CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-14 04:43:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
10,221 Commits 40 Branches 127 Tags
f36c8da1fec00d0fa57e5262926413c1cdc28a4b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub d0818e83c9 Merge pull request #8197 from Security-Onion-Solutions/fix/localfile_analyzer_csv_path 
Ensure file_path uses jinja to derive the value(s) from the pillar
 2022-06-27 10:36:59 -04:00
weslambertandGitHub 568b43d0af Ensure file_path uses jinja to derive the value(s) from the pillar 2022-06-27 10:10:13 -04:00
weslambertandGitHub 10bcc43e85 Merge pull request #8167 from Security-Onion-Solutions/feature/update_es_8_2_3 
Update to Elastic 8.2.3
 2022-06-21 16:11:39 -04:00
weslambertandGitHub af687fb2b5 Update config_saved_objects.ndjson 2022-06-21 16:06:28 -04:00
weslambertandGitHub 776cc30a8e Update to ES 8.2.3 2022-06-21 16:06:01 -04:00
weslambertandGitHub 44595cb333 Merge pull request #8123 from Security-Onion-Solutions/foxtrot 
Merge foxtrot into dev
 2022-06-14 15:44:13 -04:00
weslambertandGitHub 959cec1845 Delete Elastalert indices before upgrading to Elastic 8 2022-06-14 11:40:11 -04:00
weslambertandGitHub 151a42734c Update Elastic version to 8.2.2 2022-06-08 15:07:45 -04:00
weslambertandGitHub 11e3576e0d Update Elastic version to 8.2.2 2022-06-08 15:07:07 -04:00
weslambertandGitHub adeccd0e7f Merge pull request #8097 from Security-Onion-Solutions/dev 
Merge latest dev into foxtrot
 2022-06-08 15:01:09 -04:00
weslambertandGitHub aadf391e5a Temporarily downgrade version for merge 2022-06-08 14:59:01 -04:00
weslambertandGitHub 47f74fa5c6 Temporarily downgrade version for merge 2022-06-08 14:58:05 -04:00
weslambertandGitHub 494ce0756d Merge pull request #8045 from Security-Onion-Solutions/fix/mhr_naming 
Fix naming for Malware Hash Registry analyzer
 2022-05-31 07:52:48 -04:00
Wes Lambert 7f30a364ee Make sure everything is added back after renaming mhr to malwarehashregistry 2022-05-31 11:44:35 +00:00
Wes Lambert c82aa89497 Fix Malware Hash Registry naming so it's more descriptive in SOC 2022-05-31 11:41:48 +00:00
weslambertandGitHub a59ada695b Merge pull request #8031 from Security-Onion-Solutions/fix/screenshots 
Fix/screenshots
 2022-05-27 17:05:51 -04:00
weslambertandGitHub 1a0ac4d253 Merge pull request #8007 from Security-Onion-Solutions/fix/filestream-id 
Add filestream input ID for RITA logs
 2022-05-25 10:11:36 -04:00
weslambertandGitHub 44622350ea Add ID for RITA filestream inputs 2022-05-25 10:09:01 -04:00
weslambertandGitHub 99864f4787 Merge pull request #8001 from Security-Onion-Solutions/feature/analyzer_readme 
Add configuration requirements for various analyzers
 2022-05-25 09:33:07 -04:00
Wes Lambert b93512eb01 Adjust verbiage around pillar configuration 2022-05-24 12:36:32 +00:00
Wes Lambert 92dee14ee8 Add configuration requirements for various analyzers 2022-05-24 12:29:14 +00:00
weslambertandGitHub 3e6dfcfaca Merge pull request #7996 from Security-Onion-Solutions/weslambert-patch-2 
Create Virustotal README
 2022-05-23 11:43:43 -04:00
weslambertandGitHub a6f1bf3aef Create Virustotal README 2022-05-23 11:39:44 -04:00
Wes Lambert 429ccb2dcc Only import yaml module when config is loaded 2022-05-18 02:07:39 +00:00
weslambertandGitHub 94ca3ddbda Merge pull request #7961 from Security-Onion-Solutions/weslambert-patch-1 
Add information for MHR and WhoisLookup, and other minor updates
 2022-05-17 13:33:24 -04:00
weslambertandGitHub d3206a048f Add information for MHR and WhoisLookup, and other minor updates 2022-05-17 12:49:16 -04:00
weslambertandGitHub ff855eb8f7 Merge pull request #7958 from Security-Onion-Solutions/feature/mhr_analyzer 
Add Team Cymru Malware Hash Registry Analyzer
 2022-05-17 12:42:01 -04:00
Wes Lambert 8af1f19ac3 Another no_results change 2022-05-17 16:12:43 +00:00
Wes Lambert e4a7e3cba6 Change 'No results found.' to 'no_results' 2022-05-17 16:11:58 +00:00
