CSEC_PUBLIC/securityonion
1
0 Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-10-21 21:57:13 +02:00
Code Issues Packages Projects Releases Wiki Activity
18,863 Commits 65 Branches 130 Tags
ff2b46b73e185bd87fc2ffc0131a1036c02b2b7b
Commit Graph
18863 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Josh Patterson ff2b46b73e combine default and alerts queries added via pillar 
pillar.get replaces lists, so once alerts queries are saved to pillar
from the SOC config UI, queries added to defaults later (e.g. the
licensed Group By Assessment, Name) never reach soc.json. Merge them by
name the same way availableModels are merged by id: pillar order and
edits are kept, and default queries missing from pillar are appended.
 2026-10-14 09:19:16 -04:00
Mike Reeves b158a38099 Merge pull request #16323 from Security-Onion-Solutions/mreeves/alert-triage-notify-skill 
Remove the Notifier agent mapping
 2026-10-13 17:45:22 -04:00
Mike Reeves 26f5d07435 Remove the Notifier agent mapping 
AlertTriage now sends its own notification through the Notify skill, so the
Notifier agent no longer exists in SOC.
 2026-10-13 17:35:22 -04:00
Mike Reeves 747abeed79 Merge pull request #16302 from Security-Onion-Solutions/mreeves/alert-assessment-groupby 
Add a licensed Group By Assessment, Name alerts query
 2026-10-13 17:16:48 -04:00
Mike Reeves 1bcf80dd10 Group by assessment without a missing bucket 
The assessment is a number, and SOC's missing bucket only works on keyword
fields, so the * made Elasticsearch fail parsing "__missing__" as a long.
Untriaged alerts now drop out of this view.
 2026-10-13 17:11:49 -04:00
Josh Patterson e7d7676a90 Merge pull request #16322 from Security-Onion-Solutions/fix/socmerge 
combine default and availableModels added via pillar
 2026-10-13 16:27:57 -04:00
Josh Patterson 2b6566d33b combine default and availableModels added via pillar 2026-10-13 13:52:30 -04:00
Jorge Reyes f5641647ab Merge pull request #16319 from Security-Onion-Solutions/reyesj2-patch-1 
remap enterprisesearch integration components
 2026-10-13 09:17:30 -05:00
Jorge Reyes fc5e66e913 remap enterprisesearch integration components 2026-10-13 09:10:36 -05:00
Jason Ertel 5f4fc58416 Merge pull request #16317 from Security-Onion-Solutions/jertel/wip 
eval to use Suricata for metadata
 2026-10-10 11:04:49 -04:00
Jason Ertel 84b2b19698 eval to use Suricata for metadata 2026-10-10 11:02:35 -04:00
Josh Brower 7214f8770c Merge pull request #16269 from Security-Onion-Solutions/esql-correlations 
Initial Correlations support
 2026-10-09 15:53:10 -04:00
Mike Reeves 0a0062b9ab Merge pull request #16315 from Security-Onion-Solutions/mreeves/soai-haiku 
Add Claude Haiku to the SOAI assistant models
 2026-10-09 13:51:46 -04:00
Mike Reeves 5d88755429 Increase contextLimitSmall to 1000000 2026-10-09 13:14:26 -04:00
Mike Reeves ecc75ef65a Merge branch '3/dev' into mreeves/soai-haiku 2026-10-09 13:13:45 -04:00
Mike Reeves 037f6d3d4f Update agent mapping for Investigator and DetectionEngineer 2026-10-09 13:09:09 -04:00
Mike Reeves 0cc7e36af5 Reduce contextLimitSmall from 1000000 to 100000 2026-10-09 12:47:46 -04:00
Mike Reeves 946e904434 Merge pull request #16301 from Security-Onion-Solutions/mreeves/alert-triage-agent 
Map the AlertTriage and Notifier agents to a model
 2026-10-09 12:39:24 -04:00
Mike Reeves b17b596a64 Add Claude Haiku to the SOAI assistant models 2026-10-09 10:11:25 -04:00
defensivedepth 5a24fe8b61 Move pipeline fix 2026-10-08 19:43:22 -04:00
defensivedepth fed0c5739d Refactor correlations 2026-10-08 19:31:29 -04:00
Matthew Wright 603949002b Merge pull request #16312 from Security-Onion-Solutions/mwright/md-img-toggle 
Add allowExternalMarkdownImages SOC Setting
 2026-10-08 12:38:45 -04:00
Matthew Wright de63f95ab0 turn off advanced 2026-10-08 12:38:13 -04:00
