CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
securityonion/salt/elasticsearch/files/ingest
History
Doug Burks 272b345892 FIX: Suricata DNS A and CNAME parsing #10117
2023-04-13 10:52:37 -04:00
..
beats.common
Support non-WEL Beats
2021-11-02 08:23:29 -04:00
common.nids
Change rule_ruleset to rule.ruleset
2020-10-20 22:14:23 -04:00
dns.tld
Improve support for Suricata metadata #2200
2021-02-22 10:27:24 -05:00
ecs
Add ECS testing pipeline
2021-11-08 20:08:56 +00:00
filterlog
FIX: Add event.category field to pfsense firewall logs #8112
2022-06-13 08:03:44 -04:00
http.status
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
import.wel
so-import-evtx - fix ingest formatting
2021-09-15 14:13:16 -04:00
kratos
Add ingest node pipeline for Kratos
2022-07-08 15:53:00 +00:00
logscan.alert
Only append source.ip to logscan.source.ips if it's been created
2021-08-02 09:50:49 -04:00
osquery.live_query
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.normalize
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.query_result
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
ossec
Fix Wazuh WEL Parsing
2022-01-10 13:55:38 -05:00
rita.beacon
Update RITA beacon parsing
2023-01-03 16:01:35 +00:00
rita.connection
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
rita.dns
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
strelka.file
Replace staging path with processed path for analyzed files
2021-07-14 15:04:46 +00:00
suricata.alert
Update common.nids
2020-10-07 15:14:08 +00:00
suricata.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
suricata.dhcp
update Suricata DHCP parser to set server.address
2023-01-30 15:57:47 -05:00
suricata.dnp3
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.dns
FIX: Suricata DNS A and CNAME parsing #10117
2023-04-13 10:52:37 -04:00
suricata.fileinfo
Several Suricata things
2021-07-21 09:10:33 -04:00
suricata.flow
Suricata Conn
2020-06-15 21:46:04 -04:00
suricata.ftp
Improve support for Suricata metadata #2200
2021-02-22 13:00:14 -05:00
suricata.ftp_data
Add initial suricata.ftp_data pipeline
2020-12-10 14:14:50 +00:00
suricata.http
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
suricata.ikev2
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.krb5
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.nfs
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.rdp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.sip
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.smb
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.smtp
Fix Protocol
2020-06-12 12:28:29 -04:00
suricata.snmp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.ssh
Fix Protocol
2020-06-12 12:28:29 -04:00
suricata.tftp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.tls
Improve support for Suricata metadata #2200
2021-02-22 10:27:24 -05:00
syslog
Update with changes from Abe's PR and other fixes
2022-03-25 13:57:44 -04:00
sysmon
update sysmon parser
2022-12-30 16:20:06 -05:00
win.eventlogs
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
zeek.bacnet
Use native 'is_orig' since we are already using that field name for other logs
2022-11-29 21:21:41 +00:00
zeek.bacnet_discovery
Use native 'is_orig' since we are already using that field name for other logs
2022-11-29 21:21:41 +00:00
zeek.bacnet_property
Use native 'is_orig' since we are already using that field name for other logs
2022-11-29 21:21:41 +00:00
zeek.bsap_ip_header
fix more typos
2022-11-29 07:16:30 -05:00
zeek.bsap_ip_rdb
Various field renames
2022-11-29 21:32:05 +00:00
zeek.bsap_ip_unknown
fix more typos
2022-11-29 07:16:30 -05:00
zeek.bsap_serial_header
Change 'bsap.node.status.byte' to 'bsap.node.status_byte'
2022-11-30 13:01:30 -05:00
zeek.bsap_serial_rdb
fix more typos
2022-11-29 07:16:30 -05:00
zeek.bsap_serial_rdb_ext
Change 'bsap.node.status_byte' to 'bsap.node_status_byte'.