weslambertandGitHub 2688083ff1 Merge pull request #7959 from Security-Onion-Solutions/feature/whoislookup-analyzer 
Add Whoislookup RDAP-based analyzer
 2022-05-17 12:09:06 -04:00
Wes Lambert 766e9748c5 Add Whoislookup RDAP-based analyzer 2022-05-17 15:52:12 +00:00
weslambertandGitHub 3761b491c0 Remove whitespace 2022-05-17 10:50:33 -04:00
Wes Lambert e8fc3ccdf4 Add Team Cymru Malware Hash Registry Analyzer 2022-05-17 14:44:53 +00:00
weslambertandGitHub 6c506bbab0 Merge pull request #7935 from Security-Onion-Solutions/fix/pulsedive 
Fix Pulsedive analyzer logic
 2022-05-12 15:20:15 -04:00
Wes Lambert 3dc266cfa9 Add test for when indicator is not found 2022-05-12 19:02:41 +00:00
Wes Lambert a233c08830 Update logic to handle indicators that are not present in database. 2022-05-12 19:02:02 +00:00
weslambertandGitHub 7f797a11f8 Merge pull request #7924 from Security-Onion-Solutions/analyzer-docs 
Update analyzer docs with information about analyzers that require au…
 2022-05-10 09:40:50 -04:00
weslambertandGitHub 34d57c386b Update analyzer docs with information about analyzers that require authentication 2022-05-10 09:32:18 -04:00
weslambertandGitHub 000e813fbb Merge pull request #7921 from Security-Onion-Solutions/fix/analyzer-packages 
Update analyzer packages to those downloaded by Alpine and add additional build script option
 2022-05-09 16:43:31 -04:00
Wes Lambert 555ca2e277 Update analyzer build/testing script to download necessary Python packages 2022-05-09 20:06:39 +00:00
Wes Lambert 32adba6141 Update analyzer packages with those built from native (Alpine) Docker image 2022-05-09 20:04:41 +00:00
weslambertandGitHub 9800f59ed7 Add Urlscan to observable support matrix 2022-05-06 13:11:43 -04:00
Wes Lambert ccac71f649 Fix formatting/whitespace 2022-05-06 17:08:40 +00:00
Wes Lambert 1990ba0cf0 Fix formatting/whitespace 2022-05-06 17:08:33 +00:00
Wes Lambert 8ff5778569 Add Urlscan analyzer and tests 2022-05-06 17:01:06 +00:00
weslambertandGitHub a96c665d04 Change test name for EmailRep 2022-05-03 14:13:25 -04:00
weslambertandGitHub f3a91d9fcd Add EmailRep analyzer to observable support matrix 2022-05-03 10:10:57 -04:00
Wes Lambert 5a9acb3857 Add EmailRep analyzer and tests 2022-05-03 14:06:32 +00:00
Wes Lambert 8b5666b238 Ensure API key is used 2022-05-03 12:48:06 +00:00
weslambertandGitHub efb229cfcb Update to match configuration in analyzer dir 2022-05-02 16:35:21 -04:00
weslambertandGitHub 2fcb2b081d Update allowed complexity to 12 2022-05-02 16:14:43 -04:00
weslambertandGitHub 25f17a5efd Update allowed complexity to 11 2022-04-29 09:42:57 -04:00
weslambertandGitHub 66b4fe9f58 Add additional information around URI and User Agent 2022-04-28 17:14:36 -04:00
Wes Lambert c001708707 Add Pulsedive analyzer and tests 2022-04-28 20:56:03 +00:00
weslambertandGitHub 4edd729596 Add initial supported observable matrix/table 2022-04-27 08:58:34 -04:00
Wes Lambert 76f183b112 Add Greynoise analyzer and tests 2022-04-26 17:25:35 +00:00
Wes Lambert bd63753d80 Update analyzer name/description 2022-04-25 19:27:10 +00:00
Wes Lambert 15fcaa7030 Add localfile analyzer and tests 2022-04-25 19:23:35 +00:00
Wes Lambert fbf6e64e67 Add initial OTX analyzer and tests 2022-04-22 17:13:40 +00:00
weslambertandGitHub 677db7c563 Merge pull request #7841 from Security-Onion-Solutions/weslambert-patch-2 
Update shard count for Zeek in setup
 2022-04-21 17:27:57 -04:00
weslambertandGitHub 1bb216954c Merge pull request #7840 from Security-Onion-Solutions/weslambert-patch-1 
Update shards for Zeek
 2022-04-21 17:26:57 -04:00
weslambertandGitHub c81988ab00 Update shard count for Zeek in setup 2022-04-21 17:26:30 -04:00
weslambertandGitHub 542db5b7f5 Update defaults.yaml 2022-04-21 17:24:24 -04:00
Wes Lambert b2db32a2c7 Add function/test for non-existent VT api_key 2022-04-21 17:33:24 +00:00
Wes Lambert 9287d6adf7 Reduce size of test output for test 2022-04-21 16:56:22 +00:00