Matthew Wright a1b76650fb add external image markdown toggle 2026-10-08 12:10:30 -04:00
Jorge Reyes 0cd8e53832 Merge pull request #16311 from Security-Onion-Solutions/reyesj2-patch-4 
regenerate elastic agent installer
 2026-10-08 10:13:30 -05:00
reyesj2 0210ccfcc3 elastic agent 9.4.8 regenerate installer 2026-10-08 09:54:41 -05:00
reyesj2 517076330a stg profile update - breaks so-elastic-agent / so-elastic-fleet containers 2026-10-08 09:54:35 -05:00
Jason Ertel ad249782fc Merge pull request #16310 from Security-Onion-Solutions/jertel/wip 
new destination timeout annotation; fix fp
 2026-10-08 10:48:26 -04:00
Jason Ertel 2eab084358 new destination timeout annotation; fix fp 2026-10-08 10:46:15 -04:00
Jorge Reyes 547d2a316b Merge pull request #16306 from Security-Onion-Solutions/reyesj2/es948 
ES 9.4.8
 2026-10-07 16:17:52 -05:00
Jorge Reyes 1c4eef4224 Update version from 3.0.0-foxtrot to 3.4.0 2026-10-07 12:31:45 -05:00
defensivedepth d352bc0384 ES|QL and Sigma correlation support 2026-10-07 11:26:32 -04:00
Mike Reeves 3304aff62b Note that an oai query also needs the agentic assistant 
SOC (securityonion-soc#1363) now hides a query licensed for oai unless the
assistant is enabled and agentic, so the query editor's license help says so.

Claude-Session: https://claude.ai/code/session_01SZLcwj68A2wLo3F8TGKsLP
 2026-10-07 08:56:44 -04:00
Mike Reeves 7469d833d1 Add a licensed Group By Assessment, Name alerts query 
Groups alerts by the AI triage assessment, keeping untriaged alerts as a
missing bucket. Query entries take an optional license feature, which SOC uses
to hide this one on grids without OnionAI, and the query editor now shows it.
 2026-10-06 21:14:25 -04:00
Mike Reeves b11fc6257a Map the AlertTriage and Notifier agents to a model 
SOC disables a built-in agent that has no agentMapping entry, so the new
AlertTriage agent and the Notifier it delegates to need one to run.
 2026-10-06 20:43:04 -04:00
Jason Ertel d1114a0dae Merge pull request #16300 from Security-Onion-Solutions/jertel/wip 
update tick interval desc
 2026-10-06 18:41:48 -04:00
Jason Ertel f4b301d71c update tick interval desc 2026-10-06 18:32:49 -04:00
Jorge Reyes c6e42131b2 Update version from 3.4.0 to 3.0.0-foxtrot 2026-10-06 13:45:22 -05:00
reyesj2 337dddf596 ES 9.4.8 2026-10-06 13:44:52 -05:00
Josh Patterson f7dbfba178 Merge pull request #16297 from Security-Onion-Solutions/revert-16274-fix/auto-apply-state-queue 
Revert "Fix/auto apply state queue"
 2026-10-05 17:54:16 -04:00
Josh Patterson 0a628bb7e7 Revert "Fix/auto apply state queue" 2026-10-05 17:43:08 -04:00
Josh Patterson bd6647e775 Merge pull request #16274 from Security-Onion-Solutions/fix/auto-apply-state-queue 
Fix/auto apply state queue
 2026-10-05 14:33:02 -04:00
Josh Brower da2c19188a Merge pull request #16287 from Security-Onion-Solutions/sigma-pipeline-dir 
Move Sigma pipelines into a managed directory
 2026-10-05 09:41:48 -04:00
defensivedepth 90b3d37be6 Clarify req 2026-10-05 08:14:13 -04:00
defensivedepth fcd2f67076 Merge remote-tracking branch 'origin/3/dev' into sigma-pipeline-dir 2026-10-05 07:44:53 -04:00
defensivedepth a9cdd17694 Refactor sigma pipelines 2026-10-02 14:23:57 -04:00
Josh Brower b32aaac290 Merge pull request #16278 from Security-Onion-Solutions/evtx-import-datastreams 
EVTX Import cleanup
 2026-10-02 13:30:57 -04:00
Josh Brower 1aee3f28dc Merge pull request #16279 from Security-Onion-Solutions/process-caseless-mappings 
caseless for non-Defend sources
 2026-10-02 13:30:45 -04:00
Josh Patterson 678cb0d5b2 Merge pull request #16286 from Security-Onion-Solutions/fix/docker-29.8.1 
upgrade docker 29.8.1 and containerd 2.3.6
 2026-10-02 12:05:04 -04:00
Josh Patterson 31c5190a1f add missing comma 2026-10-02 12:03:04 -04:00