Compare commits

...

186 Commits

Author SHA1 Message Date
Mike Reeves
c949101d0f Merge pull request #10406 from Security-Onion-Solutions/dev
2.3.250
2023-05-22 15:14:23 -04:00
Mike Reeves
7c1f19b91f Merge pull request #10405 from Security-Onion-Solutions/2.3.250
2.3.250
2023-05-22 11:39:40 -04:00
Mike Reeves
598d6b025e 2.3.250 2023-05-22 11:37:13 -04:00
Jason Ertel
4d0d0714a5 Merge pull request #10401 from Security-Onion-Solutions/jertel/fixwhoisit
use the same requests version that's already packaged with the analyzer
2023-05-20 08:45:29 -04:00
Jason Ertel
cb0c078955 use the same requests version that's already packaged with the analyzer 2023-05-19 23:56:39 -04:00
Jason Ertel
aa426244bf Merge pull request #10394 from Security-Onion-Solutions/jertel/fixwhoisit
fix lib dependency issue with whoisit
2023-05-19 14:34:32 -04:00
Jason Ertel
97b2ae8d82 fix lib dependency issue with whoisit 2023-05-19 14:23:12 -04:00
Doug Burks
7047125759 Merge pull request #10386 from Security-Onion-Solutions/2.3/elastic-8.7.1
UPGRADE: Elastic 8.7.1 #10269
2023-05-18 15:27:10 -04:00
Doug Burks
43f73abd4d Update so-kibana-config-load 2023-05-18 15:18:27 -04:00
Doug Burks
51a8684850 Update config_saved_objects.ndjson 2023-05-18 15:17:36 -04:00
Doug Burks
b3c5239787 Merge pull request #10333 from Security-Onion-Solutions/dougburks-patch-1
Update soup for 2.3.250
2023-05-11 08:28:53 -04:00
Doug Burks
0f562279ee Update soup for 2.3.250 2023-05-11 07:26:58 -04:00
weslambert
834f45c0f2 Merge pull request #10286 from Security-Onion-Solutions/fix/strelka_ignore_yara_rules
Ignore "expl_outlook_cve_2023_23397.yar" and "gen_mal_3cx_compromise_mar23.yar" since they are causing problems with YARA compilation
2023-05-08 11:58:11 -04:00
weslambert
d4cf9efeca Merge pull request #10303 from Security-Onion-Solutions/fix/kibana_pivot_to_pcap_url
Surround _id field in double quotes to prevent errors associated with values beginning with a hyphen
2023-05-08 11:55:22 -04:00
Doug Burks
c620983b4a Merge pull request #10299 from Security-Onion-Solutions/dougburks-patch-1
FIX: Improve soup's local file modification logic #8972
2023-05-08 09:47:49 -04:00
Wes
ed19c139ea Surround _id field in double quotes to prevent errors associated with values beginning with a hyphen 2023-05-08 13:44:36 +00:00
Doug Burks
af85c6261b FIX: Improve soup's local file modification logic #8972 2023-05-08 09:41:26 -04:00
weslambert
e9f58269cd Ignore "expl_outlook_cve_2023_23397.yar" and "gen_mal_3cx_compromise_mar23.yar" since they are causing problems with YARA compilation 2023-05-04 16:13:59 -04:00
Jason Ertel
208c3d96e9 Merge pull request #10266 from Security-Onion-Solutions/jertel/aws
more detection improvements
2023-05-02 08:17:13 -04:00
Jason Ertel
1e888a5d9e more detection improvements 2023-05-02 07:56:11 -04:00
Jason Ertel
f7ae8d449e Merge pull request #10259 from Security-Onion-Solutions/jertel/simplifycd
simplify cloud detection
2023-05-01 11:33:26 -04:00
Jason Ertel
195274bb11 Merge branch 'dev' into jertel/simplifycd 2023-05-01 11:29:39 -04:00
Jason Ertel
a0ac1d2274 simplify cloud detection 2023-05-01 11:04:43 -04:00
Mike Reeves
3dd39c7f59 Merge pull request #10234 from Security-Onion-Solutions/TOoSmOotH-patch-2
Update VERSION
2023-04-26 14:41:04 -04:00
Mike Reeves
ba846bbf35 Update VERSION 2023-04-26 14:39:31 -04:00
Mike Reeves
0baf8e9471 Merge pull request #10227 from Security-Onion-Solutions/dev
2.3.240
2023-04-26 14:31:56 -04:00
Mike Reeves
e30fec7af0 Merge pull request #10226 from Security-Onion-Solutions/2.3.240
2.3.240
2023-04-26 09:58:18 -04:00
Mike Reeves
884f5cd3a6 2.3.240 2023-04-26 09:55:19 -04:00
Jason Ertel
11babd2f1c Merge pull request #10221 from Security-Onion-Solutions/jertel/imdsv2to
timeout more quickly on aws imdsv2 detection
2023-04-26 07:59:13 -04:00
Jason Ertel
b440ab5c02 timeout more quickly on aws imdsv2 detection 2023-04-26 07:57:23 -04:00
