CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-07-18 14:53:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
9,770 Commits 45 Branches 127 Tags
f9563b2dc4589bcbcbbc12e44ebd1b10e455133d
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
weslambertandGitHub 262e68cb75 Merge pull request #7469 from Security-Onion-Solutions/fix/kibana_config_load_template 
Add .template extension to ensure we are loading the template and not the resultant file
 2022-03-08 21:12:29 -05:00
weslambertandGitHub c83b63d0d8 Add .template extension to load template file 2022-03-08 20:53:16 -05:00
weslambertandGitHub 8d9ddf5f1b Add .template extension to load template 2022-03-08 20:52:13 -05:00
weslambertandGitHub 8115da358f Add .template extension to load template file 2022-03-08 20:51:50 -05:00
weslambertandGitHub 5f3c29b7f8 Merge pull request #7466 from Security-Onion-Solutions/fix/process_name_keyword 
Add process.name.keyword
 2022-03-08 12:47:31 -05:00
weslambertandGitHub 65f998d6f7 Remove process.name.keyword for future-proofing 2022-03-08 12:44:51 -05:00
weslambertandGitHub 406267a892 Add process.name.keyword 2022-03-08 12:42:34 -05:00
weslambertandGitHub d9c3160fbf Merge pull request #7465 from Security-Onion-Solutions/fix/kibana_saved_objects_load 
Kibana dashboard/saved objects loading improvements
 2022-03-08 12:22:55 -05:00
Wes Lambert d392cb258c Switch Kibana state to kibana.so_savedobjects_defaults in top file 2022-03-08 16:59:48 +00:00
Wes Lambert 86e228b200 Add .template extension for future-proofing config files 2022-03-08 16:58:37 +00:00
Wes Lambert a6fd1023b4 Fix criteria for successful execution 2022-03-08 16:57:26 +00:00
Wes Lambert 3f31f7fd41 Add .template extension to fix script behavior and not modify watched file 2022-03-08 16:43:43 +00:00
Wes Lambert 28554164cd Remove drop file when securitySolution saved objects change 2022-03-08 14:39:23 +00:00
Wes Lambert 14dddd8649 Remove drop file when config saved objects change 2022-03-08 14:37:15 +00:00
Wes Lambert c0f49f6fb0 Remove drop file when dashbaord saved objects change 2022-03-08 14:35:04 +00:00
Wes Lambert d10d4acf9f Modify Kibana config load script to drop file if successfully executed 2022-03-08 14:33:15 +00:00
weslambertandGitHub e2bda255cc Merge pull request #7447 from Security-Onion-Solutions/fix/es_templates_soup 
Remove old Elasticsearch index templates during SOUP
 2022-03-07 15:10:44 -05:00
Wes Lambert fa9be58b23 Specify index templates 2022-03-07 20:04:23 +00:00
Wes Lambert 647b316a96 Remove old ES index templates 
Signed-off-by: Wes Lambert <wlambertts@gmail.com>
 2022-03-07 20:02:45 +00:00
weslambertandGitHub eac120f4c2 Merge pull request #7444 from Security-Onion-Solutions/fix/dtc_client_override 
Add DTC client mappings
 2022-03-07 13:38:19 -05:00
Wes Lambert c549b20221 Add DTC client mappings 2022-03-07 18:36:26 +00:00
weslambertandGitHub 5600b55f05 Merge pull request #7427 from Security-Onion-Solutions/fix/syslog_kibana_viz 
Replace syslog facility and severity with label fields in Kibana syslog dashboard
 2022-03-07 08:14:35 -05:00
Wes Lambert 33ba45472f Replace syslog facility and severity with label fields 2022-03-04 21:40:41 +00:00
weslambertandGitHub ee4035f022 Merge pull request #7426 from Security-Onion-Solutions/fix/syslog_zeek 
