  weslambertandGitHub
|
12c3c351d8
|
Merge pull request #1498 from Security-Onion-Solutions/feature/filterlog
Feature/filterlog
|
2020-10-09 20:05:21 -04:00 |
|
|
Wes Lambert
|
28a1f7f88a
|
Remove pfsense tag
|
2020-10-10 00:03:51 +00:00 |
|
|
Wes Lambert
|
b55ffa44f8
|
Fix module,dataset rename
|
2020-10-10 00:01:37 +00:00 |
|
|
Wes Lambert
|
69a04dedd3
|
Filterlog config changes
|
2020-10-09 23:56:52 +00:00 |
|
|
weslambertandGitHub
|
993aabedf2
|
Merge pull request #1491 from Security-Onion-Solutions/fix/so-elasticsearch-pipeline-stats-dots
Ensure pipelines with dots in names can be referenced
|
2020-10-08 15:41:44 -04:00 |
|
|
weslambertandGitHub
|
06706d29f2
|
Ensure pipelines with dots in names can be referenced
|
2020-10-08 15:41:17 -04:00 |
|
|
weslambertandGitHub
|
f41987024f
|
Merge pull request #1490 from Security-Onion-Solutions/feature/so-elastic-pipeline-stats
Add pipeline stats script
|
2020-10-08 15:12:55 -04:00 |
|
|
Wes Lambert
|
1efb39a71b
|
Add pipeline stats script
|
2020-10-08 19:11:41 +00:00 |
|
|
weslambertandGitHub
|
0f5f781024
|
Merge pull request #1484 from Security-Onion-Solutions/fix/strelka_rule_null_safe_2
More fixes for rule field
|
2020-10-08 09:37:44 -04:00 |
|
|
Wes Lambert
|
a6d3dcf398
|
More fixes for rule field
|
2020-10-08 13:36:47 +00:00 |
|
|
weslambertandGitHub
|
5e4bbcd4ca
|
Merge pull request #1483 from Security-Onion-Solutions/fix/strelka_rule_null_safe
Add null safe check for rule
|
2020-10-08 09:15:29 -04:00 |
|
|
Wes Lambert
|
a2e2f23a8d
|
Add null safe check for rule
|
2020-10-08 13:14:39 +00:00 |
|
|
weslambertandGitHub
|
3ec9206b17
|
Merge pull request #1482 from Security-Onion-Solutions/fix/network_transport_kibana_viz
Fix network transport Kibana viz
|
2020-10-08 08:18:12 -04:00 |
|
|
Wes Lambert
|
adf0ef87c9
|
Fix network transport Kibana viz
|
2020-10-08 12:17:15 +00:00 |
|
|
weslambertandGitHub
|
7767d3897b
|
Merge pull request #1481 from Security-Onion-Solutions/fix/network_transport_lower
Lowercase network.transport
|
2020-10-08 08:00:22 -04:00 |
|
|
weslambertandGitHub
|
5ada85942b
|
Lowercase network.transport
|
2020-10-08 07:59:57 -04:00 |
|
|
weslambertandGitHub
|
7befff3baa
|
Merge pull request #1474 from Security-Onion-Solutions/fix/common_nids
Don't use regex for determining rule type
|
2020-10-07 12:16:55 -04:00 |
|
|
Wes Lambert
|
7543144afe
|
Don't use regex for determining rule type
|
2020-10-07 16:15:43 +00:00 |
|
|
weslambertandGitHub
|
7787f81bdd
|
Merge pull request #1473 from Security-Onion-Solutions/fix/logstash_output_wazuh
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:49:40 -04:00 |
|
|
weslambertandGitHub
|
8e829b47ae
|
Remove dataset name since pipeline no longer in use
|
2020-10-07 11:48:56 -04:00 |
|
|
weslambertandGitHub
|
8015676e01
|
Merge pull request #1472 from Security-Onion-Solutions/fix/rename-signature_info
Change rule.signature_info to rule.reference and ensure common.nids e…
|
2020-10-07 11:21:18 -04:00 |
|
|
Wes Lambert
|
015a441e79
|
Change rule.signature_info to rule.reference and ensure common.nids exists
|
2020-10-07 15:20:26 +00:00 |
|
|
weslambertandGitHub
|
a1866e5229
|
Merge pull request #1471 from Security-Onion-Solutions/fix/ingest-updates
Fix/ingest updates
|
2020-10-07 11:15:55 -04:00 |
|
|
Wes Lambert
|
f0a1457ffd
|
Update common.nids
|
2020-10-07 15:14:08 +00:00 |
|
|
Wes Lambert
|
8c07c098f6
|
Pipeline cleanup
|
2020-10-06 20:14:15 +00:00 |
|
|
Wes Lambert
|
350cc41740
|
Let zeek.common handle common fields for zeek.tunnels
|
2020-10-06 20:12:23 +00:00 |