Jason Ertel
91d667c3ad Merge pull request #10200 from Security-Onion-Solutions/jertel/imdsv2_23
Detect cloud install on forced imdsv2 instances
2023-04-25 09:46:39 -04:00
Jason Ertel
f04c01b28c Merge pull request #10204 from Security-Onion-Solutions/jertel/2.3.240_soup
soup update for 2.3.240
2023-04-25 09:46:28 -04:00
Jason Ertel
71ab8ddf1d soup update for 2.3.240 2023-04-25 09:42:14 -04:00
Jason Ertel
f1f79d55dc Detect cloud install on forced imdsv2 instances 2023-04-24 16:26:23 -04:00
Mike Reeves
db1bd16758 Merge pull request #10142 from Security-Onion-Solutions/TOoSmOotH-patch-1
Update VERSION
2023-04-17 10:56:59 -04:00
Mike Reeves
ef73834d58 Update VERSION 2023-04-17 10:55:38 -04:00
Mike Reeves
3891548d6d Merge pull request #10141 from Security-Onion-Solutions/dev
2.3.230 Release
2023-04-17 10:47:32 -04:00
Mike Reeves
9d6ed8b9b2 Merge pull request #10140 from Security-Onion-Solutions/2.3.230
2.3.230
2023-04-17 10:26:59 -04:00
Mike Reeves
ef92815a08 2.3.230 2023-04-17 10:22:39 -04:00
Doug Burks
19b5cdcb0e Merge pull request #10119 from Security-Onion-Solutions/2.3/fix-suricata-dns
FIX: Suricata DNS A and CNAME parsing #10117
2023-04-13 11:00:13 -04:00
Doug Burks
272b345892 FIX: Suricata DNS A and CNAME parsing #10117 2023-04-13 10:52:37 -04:00
Mike Reeves
7fad9d60ef Merge pull request #10113 from Security-Onion-Solutions/TOoSmOotH-patch-4
Update init.sls
2023-04-12 10:32:43 -04:00
Mike Reeves
46fc62b8dc Update init.sls 2023-04-12 10:29:54 -04:00
Doug Burks
ca9a93a4b0 Merge pull request #9998 from Security-Onion-Solutions/dougburks-patch-1
Update soup for 2.3.230
2023-03-24 12:38:39 -04:00
Doug Burks
aa2e18fca9 Update soup for 2.3.230 2023-03-24 12:31:51 -04:00
Mike Reeves
7e4ce7b81d Merge pull request #9877 from Security-Onion-Solutions/TOoSmOotH-patch-3
Update HOTFIX
2023-03-01 16:37:14 -05:00
Mike Reeves
e5c0058dd1 Update HOTFIX 2023-03-01 16:36:08 -05:00
Mike Reeves
07c5b541a3 Merge pull request #9876 from Security-Onion-Solutions/master
Master to Dev
2023-03-01 16:35:48 -05:00
Mike Reeves
b756b8ea32 Merge pull request #9873 from Security-Onion-Solutions/hotfix/2.3.220
Hotfix/2.3.220
2023-03-01 16:32:49 -05:00
Mike Reeves
5b46e57ae1 Merge pull request #9875 from Security-Onion-Solutions/hotfix23220
Hotfix for 2.3.220
2023-03-01 16:14:26 -05:00
Mike Reeves
924009afb8 Hotfix for 2.3.220 2023-03-01 16:11:38 -05:00
Mike Reeves
8f5bacc510 Merge pull request #9874 from Security-Onion-Solutions/TOoSmOotH-patch-3
Update init.sls
2023-03-01 14:52:04 -05:00
Mike Reeves
d5e48a7eca Update init.sls 2023-03-01 14:50:55 -05:00
Mike Reeves
6346a92f0f Merge pull request #9872 from Security-Onion-Solutions/hotfix23220
Hotfix for 2.3.220
2023-03-01 14:20:47 -05:00
Mike Reeves
13a566a9a2 Hotfix for 2.3.220 2023-03-01 14:19:04 -05:00
Mike Reeves
063c6599d8 Hotfix for 2.3.220 2023-03-01 14:17:22 -05:00
weslambert
9fb315c99d Merge pull request #9870 from Security-Onion-Solutions/fix/curator_configuration_update_8.0.x
Update Curator configuration to align with requirements for Curator 8.0.x
2023-03-01 10:19:32 -05:00
Wes
6e0891e586 Update Curator configuration to align with requirements for Curator 8.0.x 2023-03-01 15:16:52 +00:00
Mike Reeves
3a96d59899 Merge pull request #9869 from Security-Onion-Solutions/TOoSmOotH-patch-2
Update HOTFIX
2023-03-01 10:10:47 -05:00
Mike Reeves
5fa945956e Update HOTFIX 2023-03-01 10:09:19 -05:00
Mike Reeves
b0aab96cf5 Merge pull request #9858 from Security-Onion-Solutions/TOoSmOotH-patch-1
Update VERSION
2023-02-27 09:40:39 -05:00
Mike Reeves
11def72790 Update VERSION 2023-02-27 09:39:52 -05:00
Mike Reeves
2ca2724a4c Merge pull request #9857 from Security-Onion-Solutions/dev
2.3.220
2023-02-27 09:35:14 -05:00
Mike Reeves
884883a225 Merge pull request #9856 from Security-Onion-Solutions/2.3.220
2.3.220
2023-02-27 09:26:28 -05:00