Wes Lambert c8e189f35a Add source-packages for JA3er 2022-04-21 16:46:45 +00:00
Wes Lambert 5afcc8de4f Add JA3er analyzer and associated test 2022-04-21 16:42:46 +00:00
weslambertandGitHub d7eed52fae Change -f to -r 2022-04-21 09:46:44 -04:00
Wes Lambert 07cf3469a0 Remove pyyaml for requirements file 2022-04-04 11:40:02 +00:00
Wes Lambert 39101cafd1 Add UrlHaus analyzer and helpers script 2022-04-01 21:11:57 +00:00
weslambertandGitHub 7f7eaf173b Merge pull request #7663 from Security-Onion-Solutions/fix/strelka_fw 
Add strelka_frontend to heavynode, sensor, and standalone role FW por…
 2022-03-28 16:14:25 -04:00
weslambertandGitHub 6004dde54a Add strelka_frontend to heavynode, sensor, and standalone role FW portgroups 2022-03-28 16:05:07 -04:00
weslambertandGitHub fb7160cba5 Merge pull request #7644 from Security-Onion-Solutions/fix/syslog_pr_adjustment 
Update with changes from Abe's PR and other fixes
 2022-03-25 13:59:20 -04:00
weslambertandGitHub e6599cd10e Update with changes from Abe's PR and other fixes 2022-03-25 13:57:44 -04:00
weslambertandGitHub c02d7fab50 Merge pull request #7636 from Security-Onion-Solutions/feature/rita 
Parsing of RITA Logs
 2022-03-24 13:05:22 -04:00
weslambertandGitHub fbc86f43ec Add exclude filter for logs for when there are no results from analysis 2022-03-24 13:03:03 -04:00
weslambertandGitHub 4c93217aac Merge pull request #7635 from Security-Onion-Solutions/fix/process_mappings_keyword 
Additional .keyword shims for process mappings
 2022-03-24 12:53:16 -04:00
Wes Lambert fe1b72655b Additional .keyword shims for process mappings 2022-03-24 16:45:06 +00:00
weslambertandGitHub 5160a55dcf Merge pull request #7629 from Security-Onion-Solutions/fix/roles_load_check_cluster_health 
Check ES cluster health before trying to load roles
 2022-03-23 11:07:24 -04:00
weslambertandGitHub 1f2bca599f Check cluster health before trying to load roles for ES 2022-03-23 11:00:26 -04:00
Wes Lambert 8a56c88773 Adjust log file paths 2022-03-22 17:51:17 +00:00
Wes Lambert 57f01c70ec Remove extra forward slash in log path 2022-03-22 17:45:23 +00:00
Wes Lambert 2487d468ab Add RITA Elasticsearch ingest pipeline config 2022-03-22 17:38:22 +00:00
Wes Lambert f613d8ad86 Add RITA Logstash config 2022-03-22 17:36:18 +00:00
weslambertandGitHub bb9d6673ec Fix casing 2022-03-21 12:38:50 -04:00
weslambertandGitHub 9afa949623 Don't rotate Filebeat log on startup 2022-03-21 12:38:12 -04:00
weslambertandGitHub b2c26807a3 Add xpack.reporting.kibanaServer.hostname to defaults file 2022-03-21 09:30:25 -04:00
Wes Lambert faeaa948c8 Remove extra Salt logic and clean up output format of resultant script 2022-03-19 04:31:48 +00:00
Wes Lambert 1a6ef0cc6b Re-enable FB module load 2022-03-19 03:55:40 +00:00
Wes Lambert a18b38de4d Update so-filebeat-module-setup to use new load style to avoid having to explicitly enabled filesets 2022-03-19 03:54:41 +00:00
Wes Lambert 2e7d314650 Remove Cyberark module 2022-03-19 03:43:55 +00:00
Wes Lambert c97847f0e2 Remove Threat Intel Recored Future fileset 2022-03-19 03:43:34 +00:00
Wes Lambert 59a2ac38f5 Disable FB module load for now 2022-03-18 22:12:09 +00:00
Wes Lambert 543bf9a7a7 Update Kibana version to 8 2022-03-18 22:07:21 +00:00
Wes Lambert d111c08fb3 Update Curator commands with new Filebeat module variables 2022-03-18 21:45:33 +00:00
weslambertandGitHub a9ea99daa8 Switch from so_elastic user to so_kibana user for Elastic 8 2022-03-18 15:09:50 -04:00
weslambertandGitHub cb0d4acd57 Remove X-Pack ML entry for Elastic 8 2022-03-18 14:46:28 -04:00
weslambertandGitHub e0374be4aa Update version from 7.16.2 to 8.1.0 for Kibana config 2022-03-18 11:57:33 -04:00
weslambertandGitHub 6f294cc0c2 Change Kibana user role from superuser to kibana_system for Elastic 8 2022-03-18 11:54:08 -04:00
weslambertandGitHub 5ec5b9a2ee Remove older module config files 2022-03-18 10:14:13 -04:00