|
|
weslambertandGitHub
|
a16419b997
|
Merge pull request #1466 from Security-Onion-Solutions/fix/so-elasticsearch-templates-load
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 13:19:54 -04:00 |
|
|
Wes Lambert
|
a6a69c57d1
|
Rename so-elasticsearch-templates to so-elasticsearch-templates-load
|
2020-10-06 17:18:42 +00:00 |
|
|
weslambertandGitHub
|
6cdff854f3
|
Merge pull request #1465 from Security-Onion-Solutions/feature/so-elasticsearch-templates-list
Add so-elasticsearch-templates-list
|
2020-10-06 13:16:11 -04:00 |
|
|
Wes Lambert
|
787f1d8732
|
Add so-elasticsearch-templates-list
|
2020-10-06 17:15:27 +00:00 |
|
|
weslambertandGitHub
|
1a2921c2bc
|
Merge pull request #1463 from Security-Onion-Solutions/feature/so-elasticsearch-pipelines-list
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 13:04:24 -04:00 |
|
|
Wes Lambert
|
4a5d50cf80
|
Add so-elasticsearch-pipelines-list and fix common script perms
|
2020-10-06 17:01:58 +00:00 |
|
|
weslambertandGitHub
|
706c81daca
|
Merge pull request #1459 from Security-Onion-Solutions/feature/strelka_yara_alert
Add Strelka YARA matches as alerts
|
2020-10-06 08:23:16 -04:00 |
|
|
Wes Lambert
|
019bec992d
|
Add Strelka YARA matches as alerts
|
2020-10-06 12:19:44 +00:00 |
|
|
weslambertandGitHub
|
9f4cb42c4f
|
Merge pull request #1452 from Security-Onion-Solutions/fix/kibana_case_create
Change alert to case
|
2020-10-05 11:46:14 -04:00 |
|
|
Wes Lambert
|
575da0f9d3
|
Change alert to case
|
2020-10-05 15:45:10 +00:00 |
|
|
weslambertandGitHub
|
f4fcc052ca
|
Merge pull request #1451 from Security-Onion-Solutions/fix/wazuh_rule_cat
Put back rule.category for Wazuh alerts
|
2020-10-05 11:35:20 -04:00 |
|
|
weslambertandGitHub
|
bc31e19e37
|
Put back rule.category for Wazuh alerts
|
2020-10-05 11:34:29 -04:00 |
|
|
weslambertandGitHub
|
6e2319f6da
|
Merge pull request #1449 from Security-Onion-Solutions/fix/wazuh_logging
Adjust Wazuh logging so we don't log alerts to a separate file and so…
|
2020-10-05 10:04:01 -04:00 |
|
|
weslambertandGitHub
|
968dce0aee
|
Adjust Wazuh logging so we don't log alerts to a separate file and so we don't write a separate log file for non-JSON for archives
|
2020-10-05 10:03:40 -04:00 |
|
|
weslambertandGitHub
|
6b292ea62b
|
Merge pull request #1448 from Security-Onion-Solutions/fix/so_elastic_clear
Fix/so elastic clear
|
2020-10-05 09:40:04 -04:00 |
|
|
Wes Lambert
|
da8957b4f4
|
Use Elasticsearch pillar vs manager IP for so-elastic-clear
|
2020-10-05 13:37:06 +00:00 |
|
|
Wes Lambert
|
1970d95d5f
|
Make Filebeat registry persistent to avoid re-reading old data
|
2020-10-05 13:30:04 +00:00 |
|
|
weslambertandGitHub
|
771d091d6e
|
Merge pull request #1446 from Security-Onion-Solutions/feature/wazuh_severity
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 08:52:20 -04:00 |
|
|
Wes Lambert
|
77d31cb289
|
Add event.severity and event.severity_label config for Wazuh alerts
|
2020-10-05 12:50:29 +00:00 |
|
|
weslambertandGitHub
|
203e84d2cf
|
Update comma verbiage for HOME_NET in whiptail menu
|
2020-10-05 08:08:22 -04:00 |
|
|
weslambertandGitHub
|
2d2f4de337
|
Merge pull request #1437 from Security-Onion-Solutions/fix/kib_scripted_thehive
Update scripted field for TheHive case
|
2020-10-01 16:54:02 -04:00 |
|
|
Wes Lambert
|
8a81a5148b
|
Update scripted field for TheHive case
|
2020-10-01 20:52:57 +00:00 |
|
|
weslambertandGitHub
|
98bef8fb9d
|
Merge pull request #1436 from Security-Onion-Solutions/fix/kibana_soc_thehive_case
Add SOC url for api integration
|