Mike Reeves
5c8ba3af65 2.3.220 2023-02-27 09:23:33 -05:00
Josh Brower
4b5d314adf Merge pull request #9833 from Security-Onion-Solutions/FleetDMConfigFix
Remove unsupported config option
2023-02-21 16:36:58 -05:00
Josh Brower
6e637f559c Remove unsupported config option 2023-02-21 16:35:11 -05:00
Doug Burks
cc5304e9f7 Merge pull request #9806 from Security-Onion-Solutions/2.3/upgrade-elastic-8.6.2
2.3/upgrade elastic 8.6.2
2023-02-17 08:03:01 -05:00
Doug Burks
002403055d UPGRADE: Elastic 8.6.2 #9804 2023-02-17 07:04:57 -05:00
Doug Burks
b80b80e825 UPGRADE: Elastic 8.6.2 #9804 2023-02-17 07:03:47 -05:00
Josh Brower
c539d53a02 Merge pull request #9791 from Security-Onion-Solutions/fleetsapassword
Fix edge case
2023-02-15 15:30:49 -05:00
Josh Brower
3a22978c2b Fix password gen edge case 2023-02-15 15:25:35 -05:00
Doug Burks
5b1461e9a1 Merge pull request #9782 from Security-Onion-Solutions/dougburks-patch-1
Update soup for 2.3.220
2023-02-14 08:44:09 -05:00
Doug Burks
69f889dbd9 Update soup for 2.3.220 2023-02-14 08:42:35 -05:00
Josh Brower
aefe1cceb8 Merge pull request #9758 from Security-Onion-Solutions/fleetupgrade
Fix link for FleetDM standalone nodes
2023-02-09 14:10:45 -05:00
Josh Brower
b7e97eceb3 Fix link for FleetDM standalone nodes 2023-02-09 14:08:48 -05:00
Josh Brower
450e02e874 Merge pull request #9749 from Security-Onion-Solutions/fleetdm-fix
FleetDM Upgrade Fix
2023-02-09 09:30:22 -05:00
Josh Brower
09bebf08d6 Fix FleetDM SOC Link 2023-02-09 09:10:50 -05:00
Josh Brower
4dd54cea6c Use correct variable name 2023-02-08 16:58:47 -05:00
Josh Brower
e07f4bd0ed Workaround for FleetDM PW Req 2023-02-08 13:03:33 -05:00
Mike Reeves
6adb586bb4 Merge pull request #9734 from Security-Onion-Solutions/TOoSmOotH-patch-1
Update VERSION
2023-02-07 09:07:06 -05:00
Mike Reeves
2f99821736 Update VERSION 2023-02-07 09:05:16 -05:00
Mike Reeves
db27c22158 Merge pull request #9730 from Security-Onion-Solutions/dev
2.3.210
2023-02-07 08:58:36 -05:00
Mike Reeves
2ff284fc7f Merge pull request #9729 from Security-Onion-Solutions/2.3.210
2.3.210
2023-02-06 16:36:06 -05:00
Mike Reeves
5d0a3ef205 2.3.210 2023-02-06 16:32:45 -05:00
Mike Reeves
ac9c10dd3a 2.3.210 2023-02-06 15:46:27 -05:00
weslambert
d4d67b545d Merge pull request #9699 from Security-Onion-Solutions/fix/strelka_yara_exclusion
Add 'configured_vulns_ext_vars.yar' to exclusion list
2023-02-01 14:38:29 -05:00
weslambert
2dced35800 Add 'configured_vulns_ext_vars.yar' to exclusion list 2023-02-01 14:24:20 -05:00
Josh Patterson
c2a04a79c5 Merge pull request #9697 from Security-Onion-Solutions/23mysqlpy
23mysqlpy
2023-02-01 14:17:24 -05:00
m0duspwnens
d43346a084 hold python mysql 2023-02-01 14:11:27 -05:00
m0duspwnens
0c4a27d120 lock python36-mysql-1.3.12-2.el7 version 2023-02-01 12:33:19 -05:00
Doug Burks
b4530ffffe Merge pull request #9681 from Security-Onion-Solutions/fix/suricata-dhcp-parsing-2.3
2.3: Improve Suricata DHCP parsing and dashboard
2023-01-31 10:18:49 -05:00
Doug Burks
d12aa0ed56 Move host.domain table to end of DHCP tables 2023-01-31 07:14:18 -05:00
Doug Burks
17bcf50ccb update Suricata DHCP parser to set server.address 2023-01-30 15:57:47 -05:00
Doug Burks
48401f6a3f Merge pull request #9675 from Security-Onion-Solutions/dougburks-patch-1
Update soup for 2.3.210
2023-01-30 09:17:47 -05:00
Doug Burks
a96825f43e Update soup for 2.3.210 2023-01-30 09:16:00 -05:00
Doug Burks
2d48ae7bca Merge pull request #9656 from Security-Onion-Solutions/2.3/elastic-8.6.1
UPGRADE: Elastic 8.6.1 #9594 (2.3)
2023-01-26 16:24:33 -05:00
Doug Burks
0ff519ed2f Update to Elastic 8.6.1 2023-01-26 16:09:13 -05:00
Doug Burks
127533492f Update to Elastic 8.6.1 2023-01-26 16:08:15 -05:00
Mike Reeves
7d4b4a8bd4 Merge pull request #9585 from Security-Onion-Solutions/TOoSmOotH-patch-1
Update VERSION
2023-01-17 09:40:46 -05:00
Mike Reeves