Change to label fields for syslog facility and severity
 2022-03-04 16:31:45 -05:00
weslambertandGitHub f71ccadb8a Change to label fields for Zeek syslog 2022-03-04 16:29:55 -05:00
weslambertandGitHub fc3273fa49 Change to label fields to comply with what's defined in Filebeat template 2022-03-04 16:29:01 -05:00
weslambertandGitHub 3148fa0e06 Merge pull request #7422 from Security-Onion-Solutions/fix/syslog_dot_keyword 
.keyword additions and increase max_clause_count
 2022-03-04 15:32:29 -05:00
weslambertandGitHub 254cf53c2f Increase clause count to 3500 2022-03-04 10:36:37 -05:00
Wes Lambert ffae22beef Add DTC syslog mappings for .keyword and add refs to defaults.yml 2022-03-04 13:04:11 +00:00
weslambertandGitHub 93c2f82345 Merge pull request #7413 from Security-Onion-Solutions/fix/add_keyword_subfield 
Add .keyword subfield for more mappings
 2022-03-03 10:42:38 -05:00
Wes Lambert 1f71816ad7 Add keyword subfield for DTC winlog mappings 2022-03-03 14:54:30 +00:00
Wes Lambert 1c086e36da Add missing comma for file mappings 2022-03-03 13:49:54 +00:00
Wes Lambert aa8d24b6cd Add DTC destination, source, and winlog mapping references to templates in defaults file 2022-03-03 13:42:20 +00:00
Wes Lambert 85979cbce8 Add file, process, and winlog mapping changes 2022-03-03 13:37:27 +00:00
Wes Lambert 8f97f09c9c Additional .keyword changes for host.hostname client.address, and event.action 2022-03-02 21:54:46 +00:00
Wes Lambert 3ee46e4c29 Add .keyword for destination/source geo.country_name 2022-03-02 21:50:03 +00:00
weslambertandGitHub a21060306c Merge pull request #7404 from Security-Onion-Solutions/fix/field_limit_adjustment 
Adjust field limit for now due to component template errors
 2022-03-02 11:41:35 -05:00
Wes Lambert c5b16fdf3b Adjust field limit for now 2022-03-02 16:33:39 +00:00
weslambertandGitHub b80e82aaf6 Merge pull request #7396 from Security-Onion-Solutions/fix/dot_security 
Revert back to usage of .security field
 2022-03-02 10:42:29 -05:00
Wes Lambert ab9b81ea39 Change match_only_text to text for mac in host mappings 2022-03-02 15:01:05 +00:00
Wes Lambert ed620b93b7 Add custom analyzer definition to all SO/DTC mappings 2022-03-02 14:43:19 +00:00
Wes Lambert 27c8eaa630 Update all other mappings for .security where applicable 2022-03-02 14:39:23 +00:00
Wes Lambert e925d435ff Update event, file, and host mappings to include .security 2022-03-02 14:33:52 +00:00
Wes Lambert 496b161253 Update ECS mappings to include .security 2022-03-02 14:27:36 +00:00
Wes Lambert aae2fd1fbb Update DNS mappings to include .security 2022-03-02 14:27:15 +00:00
Wes Lambert 0b45cf7ae1 Update base mappings to include .security 2022-03-02 14:25:57 +00:00
Wes Lambert d89af5f04f Update agent mappings to include .security 2022-03-02 14:25:14 +00:00
Wes Lambert 2d2ec45029 Modify base ECS mappings to include .security where possible, as well as custom analyzer definition 2022-03-02 14:19:36 +00:00
weslambertandGitHub 93386f4620 Merge pull request #7389 from Security-Onion-Solutions/fix/revert_text 
Fix/revert text
 2022-03-02 09:17:46 -05:00
Wes Lambert 5489b8559d Revert "Switch from .security to match_only_text" 
This reverts commit f7862af934.
 2022-03-01 18:44:00 +00:00
Wes Lambert 2a9caccc7c Revert "Add additional .text subfield mappings" 
This reverts commit 61dadc6249.