2020-10-01 16:47:11 -04:00 |
|
|
Wes Lambert
|
eced18c3cc
|
Add SOC url for api integration
|
2020-10-01 20:29:28 +00:00 |
|
|
weslambertandGitHub
|
6818de9e64
|
Merge pull request #1431 from Security-Onion-Solutions/fix/elastlert_rules
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:36:11 -04:00 |
|
|
weslambertandGitHub
|
887937a75d
|
Remove rule sync, since we don't have any rules to sync
|
2020-09-30 18:35:35 -04:00 |
|
|
weslambertandGitHub
|
5b16a65422
|
Merge pull request #1429 from Security-Onion-Solutions/fix/zeek_server_ip
Fix issue with null Zeek server IP
|
2020-09-30 13:54:50 -04:00 |
|
|
Wes Lambert
|
02d2e5e2c6
|
Fix isue with null Zeek server IP
|
2020-09-30 17:53:30 +00:00 |
|
|
weslambertandGitHub
|
defe832121
|
Merge pull request #1427 from Security-Onion-Solutions/fix/wazuh_filebeat
Fix Filebeat config for Wazuh
|
2020-09-30 10:59:01 -04:00 |
|
|
Wes Lambert
|
d8f70397f7
|
Fix Filebeat config for Wazuh
|
2020-09-30 14:57:56 +00:00 |
|
|
weslambertandGitHub
|
dac2ad5dbf
|
Merge pull request #1425 from Security-Onion-Solutions/feature/soctopus_pillar
Add initial implementation of SOCtopus pillar
|
2020-09-30 10:25:26 -04:00 |
|
|
Wes Lambert
|
c62acf5e4e
|
Add initial implmentation of SOCtopus pillar
|
2020-09-30 14:24:15 +00:00 |
|
|
weslambertandGitHub
|
401764437f
|
Merge pull request #1421 from Security-Onion-Solutions/fix/ip_type
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 14:21:25 -04:00 |
|
|
Wes Lambert
|
36019727b3
|
Ensure IPs are typed as IP and ports as integer
|
2020-09-29 18:20:15 +00:00 |
|
|
weslambertandGitHub
|
3d6c956e02
|
Merge pull request #1409 from Security-Onion-Solutions/feature/wazuh_wel
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 15:07:15 -04:00 |
|
|
Wes Lambert
|
869767d9d9
|
Add initial parsing for Wazuh WEL/Sysmon
|
2020-09-28 19:04:21 +00:00 |
|
|
weslambertandGitHub
|
6bfef773f2
|
Merge pull request #1392 from Security-Onion-Solutions/bugfix/config_dev_nullify
dev nullify so-config-backup cron job
|
2020-09-24 21:00:18 -04:00 |
|
|
weslambertandGitHub
|
b3f9ee3b34
|
dev nullify so-config-backup cron job
|
2020-09-24 20:59:42 -04:00 |
|
|
weslambertandGitHub
|
a09002edae
|
Merge pull request #1384 from Security-Onion-Solutions/bugfix/config_backup
Add back missing # sign
|
2020-09-23 21:34:52 -04:00 |
|
|
weslambertandGitHub
|
5b93c40ce4
|
Add back missing # sign
|
2020-09-23 21:34:10 -04:00 |
|
|
weslambertandGitHub
|
4f228c1b7c
|
Merge pull request #1379 from Security-Onion-Solutions/feature/config_backup
Feature/config backup
|
2020-09-23 09:58:05 -04:00 |
|
|
Wes Lambert
|
71734ddc0a
|
Add cron job to common state for daily config backup
|
2020-09-23 13:55:32 +00:00 |
|
|
Wes Lambert
|
57732b360e
|
Add config backup script
|
2020-09-23 13:47:14 +00:00 |
|
|
Wes Lambert
|
4d42d04cc3
|
Fix backup pillar definition
|
2020-09-23 13:45:42 +00:00 |
|
|
Wes Lambert
|
d02c440934
|
Add backup params to global.sls
|
2020-09-22 21:05:57 +00:00 |
|
|
weslambertandGitHub
|
74e4adda11
|
Merge pull request #1357 from Security-Onion-Solutions/feature/dashboard_updates_2
Add All Logs for Connections dashboard
|
2020-09-16 11:56:38 -04:00 |
|
|
Wes Lambert
|
44ef935d65
|
Add All Logs for Connections dashboard
|
2020-09-16 15:55:28 +00:00 |
|
|
weslambertandGitHub
|
6325b30a21
|
Merge pull request #1356 from Security-Onion-Solutions/feature/dashboard_updates
Kibana dashboard updates
|
2020-09-16 11:19:27 -04:00 |
|
|
Wes Lambert
|
bd8d2fc271
|
Kibana dashboard updates
|
2020-09-16 15:17:26 +00:00 |
|
|