e9fa84d71b Update VERSION 2023-01-17 09:39:35 -05:00
Mike Reeves
cd8cf4a1ac Merge pull request #9578 from Security-Onion-Solutions/dev
2.3.200
2023-01-17 09:26:23 -05:00
Mike Reeves
9718e61a6a Merge pull request #9576 from Security-Onion-Solutions/2.3.200
2.3.200
2023-01-13 16:12:20 -05:00
Mike Reeves
22ec638e85 2.3.200 2023-01-13 16:08:27 -05:00
Doug Burks
7b0c22f967 Merge pull request #9568 from Security-Onion-Solutions/fix/soup-thehive-errors
soup should continue even if thehive errors
2023-01-12 13:28:41 -05:00
Doug Burks
672cab858e Continue even if thehive errors 2023-01-12 12:48:16 -05:00
Josh Brower
29312d595b Merge pull request #9559 from Security-Onion-Solutions/idh-skins
Fix mispelling
2023-01-11 11:04:29 -05:00
Josh Brower
b54f2e8752 Fix mispelling 2023-01-11 10:59:50 -05:00
Josh Brower
1470e120ef Merge pull request #9540 from Security-Onion-Solutions/idhskins
bug fix - idh skins
2023-01-09 15:49:04 -05:00
Josh Brower
2c747ec837 make sure dir is created 2023-01-09 13:46:10 -05:00
Josh Brower
8cb5cd5fee Merge pull request #9214 from Security-Onion-Solutions/idhskins
Custom IDH HTTP Skins
2023-01-06 15:14:14 -05:00
Doug Burks
a4bae77973 Merge pull request #9271 from Njinx/dev
so-status runs some code before checking for root privileges
2023-01-04 16:05:34 -05:00
Doug Burks
96a568f57f Merge pull request #9515 from Security-Onion-Solutions/fix/so-common-references-2.3
fix so-common references
2023-01-04 14:31:57 -05:00
doug
7dcdcc18a5 fix so-common references 2023-01-04 14:28:47 -05:00
Doug Burks
10fc8de9f9 Merge pull request #9513 from Security-Onion-Solutions/fix/jinja-whitespace-2.3
fix jinja whitespace 2.3
2023-01-04 13:56:17 -05:00
doug
3482df5ee1 fix jinja whitespace 2023-01-04 13:33:51 -05:00
Doug Burks
9ea3d6bb1f Merge pull request #9512 from Security-Onion-Solutions/fix/copyright-year-2023
Update Copyright year
2023-01-04 12:50:30 -05:00
doug
a67a254edc update Copyright year 2023-01-04 12:44:18 -05:00
Doug Burks
08a5a9ab31 Merge pull request #9510 from Security-Onion-Solutions/fix/sysmon-fields-2.3
Improve default sysmon fields and add new network_connection fields
2023-01-04 07:58:04 -05:00
Doug Burks
e3d32c7871 Improve default sysmon fields and add new network_connection fields 2023-01-04 07:38:18 -05:00
weslambert
20d6ce1ce9 Merge pull request #9501 from Security-Onion-Solutions/fix/elasticsearch_ingest_pipeline_rita_beacon
Update RITA beacon parsing
2023-01-03 11:13:55 -05:00
Wes
bd114eb1c4 Update RITA beacon parsing 2023-01-03 16:01:35 +00:00
Doug Burks
55c6fc422b Merge pull request #9497 from Security-Onion-Solutions/fix/sysmon-parsing-2.3
FIX: Sysmon logs are missing event.category and event.dataset #8194
2023-01-03 08:56:16 -05:00
doug
5d060f9832 update Sysmon File dashboard 2022-12-31 14:10:02 -05:00
doug
edcbfd17f5 update sysmon parser 2022-12-30 16:20:06 -05:00
Doug Burks
ff4850d9ce Merge pull request #9452 from Security-Onion-Solutions/feature/improve-dashboards-2.3
FEATURE: Improve SOC Dashboards #9450 2.3
2022-12-21 15:46:21 -05:00
Doug Burks
3e1a5b6329 Improve Strelka dashboard 2022-12-21 15:34:06 -05:00
Doug Burks
b1709f3ea3 Improve Firewall dashboard 2022-12-21 15:28:41 -05:00
Doug Burks
76a73ea35c Improve Software dashboard 2022-12-21 15:25:19 -05:00
Doug Burks
991a6ec43c Improve Intel dashboard 2022-12-21 15:19:54 -05:00
Doug Burks
e2c0607249 Improve FTP dashboard 2022-12-21 14:36:44 -05:00
Doug Burks
82c61e6bc9 improve NIDS Alerts dashboard 2022-12-21 14:32:05 -05:00
Doug Burks
37aa779095 Minor improvements 2022-12-21 13:14:38 -05:00
Doug Burks
9e631ad63d Improve SOC dashboards 2022-12-21 13:04:12 -05:00
Jason Ertel
fe6a55b58e Merge pull request #9393 from Security-Onion-Solutions/jertel/soup23200
Move Kratos DB to /nsm
2022-12-14 14:26:19 -05:00
Jason Ertel
87cebedc85 Backup the new Kratos location 2022-12-14 14:12:47 -05:00
Jason Ertel