 2022-03-01 18:43:24 +00:00
Wes Lambert a290602a70 Revert syslog pipeline updates from Abe' PR for now 2022-03-01 15:31:07 +00:00
weslambertandGitHub 4201ee45c6 Merge pull request #7369 from Security-Onion-Solutions/fix/ingest_timestamp 
Rename ingest timestamp to event.ingested
 2022-03-01 10:11:16 -05:00
Wes Lambert 038dc49098 Temporarily increase field limit before trimming efforts 2022-03-01 15:06:28 +00:00
Wes Lambert dc07adca63 Rename ingest.timestamp to event.ingested 2022-03-01 15:05:08 +00:00
weslambertandGitHub a1c0ae4aab Merge pull request #7356 from Security-Onion-Solutions/fix/es_config_load_order 
Run template load first to prevent issues with pipeline changes that …
 2022-02-28 14:50:22 -05:00
weslambertandGitHub 414b9dcd59 Run template load first to prevent issues with pipeline changes that generate new indices 2022-02-28 12:33:18 -05:00
weslambertandGitHub a9caef9596 Merge pull request #7338 from Security-Onion-Solutions/fix/endgame_template 
Revert Endgame index name changes
 2022-02-28 08:13:09 -05:00
Wes Lambert bd1b21a5b6 Revert Endgame index name changes 2022-02-26 02:53:57 +00:00
weslambertandGitHub 56cb8d62ab Merge pull request #7337 from Security-Onion-Solutions/fix/pb_overrides 
Fix formatting for PB overrides
 2022-02-25 20:48:38 -05:00
weslambertandGitHub e942d81433 Ensure correct formatting for source override 2022-02-25 19:14:58 -05:00
weslambertandGitHub a511fd33e9 Ensure correct formatting for destination override 2022-02-25 19:14:21 -05:00
weslambertandGitHub c95f48e49a Merge pull request #7330 from Security-Onion-Solutions/fix/pb-override 
Override destination/source mappings with .keyword for Playbook
 2022-02-25 13:07:31 -05:00
Wes Lambert a8bdff89ae Move files into SO component template directory 2022-02-25 18:00:16 +00:00
Wes Lambert 08097fe9ec Add Playbook override mappings 2022-02-25 17:58:51 +00:00
weslambertandGitHub a6ab09501e Merge pull request #7326 from Security-Onion-Solutions/fix/additional_text_subfield_mappings 
Add additional .text subfield mappings
 2022-02-25 11:29:26 -05:00
Wes Lambert 61dadc6249 Add additional .text subfield mappings 2022-02-25 16:27:37 +00:00
weslambertandGitHub 22b01dab1e Merge pull request #7317 from Security-Onion-Solutions/fix/add_text_subfield_to_dtc_mappings 
Add .text subfield mappings for DTC where fields are defined
 2022-02-24 14:47:11 -05:00
Wes Lambert 0f8a39002f Add .text subfield mappings for DTC where fields are defined 2022-02-24 19:39:52 +00:00
weslambertandGitHub 5e29c71381 Merge pull request #7315 from Security-Onion-Solutions/fix/split_zeek_dns 
Split Zeek DNS records into a separate index
 2022-02-24 13:21:52 -05:00
weslambertandGitHub 23fb62c0d6 Split Zeek DNS records into a separate index 2022-02-24 12:52:25 -05:00
weslambertandGitHub 313487a887 Merge pull request #7313 from Security-Onion-Solutions/fix/kibana_dashboard_load 
Add Kibana dashboard updates for 2.3.110
 2022-02-24 09:48:28 -05:00
weslambertandGitHub bc1794e437 Fix function name 2022-02-24 09:42:14 -05:00
weslambertandGitHub 45ccfc5ad4 Add back post to .100 and call for .110 2022-02-24 09:35:43 -05:00
weslambertandGitHub 582bf4c64c Remove dashboard updates for .100 so we don't run twice 2022-02-24 09:25:59 -05:00
weslambertandGitHub 7f08ecdcbe Add function reference for .110 post changes 2022-02-24 09:25:15 -05:00
weslambertandGitHub a22e470038 Add Kibana dashboard updates for 2.3.110 2022-02-24 09:20:44 -05:00
weslambertandGitHub bc2c1b4ccc Merge pull request #6935 from abesinger/issue/6912 
Updated syslog pipeline, resolves #6912.
