wes	be5775e4a0	Ensure Filebeat defaults file is updated with ICS/SCADA log references	2022-12-06 16:15:09 +00:00
Wes	499b5d95f2	Add 'ics' tag for 'bsap'-prefixed events/logs	2022-12-06 16:01:57 +00:00
Wes	14af1d36cb	Ensure ICS/SCADA pipelines are present	2022-12-06 15:58:47 +00:00
Jason Ertel	fd13c7ccc0	Additional metadata for soc	2022-12-05 09:03:22 -05:00
Mike Reeves	f083b3867b	Update init.sls	2022-12-02 09:40:35 -05:00
Mike Reeves	f83545c556	Update filecheck	2022-11-30 11:02:56 -05:00
Wes	7f324bc47e	Remove extra space used during testing	2022-11-22 20:52:08 +00:00
Wes	a6bc5b108f	Add missing OPCUA 'activate_session' pipelines	2022-11-22 20:51:44 +00:00
weslambert	356904f751	Fix spelling of 'wireguard.responses' field name	2022-11-22 13:03:04 -05:00
weslambert	6b77843e52	Fix format/speliing for 'enip.status_code' field name	2022-11-22 12:07:55 -05:00
weslambert	13faf63770	Fix spelling for 'stun.class' field name	2022-11-22 12:07:15 -05:00
Wes	a38e312df4	Add COTP and TDS ingest pipelines	2022-11-22 13:36:27 +00:00
weslambert	d2bc1a5523	Fix syntax error for 'ics' tag logic	2022-11-22 07:24:54 -05:00
weslambert	fe180d5657	Fix indentation	2022-11-21 17:02:17 -05:00