e66c995b1f remove apparently unused reactor reference 2022-12-14 13:50:20 -05:00
Jason Ertel
e8a8f65ddc fix typo 2022-12-14 12:56:25 -05:00
Jason Ertel
a7a15117f0 Improve soup wording when the script itself needs updated 2022-12-14 12:03:47 -05:00
Jason Ertel
865ba4264b Stop backing up kratos since it now lives in /nsm. Ensure kratos is removed when re-installing. 2022-12-14 10:57:24 -05:00
Jason Ertel
6985b0ab27 Move kratos DB to /nsm 2022-12-14 10:50:24 -05:00
Mike Reeves
6e4912f759 Merge pull request #9385 from Security-Onion-Solutions/TOoSmOotH-patch-1
Fix Highlander Config for Kibana
2022-12-13 13:54:30 -05:00
Mike Reeves
b0d934daf7 Update config.map.jinja 2022-12-13 13:52:13 -05:00
Doug Burks
8e50868abd Merge pull request #9383 from Security-Onion-Solutions/fix/import-hyperlink
FIX: so-import utilities should hyperlink to dashboards #9373
2022-12-13 13:36:22 -05:00
Doug Burks
aa08803f03 FIX: so-import utilities should hyperlink to dashboards #9373 2022-12-13 13:23:27 -05:00
Doug Burks
bb346d531d FIX: so-import utilities should hyperlink to dashboards #9373 2022-12-13 13:22:53 -05:00
Doug Burks
6c057d0b0a FIX: so-import utilities should hyperlink to dashboards #9373 2022-12-13 12:43:54 -05:00
Doug Burks
47e43e53d9 FIX: so-import utilities should hyperlink to dashboards #9373 2022-12-13 12:43:10 -05:00
weslambert
a8456a4d65 Merge pull request #9369 from Security-Onion-Solutions/fix/sensoroni_analyzers_configuration_check
Fix localfile analyzer 'file_path' check and add new list value verification function for helpers
2022-12-13 11:47:10 -05:00
Wes
98a1fb96c2 Add test coverage for empty list value 2022-12-13 16:23:16 +00:00
Wes
874bbd2580 Remove extra whitespace 2022-12-13 16:02:46 +00:00
Wes
90dedbb841 Update tests to account for change in 'file_path' value verification 2022-12-13 15:58:35 +00:00
Wes
df5dd5fe28 Use new list verification function for 'file_path' 2022-12-13 15:57:43 +00:00
Wes
d5ab455485 Add new test for list value verification function 2022-12-13 15:56:58 +00:00
Wes
20b79b7ab0 Add new function to verify list value 2022-12-13 15:56:26 +00:00
Jason Ertel
56019f48ca Merge pull request #9358 from Security-Onion-Solutions/jertel/es853
Upgrade ES to 8.5.3
2022-12-12 13:45:56 -05:00
Jason Ertel
d7dd2d2ef8 Upgrade ES to 8.5.3 2022-12-12 13:43:28 -05:00
weslambert
3d431eaba9 Merge pull request #9341 from Security-Onion-Solutions/fix/analyzers_localfile_file_path
Remove double quotes to fix issue with file path sourcing from 'localfile.py'
2022-12-08 16:49:29 -05:00
weslambert
f85fb5ecf9 Remove double quotes to fix issue with file path sourcing from 'localfile.py' 2022-12-08 16:35:24 -05:00
Jason Ertel
1716cb0297 Merge pull request #9333 from Security-Onion-Solutions/jertel/mergedev
Jertel/mergedev
2022-12-08 09:17:20 -05:00
Jason Ertel
0ec366f075 clear hotfix 2022-12-08 09:15:41 -05:00
Jason Ertel
e9b9e128c6 Merge branch 'master' into jertel/mergedev 2022-12-08 09:14:08 -05:00
Mike Reeves
ef15de130a Merge pull request #9329 from Security-Onion-Solutions/hotfix/2.3.190
Hotfix/2.3.190
2022-12-08 09:08:18 -05:00
Mike Reeves
e975ee0a8e Merge pull request #9328 from Security-Onion-Solutions/mike4
2.3.190 hotfix
2022-12-07 16:22:05 -05:00
Mike Reeves
da94ddca13 2.3.190 hotfix 2022-12-07 16:17:57 -05:00
Mike Reeves
6e94751c65 Merge pull request #9327 from Security-Onion-Solutions/jertel/surifilecheck
Switch back to older style redirect due to incompatibility with Ub 18
2022-12-07 14:10:30 -05:00
Jason Ertel
d48d473f43 Switch back to older style redirect due to incompatibility with Ub 18 2022-12-07 14:06:24 -05:00
Jason Ertel
cff5a83ad5 Merge pull request #9324 from Security-Onion-Solutions/jertel/surifilecheck
Use original style due to pgrep conflict with cron
2022-12-07 12:06:26 -05:00
Jason Ertel
225b7e359c Use original style due to pgrep conflict with cron 2022-12-07 11:53:42 -05:00