 2022-02-24 08:33:55 -05:00
weslambertandGitHub 2aa811dcd2 Merge pull request #7300 from Security-Onion-Solutions/fix/new_es_template_config 
Add IDH and Kratos index templates
 2022-02-23 12:24:38 -05:00
weslambertandGitHub 6a0ecb9e9c Add IDH and Kratos index templates 2022-02-23 12:13:46 -05:00
weslambertandGitHub 00dbf54a5f Merge pull request #7295 from Security-Onion-Solutions/TOoSmOotH-patch-5 
Update so-functions
 2022-02-23 10:50:32 -05:00
weslambertandGitHub 9f7612b599 Merge pull request #7283 from Security-Onion-Solutions/fix/match_only_text 
Switch from .security to using match_only_text with .text
 2022-02-22 15:41:29 -05:00
Wes Lambert f7862af934 Switch from .security to match_only_text 2022-02-22 20:33:49 +00:00
weslambertandGitHub 3124f2bd12 Merge pull request #7255 from Security-Onion-Solutions/fix/remove_old_templates 
Remove old index templates
 2022-02-18 15:23:07 -05:00
Wes Lambert 4d1533537b Remove old index templates 2022-02-18 20:08:13 +00:00
weslambertandGitHub 87a5e64f12 Merge pull request #7249 from Security-Onion-Solutions/fix/component_index_association 
Update component -> index association for file/scan mappings for Strelka
 2022-02-18 12:19:41 -05:00
weslambertandGitHub 6ee3287d2d Update component -> index association for file/scan mappings for Strelka 2022-02-18 08:12:34 -05:00
weslambertandGitHub 6842099e11 Merge pull request #7224 from Security-Onion-Solutions/fix/zeek_viz 
Switch from dns.answers to dns.answers.name for DTC
 2022-02-17 10:05:46 -05:00
Wes Lambert 5c1f61bda8 Switch from dns.answers to dns.answers.name for DTC 2022-02-17 15:03:46 +00:00
weslambertandGitHub 53c7ad6041 Merge pull request #7223 from Security-Onion-Solutions/fix/shard_settings_setup 
Ensure setup configures pillar correctly for index settings
 2022-02-17 09:48:11 -05:00
weslambertandGitHub c0f9cb188b Add missing colon 2022-02-17 07:58:05 -05:00
weslambertandGitHub d309c4fc0a Update pillar structure for index_settings/shards 2022-02-17 07:10:29 -05:00
weslambertandGitHub d084625ee0 Merge pull request #7218 from Security-Onion-Solutions/fix/composable_templates_soup 
Add pillar update for ES index templates for 2.3.110
 2022-02-16 16:24:57 -05:00
weslambertandGitHub e71b606dd6 Add pillar update for ES index templates for 2.3.110 2022-02-16 16:22:06 -05:00
weslambertandGitHub f1f9322bee Merge pull request #7216 from Security-Onion-Solutions/fix/es_template_netflow_mappings_indent 
Fix indent for so-netflow component template references
 2022-02-16 14:47:31 -05:00
weslambertandGitHub 185ea2fd99 Fix indent for so-netflow component template references 2022-02-16 14:46:12 -05:00
weslambertandGitHub 9e222b1464 Merge pull request #7206 from Security-Onion-Solutions/feature/template-reorg 
Re-organize Elasticsearch Index Templates
 2022-02-15 16:50:14 -05:00
Wes Lambert 4fa3749418 Remove bind or ES templates 2022-02-15 18:08:03 +00:00
Wes Lambert 786a189f65 Merge branch 'feature/template-reorg' of https://github.com/security-onion-solutions/securityonion into feature/template-reorg 2022-02-15 17:06:02 +00:00
Wes Lambert de731fc05d Remove default templates from ES template pillar since they are now managed in the defaults file. 2022-02-15 17:04:57 +00:00