weslambertandGitHub
|
6806bd2461
|
Merge pull request #1348 from Security-Onion-Solutions/bugfix/es_template_load
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:15:56 -04:00 |
|
|
weslambertandGitHub
|
fbf037f460
|
Ensure templates are loaded for heavy nodes
|
2020-09-15 17:14:06 -04:00 |
|
|
weslambertandGitHub
|
b6b52671e2
|
Merge pull request #1294 from Security-Onion-Solutions/fix/wazuh_agent_name
Fix typo
|
2020-09-05 08:17:09 -04:00 |
|
|
Wes Lambert
|
f9884606df
|
Fix typo
|
2020-09-05 12:15:55 +00:00 |
|
|
weslambertandGitHub
|
b10dd40376
|
Merge pull request #1287 from Security-Onion-Solutions/fix/suri_home_net
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:51 -04:00 |
|
|
weslambertandGitHub
|
8db8dcb71a
|
Change HOME_NET and EXTERNAL_NET defaults
|
2020-09-03 08:15:14 -04:00 |
|
|
weslambertandGitHub
|
870e042c4c
|
Merge pull request #1285 from Security-Onion-Solutions/fix/so_stop_start_restart
Require at least one arg for start/stop/restart scripts
|
2020-09-02 14:58:19 -04:00 |
|
|
Wes Lambert
|
770aaf415c
|
Require at least on arg for start/stop/restart scripts
|
2020-09-02 18:55:59 +00:00 |
|
|
weslambertandGitHub
|
d35cca7fc5
|
Merge pull request #1278 from Security-Onion-Solutions/fix/elastalert_extra_hosts
Add manager to hosts file
|
2020-09-02 07:44:49 -04:00 |
|
|
weslambertandGitHub
|
5d920885e0
|
Add manager to hosts file
|
2020-09-02 07:43:55 -04:00 |
|
|
weslambertandGitHub
|
011958a2f3
|
Merge pull request #1274 from Security-Onion-Solutions/fix/zeek_syslog
Ensure Zeek syslog log is enabled for Import node
|
2020-08-31 13:08:44 -04:00 |
|
|
Wes Lambert
|
ae3fe9e892
|
Ensure Zeek syslog log is enabled for Import node
|
2020-08-31 17:07:16 +00:00 |
|
|
weslambertandGitHub
|
96f25914db
|
Merge pull request #1273 from Security-Onion-Solutions/fix/zeek_syslog_default
Fix/zeek syslog default
|
2020-08-31 12:32:52 -04:00 |
|
|
Wes Lambert
|
5ed5e6603d
|
Fix space
|
2020-08-31 16:32:12 +00:00 |
|
|
Wes Lambert
|
26ffc44fd1
|
Only enable syslog log by default in Eval mode
|
2020-08-31 16:30:32 +00:00 |
|
|
weslambertandGitHub
|
6350c83e05
|
Merge pull request #1272 from Security-Onion-Solutions/feature/wazuh_mgmt_wrappers
Add Wazuh mgmt wrappers for manage_agents and upgrade
|
2020-08-31 10:55:25 -04:00 |
|
|
Wes Lambert
|
46e7e121e3
|
Add Wazuh mgmt wrappers for manage_agents and upgrade
|
2020-08-31 14:54:24 +00:00 |
|
|
weslambertandGitHub
|
5db70cbd59
|
Merge pull request #1271 from Security-Onion-Solutions/fix/remove_minio
Remove minio for now
|
2020-08-31 10:29:30 -04:00 |
|
|
Wes Lambert
|
6d14f2af96
|
Remove minio for now
|
2020-08-31 14:07:47 +00:00 |
|
|
weslambertandGitHub
|
42bd75a1cc
|
Merge pull request #1270 from Security-Onion-Solutions/fix/elastalert_startup
Wait for Elasticsearch indices to be queryable before starting Elasta…
|
2020-08-31 09:56:18 -04:00 |
|
|
Wes Lambert
|
9abbda8e04
|
Wait for Elasticsearch indices to be queryable before starting Elastalert container
|
2020-08-31 13:54:49 +00:00 |
|
|
weslambertandGitHub
|
509985ed07
|
Merge pull request #1254 from Security-Onion-Solutions/fix/sensor_clean
Cron updates
|
2020-08-26 11:03:03 -04:00 |
|
|
weslambertandGitHub
|
000c2abb33
|
Update timing for so-yara-update
|
2020-08-26 11:02:33 -04:00 |
|
|
weslambertandGitHub
|
ce49e050bc
|
Update timing for sensor clean cron
|
2020-08-25 12:14:43 -04:00 |
|
|
weslambertandGitHub
|
61cc5b9712
|
Merge pull request #1246 from Security-Onion-Solutions/fix/sensor_clean_log
Fix/sensor clean log
|
2020-08-25 11:36:10 -04:00 |
|