Mike Reeves
9a616caf53 Merge pull request #9322 from Security-Onion-Solutions/mike
2.3.190 hotfix
2022-12-07 11:15:30 -05:00
Mike Reeves
0aab268801 2.3.190 hotfix 2022-12-07 11:12:13 -05:00
Mike Reeves
0bb7f5c5e3 Merge pull request #9320 from Security-Onion-Solutions/TOoSmOotH-patch-3
Update HOTFIX
2022-12-07 09:21:17 -05:00
Mike Reeves
4aff1f0fdb Update HOTFIX 2022-12-07 09:19:51 -05:00
Jason Ertel
35ca08ea88 Merge pull request #9315 from Security-Onion-Solutions/jertel/surifilecheck
Suricata support for filecheck; reduce cron noise
2022-12-07 08:17:19 -05:00
Jason Ertel
7b05627d5c Suricata support for filecheck; reduce cron noise 2022-12-07 07:58:32 -05:00
Mike Reeves
e3c1b6dbba Merge pull request #9306 from Security-Onion-Solutions/TOoSmOotH-patch-2
Update init.sls
2022-12-06 13:38:35 -05:00
Mike Reeves
f0c3b876a9 Update init.sls 2022-12-06 13:35:03 -05:00
Mike Reeves
531423f49a Update init.sls 2022-12-06 13:25:03 -05:00
Jason Ertel
dfad5a748c Merge pull request #9303 from Security-Onion-Solutions/jertel/surifilecheck
Jertel/surifilecheck
2022-12-06 11:52:36 -05:00
Jason Ertel
819b39c0bb Update hotfix 2022-12-06 11:41:00 -05:00
Jason Ertel
0dd2e51e83 Ensure Suricata move events get picked up 2022-12-06 11:39:58 -05:00
Mike Reeves
f7730741c2 Merge pull request #9297 from Security-Onion-Solutions/TOoSmOotH-patch-1
Update VERSION
2022-12-05 16:12:55 -05:00
Mike Reeves
cb2d6b7876 Update VERSION 2022-12-05 16:07:12 -05:00
Ben Allen
a1b2c28a42 Check privileges much earlier 2022-12-02 14:08:22 -05:00
Josh Brower
5950771003 Merge remote-tracking branch 'remotes/origin/dev' into idhskins 2022-11-22 18:04:38 -05:00
Josh Brower
7c8ce7899b Initial support for custom IDH http skins 2022-11-22 17:57:51 -05:00
492 changed files with 2600 additions and 591 deletions

1
HOTFIX
View File

@@ -0,0 +1 @@

View File

@@ -1,18 +1,18 @@
### 2.3.190-20221205 ISO image built on 2022/12/05
### 2.3.250-20230519 ISO image built on 2023/05/19
### Download and Verify
2.3.190-20221205 ISO image:
https://download.securityonion.net/file/securityonion/securityonion-2.3.190-20221205.iso
2.3.250-20230519 ISO image:
https://download.securityonion.net/file/securityonion/securityonion-2.3.250-20230519.iso
MD5: E8D0BB6F43F67EC64F04AE239781E674
SHA1: BC58236BDF8DBD86870182B6F79009406DC04138
SHA256: 34A98078538060486C70A934839A271A5AD66CF50D55EEC04DA0B325B13D56AC
MD5: EBECF635FB8CFDDD5C0559D01C14E215
SHA1: 1C2BD45D080D6D99FD84C120827EA39817FCB078
SHA256: 748E9740077BCCAFDC67D15BA2D6A4B0539A29E4527715973E5BDDE5DCF565AD
Signature for ISO image:
https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.190-20221205.iso.sig
https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.250-20230519.iso.sig
Signing key:
https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/master/KEYS
@@ -26,22 +26,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/ma
Download the signature file for the ISO:
```
wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.190-20221205.iso.sig
wget https://github.com/Security-Onion-Solutions/securityonion/raw/master/sigs/securityonion-2.3.250-20230519.iso.sig
```
Download the ISO image:
```
wget https://download.securityonion.net/file/securityonion/securityonion-2.3.190-20221205.iso
wget https://download.securityonion.net/file/securityonion/securityonion-2.3.250-20230519.iso
```
Verify the downloaded ISO image using the signature file:
```
gpg --verify securityonion-2.3.190-20221205.iso.sig securityonion-2.3.190-20221205.iso
gpg --verify securityonion-2.3.250-20230519.iso.sig securityonion-2.3.250-20230519.iso
```
The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
```
gpg: Signature made Mon 05 Dec 2022 12:27:49 PM EST using RSA key ID FE507013
gpg: Signature made Sat 20 May 2023 09:16:02 AM EDT using RSA key ID FE507013
gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.