2022-11-30 15:24:53 +00:00
zeek.bsap_serial_unknown
fix more typos
2022-11-29 07:16:30 -05:00
zeek.cip
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.cip_identity
Various field renames
2022-11-29 21:32:05 +00:00
zeek.cip_io
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
zeek.common_ssl
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.conn
Check if connection.state is populated before trying to assess its value
2022-11-29 19:00:47 +00:00
zeek.cotp
Add COTP and TDS ingest pipelines
2022-11-22 13:35:19 +00:00
zeek.dce_rpc
update DCE/RPC parsing
2020-05-15 18:19:05 +00:00
zeek.dhcp
fix message_types one more time :)
2020-05-16 15:03:27 +00:00
zeek.dnp3
update ingest files
2020-04-05 20:40:00 +00:00
zeek.dnp3_control
Add Zeek dnp3_control ingest pipeline
2022-11-29 17:18:24 +00:00
zeek.dnp3_objects
Rename dnp3_objects to zeek.dnp3_objects
2022-10-21 12:56:35 -07:00
zeek.dns
Avoid changing _index for imported logs
2022-02-26 10:36:09 -05:00
zeek.dpd
modify pipelines
2020-03-14 12:03:32 +00:00
zeek.ecat_aoe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:09:30 +00:00
zeek.ecat_arp_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:09:30 +00:00
zeek.ecat_coe_info
Various field renames
2022-11-29 21:32:05 +00:00
zeek.ecat_dev_info
Various field renames
2022-11-29 21:32:05 +00:00
zeek.ecat_foe_info
More field updates
2022-11-30 15:22:02 +00:00
zeek.ecat_log_address
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:09:30 +00:00
zeek.ecat_registers
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:09:30 +00:00
zeek.ecat_soe_info
Add ecat, enip, cip, and opcua
2022-11-11 12:15:54 -08:00
zeek.enip
Use native 'is_orig' since we are already using that field name for other logs
2022-11-29 21:21:41 +00:00
zeek.files
remove duplicate line for message2.conn_uids
2020-07-09 06:44:08 -04:00
zeek.ftp
fix zeek.ftp description
2020-07-01 20:27:40 -04:00
zeek.http
Initial support - Ingest community_id
2020-05-21 14:34:00 -04:00
zeek.intel
Fix Elasticsearch parsing for Zeek Intel Indicator #1309
2020-09-10 06:41:19 -04:00
zeek.irc
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.kerberos
Addl krb fix
2020-06-30 03:06:01 +00:00
zeek.modbus
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.modbus_detailed
Various field renames
2022-11-29 21:32:05 +00:00
zeek.modbus_mask_write_register
Various field renames
2022-11-29 21:32:05 +00:00
zeek.modbus_read_write_multiple_registers
Various field renames
2022-11-29 21:32:05 +00:00
zeek.mysql
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.notice
Initial support - Ingest community_id
2020-05-21 14:34:00 -04:00
zeek.ntlm
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.opcua_binary
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.opcua_binary_activate_session
Add space per request
2022-11-29 14:14:08 -05:00
zeek.opcua_binary_activate_session_client_software_cert
Use native link_id naming scheme for now
2022-11-29 22:05:37 +00:00
zeek.opcua_binary_activate_session_diagnostic_info
Use native link_id naming scheme for now
2022-11-29 22:05:37 +00:00
zeek.opcua_binary_activate_session_locale_id
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_browse
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.opcua_binary_browse_description
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.opcua_binary_browse_diagnostic_info
Use native link_id naming scheme for now
2022-11-29 22:05:37 +00:00
zeek.opcua_binary_browse_request_continuation_point
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_browse_response_references
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_browse_result
Use native link_id naming scheme for now
2022-11-29 22:05:37 +00:00
zeek.opcua_binary_create_session
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.opcua_binary_create_session_discovery
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_create_session_endpoints
Add space per request
2022-11-29 14:14:37 -05:00
zeek.opcua_binary_create_session_user_token
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.opcua_binary_create_subscription
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_diag_info_detail
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_get_endpoints
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_get_endpoints_description
Add space per request
2022-11-29 14:12:52 -05:00
zeek.opcua_binary_get_endpoints_discovery
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_get_endpoints_locale_id
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_get_endpoints_profile_uri
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_get_endpoints_user_token
Additional field renames and updates
2022-11-30 15:01:41 +00:00
zeek.opcua_binary_opensecure_channel
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_read
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_read_array_dims
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_array_dims_link
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_diagnostic_info
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_extension_object
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_extension_object_link
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_nodes_to_read
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_results
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.opcua_binary_read_results_link
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_status_code
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_variant_data
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_read_variant_data_link
add more zeek opcua parsers
2022-11-26 17:43:58 -05:00
zeek.opcua_binary_status_code_detail
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.pe
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.profinet
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:16:33 +00:00
zeek.profinet_dce_rpc
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:16:33 +00:00
zeek.radius
fix framed_addr field
2020-05-29 11:55:18 +00:00
zeek.rdp
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.rfb
update ingest files
2020-04-05 20:40:00 +00:00
zeek.s7comm
update zeek s7comm parsers
2022-11-29 07:50:21 -05:00
zeek.s7comm_plus
update zeek s7comm parsers
2022-11-29 07:50:21 -05:00
zeek.s7comm_read_szl
add more zeek ics parsers
2022-11-26 10:36:49 -05:00
zeek.s7comm_upload_download
Add Zeek s7comm_upload_download ingest pipeline
2022-11-29 19:45:56 +00:00
zeek.signatures
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.sip
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.smb_files
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.smb_mapping
fix zeek.smb_mapping description
2020-07-01 20:26:51 -04:00
zeek.smtp
Initial support - Ingest community_id
2020-05-21 14:34:00 -04:00
zeek.snmp
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.socks
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.software
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.ssh
fix zeek.ssh description
2020-07-01 20:26:06 -04:00
zeek.ssl
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.stun
Fix spelling for 'stun.class' field name
2022-11-22 12:04:07 -05:00
zeek.stun_nat
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:16:33 +00:00
zeek.syslog
Change to label fields to comply with what's defined in Filebeat template
2022-03-04 16:29:01 -05:00
zeek.tds
update zeek tds parsers and dashboard
2022-11-29 07:43:20 -05:00
zeek.tds_rpc
update zeek tds parsers and dashboard
2022-11-29 07:43:20 -05:00
zeek.tds_sql_batch
update zeek tds parsers and dashboard
2022-11-29 07:43:20 -05:00
zeek.tunnel
modify pipelines
2020-03-14 12:03:32 +00:00
zeek.tunnels
Let zeek.common handle common fields for zeek.tunnels
2020-10-06 20:12:23 +00:00
zeek.weird
Add message rename
2020-04-01 11:31:57 -04:00
zeek.wireguard
update zeek s7comm parsers
2022-11-29 07:50:21 -05:00
zeek.x509
rename id to log.id.fuid for X509
2020-06-15 16:55:14 +00:00