CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-04-25 14:07:49 +02:00
Code Issues Packages Projects Releases Wiki Activity
14,922 Commits 40 Branches 125 Tags
eca2a4a9c8227d5065955b03ed299eaa3b7cfdbc
Commit Graph

9355 Commits

Author SHA1 Message Date
m0duspwnens c4994a208b restart salt minion if a manager and signing policies change 2024-04-15 11:37:21 -04:00
m0duspwnens bb983d4ba2 just broker as default process 2024-04-12 16:16:03 -04:00
Josh Brower 5e8b16569f Merge pull request #12793 from Security-Onion-Solutions/2.4/detectiondefaults 
Add docs for ruleset change
 2024-04-12 13:54:06 -04:00
m0duspwnens c014508519 need /opt/so/conf/ca/cacerts on receiver for kafka to run 2024-04-12 13:50:25 -04:00
DefensiveDepth f5e42e73af Add docs for ruleset change 2024-04-12 13:30:20 -04:00
reyesj2 911ee579a9 Typo 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-12 12:16:20 -04:00
reyesj2 a6ff92b099 Note to remove so-kafka-clusterid. Update soup and setup to generate needed kafka pillar values 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-12 12:11:18 -04:00
reyesj2 af29ae1968 Merge kaffytaffy 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-12 11:43:46 -04:00
reyesj2 fbd3cff90d Make global.pipeline use GLOBALMERGED value 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-12 11:21:19 -04:00
m0duspwnens a54a72c269 move kafka_cluster_id to kafka:cluster_id 2024-04-12 11:19:20 -04:00
Josh Brower 5b81a73e58 Merge pull request #12791 from Security-Onion-Solutions/2.4/detectiondefaults 
Fix fingerprint paths
 2024-04-12 09:01:38 -04:00
DefensiveDepth 49ccd86c39 Fix fingerprint paths 2024-04-12 08:35:44 -04:00
m0duspwnens f514e5e9bb add kafka to receiver 2024-04-11 16:23:05 -04:00
reyesj2 3955587372 Use global.pipeline for redis / kafka states 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 16:20:09 -04:00
reyesj2 6b28dc72e8 Update annotation for global.pipeline 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 15:38:33 -04:00
reyesj2 ca7253a589 Run kafka-clusterid script when pillar values are missing 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 15:38:03 -04:00
reyesj2 af53dcda1b Remove references to kafkanode 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 15:32:00 -04:00
reyesj2 55cf90f477 merge 2.4/dev 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 14:44:59 -04:00
reyesj2 c269fb90ac Added a Kismet Wifi devices dashboard for an overview of kismet data 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 14:41:54 -04:00
Mike Reeves 1250a728ac Merge pull request #12769 from Security-Onion-Solutions/TOoSmOotH-patch-3 
Update analyst.json
 2024-04-11 14:30:17 -04:00
reyesj2 68e016090b Fix network.wireless.ssid not parsing 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 13:21:54 -04:00
reyesj2 fd689a4607 Fix typo in ingest pipeline 
Test to fix duplicate events in SOC, by removing conflicting field event.created

Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-11 11:18:04 -04:00
DefensiveDepth 1c5f02ade2 Update annotations 2024-04-11 09:21:08 -04:00
DefensiveDepth ed97aa4e78 Enable Detections Adv by default 2024-04-11 08:21:20 -04:00
reyesj2 7124f04138 Update ingest pipelines to match updated mappings 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-10 16:13:06 -04:00
reyesj2 2ab9cbba61 Update wording for Kismet poll interval annotation 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-10 16:12:22 -04:00
reyesj2 4097e1d81a Create mappings for Kismet integration 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-10 16:10:27 -04:00
m0duspwnens d3bd56b131 disable logstash and redis if kafka enabled 2024-04-10 14:13:27 -04:00
m0duspwnens e9e61ea2d8 Merge remote-tracking branch 'origin/2.4/dev' into kaffytaffy 2024-04-10 13:14:13 -04:00
m0duspwnens 86b984001d annotations and enable/disable from ui 2024-04-10 10:39:06 -04:00
Mike Reeves 2206553e03 Update analyst.json 2024-04-10 09:49:21 -04:00
m0duspwnens fa7f8104c8 Merge remote-tracking branch 'origin/reyesj2/kafka' into kaffytaffy 2024-04-09 11:13:02 -04:00
m0duspwnens bd5fe43285 jinja config files 2024-04-09 11:07:53 -04:00
m0duspwnens d38051e806 fix client and server properties formatting 2024-04-09 10:36:37 -04:00
m0duspwnens daa5342986 items not keys in for loop 2024-04-09 10:22:05 -04:00
m0duspwnens c48436ccbf fix dict update 2024-04-09 10:19:17 -04:00
m0duspwnens 7aa00faa6c fix var 2024-04-09 09:31:54 -04:00
m0duspwnens 6217a7b9a9 add defaults and jijafy kafka config 2024-04-09 09:27:21 -04:00
reyesj2 d67ebabc95 Remove logstash output to kafka pipeline. Add additional topics for searchnodes to ingest and add partition/offset info to event 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-08 16:38:03 -04:00
DefensiveDepth 376efab40c Ship Defender logs 2024-04-08 14:01:38 -04:00
reyesj2 65274e89d7 Add client_id to logstash pipeline. To identify which searchnode is pulling messages 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-05 15:38:00 -04:00
reyesj2 721e04f793 initial logstash input from kafka over ssl 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-05 13:37:14 -04:00
Corey Ogburn 00cea6fb80 Detection Author as a Keyword instead of Text 
With Quick Actions added to Detections, as many fields should be usable as possible.
 2024-04-05 11:22:47 -06:00
reyesj2 433309ef1a Generate kafka cluster id if it doesn't exist 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-05 09:35:12 -04:00
Mike Reeves 21f86be8ee Update so-log-check 2024-04-05 08:03:42 -04:00
Josh Brower 8e38c3763e Merge pull request #12756 from Security-Onion-Solutions/2.4/detections-defaults 
Use list not string
 2024-04-04 17:00:38 -04:00
DefensiveDepth ca807bd6bd Use list not string 2024-04-04 16:58:39 -04:00
reyesj2 735cfb4c29 Autogenerate kafka topics when a message it sent to non-existing topic 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-04 16:45:58 -04:00
reyesj2 6202090836 Merge remote-tracking branch 'origin/kaffytaffy' into reyesj2/kafka 2024-04-04 16:27:06 -04:00
reyesj2 436cbc1f06 Add kafka signing_policy for client/server auth. Add kafka-client cert on manager so manager can interact with kafka using its own cert 
Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>
 2024-04-04 16:21:29 -04:00