View File

@@ -1 +1 @@
2.3.190
2.3.250

View File

@@ -67,7 +67,5 @@ peer:
reactor:
- 'so/fleet':
- salt://reactor/fleet.sls
- 'salt/beacon/*/watch_sqlite_db//opt/so/conf/kratos/db/sqlite.db':
- salt://reactor/kratos.sls

View File

@@ -15,6 +15,7 @@ zeek:
SpoolDir: /nsm/zeek/spool
CfgDir: /opt/zeek/etc
CompressLogs: 1
ZeekPort: 27760
local:
'@load':
- misc/loaded-scripts

View File

@@ -110,7 +110,6 @@ commonpkgs:
- libssl-dev
- python3-dateutil
- python3-m2crypto
- python3-mysqldb
- python3-packaging
- python3-lxml
- git
@@ -153,7 +152,6 @@ commonpkgs:
- python36-docker
- python36-dateutil
- python36-m2crypto
- python36-mysql
- python36-packaging
- python36-lxml
- yum-utils
@@ -170,6 +168,7 @@ heldpackages:
- docker-ce: 3:20.10.5-3.el7
- docker-ce-cli: 1:20.10.5-3.el7
- docker-ce-rootless-extras: 20.10.5-3.el7
- python36-mysql: 1.3.12-2.el7
- hold: True
- update_holds: True
{% endif %}

View File

@@ -1,6 +1,6 @@
#!/usr/bin/env python3
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -13,7 +13,9 @@
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.. /usr/sbin/so-common
# along with this program. If not, see <http://www.gnu.org/licenses/>.
. /usr/sbin/so-common
{% set BACKUPLOCATIONS = salt['pillar.get']('backup:locations', {}) %}
TODAY=$(date '+%Y_%m_%d')
@@ -35,7 +37,7 @@ if [ ! -f $BACKUPFILE ]; then
{%- endfor %}
tar -rf $BACKUPFILE /etc/pki
tar -rf $BACKUPFILE /etc/salt
tar -rf $BACKUPFILE /opt/so/conf/kratos
tar -rf $BACKUPFILE /nsm/kratos
fi

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/usr/bin/env python3
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/usr/bin/env python3
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common
SKIP=0

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common
if [ "$1" == "" ]; then
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_component_template | jq '.component_templates[] |.name'| sort

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common
if [ "$1" == "" ]; then
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_index_template | jq '.index_templates[] |.name'| sort

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common

View File

@@ -1,7 +1,7 @@
#!/bin/bash
#
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common
if [ "$1" == "" ]; then
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_ingest/pipeline/* | jq 'keys'

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -14,7 +14,7 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') -%}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip', '') %}
. /usr/sbin/so-common
if [ "$1" == "" ]; then
{{ ELASTICCURL }} -s -k -L https://{{ NODEIP }}:9200/_template/* | jq 'keys'

View File

@@ -1,5 +1,5 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/usr/bin/env python3
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -53,8 +53,10 @@ if [[ $? -ne 0 ]]; then
exit 2
fi
TEMPPW=$FLEET_SA_PW!
# Create New User
CREATE_OUTPUT=$(docker exec so-fleet fleetctl user create --email $USER_EMAIL --name $USER_EMAIL --password $USER_PASS --global-role admin 2>&1)
CREATE_OUTPUT=$(docker exec so-fleet fleetctl user create --email $USER_EMAIL --name $USER_EMAIL --password $TEMPPW --global-role admin 2>&1)
if [[ $? -eq 0 ]]; then
echo "Successfully added user to Fleet"
@@ -64,6 +66,9 @@ else
exit 2
fi
# Reset New User Password to user supplied password
echo "$USER_PASS" | so-fleet-user-update "$USER_EMAIL"
# Disable forced password reset
MYSQL_OUTPUT=$(docker exec so-mysql mysql -u root --password=$MYSQL_PW fleet -e \
"UPDATE users SET admin_forced_password_reset = 0 WHERE email = '$USER_EMAIL'" 2>&1)

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -18,10 +18,10 @@
{%- set MANAGER = salt['grains.get']('master') %}
{%- set VERSION = salt['pillar.get']('global:soversion') %}
{%- set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
{%- set MANAGERIP = salt['pillar.get']('global:managerip') -%}
{%- set MANAGERIP = salt['pillar.get']('global:managerip') %}
{%- set URLBASE = salt['pillar.get']('global:url_base') %}
{% set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
{% set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
{%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
{%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
INDEX_DATE=$(date +'%Y.%m.%d')
RUNID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1)
@@ -166,11 +166,11 @@ cat << EOF
Import complete!
You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser:
https://{{ URLBASE }}/#/hunt?q=import.id:${RUNID}%20%7C%20groupby%20event.module%20event.dataset&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC
https://{{ URLBASE }}/#/dashboards?q=import.id:${RUNID}%20%7C%20groupby%20-sankey%20event.dataset%20event.category%2a%20%7C%20groupby%20-pie%20event.category%20%7C%20groupby%20-bar%20event.module%20%7C%20groupby%20event.dataset%20%7C%20groupby%20event.module%20%7C%20groupby%20event.category%20%7C%20groupby%20observer.name%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC
or you can manually set your Time Range to be (in UTC):
From: $START_OLDEST_FORMATTED To: $END_NEWEST
Please note that it may take 30 seconds or more for events to appear in Hunt.
Please note that it may take 30 seconds or more for events to appear in Security Onion Console.
EOF
fi

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -18,7 +18,7 @@
{%- set MANAGER = salt['grains.get']('master') %}
{%- set VERSION = salt['pillar.get']('global:soversion') %}
{%- set IMAGEREPO = salt['pillar.get']('global:imagerepo') %}
{%- set MANAGERIP = salt['pillar.get']('global:managerip') -%}
{%- set MANAGERIP = salt['pillar.get']('global:managerip') %}
{%- set URLBASE = salt['pillar.get']('global:url_base') %}
. /usr/sbin/so-common
@@ -214,11 +214,11 @@ cat << EOF
Import complete!
You can use the following hyperlink to view data in the time range of your import. You can triple-click to quickly highlight the entire hyperlink and you can then copy it into your browser:
https://{{ URLBASE }}/#/hunt?q=import.id:${HASH}%20%7C%20groupby%20event.module%20event.dataset&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC
https://{{ URLBASE }}/#/dashboards?q=import.id:${HASH}%20%7C%20groupby%20-sankey%20event.dataset%20event.category%2a%20%7C%20groupby%20-pie%20event.category%20%7C%20groupby%20-bar%20event.module%20%7C%20groupby%20event.dataset%20%7C%20groupby%20event.module%20%7C%20groupby%20event.category%20%7C%20groupby%20observer.name%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port&t=${START_OLDEST_SLASH}%2000%3A00%3A00%20AM%20-%20${END_NEWEST_SLASH}%2000%3A00%3A00%20AM&z=UTC
or you can manually set your Time Range to be (in UTC):
From: $START_OLDEST To: $END_NEWEST
Please note that it may take 30 seconds or more for events to appear in Hunt.
Please note that it may take 30 seconds or more for events to appear in Security Onion Console.
EOF
fi

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,11 +1,6 @@
#!/bin/bash
#
# {%- set FLEET_MANAGER = salt['pillar.get']('global:fleet_manager', False) -%}
# {%- set FLEET_NODE = salt['pillar.get']('global:fleet_node', False) -%}
# {%- set FLEET_IP = salt['pillar.get']('global:fleet_ip', '') %}
# {%- set MANAGER = salt['pillar.get']('global:url_base', '') %}
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -19,6 +14,10 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
{%- set FLEET_MANAGER = salt['pillar.get']('global:fleet_manager', False) %}
{%- set FLEET_NODE = salt['pillar.get']('global:fleet_node', False) %}
{%- set FLEET_IP = salt['pillar.get']('global:fleet_ip', '') %}
{%- set MANAGER = salt['pillar.get']('global:url_base', '') %}
KIBANA_HOST={{ MANAGER }}
KSO_PORT=5601

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/usr/bin/env python3
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
#
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

View File

@@ -1,6 +1,6 @@
#!/bin/bash
# Copyright 2014-2022 Security Onion Solutions, LLC
# Copyright 2014-2023 Security Onion Solutions, LLC
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

Some files were not shown because too many files have changed in this diff Show More