securityonion

beats.common

Support non-WEL Beats

2021-11-02 08:23:29 -04:00

common.nids

FIX: Update NIDS rule.reference in common.nids pipeline #11846

2023-11-29 09:46:11 -05:00

dns.tld

Improve support for Suricata metadata #2200

2021-02-22 10:27:24 -05:00

ecs

Add ECS testing pipeline

2021-11-08 20:08:56 +00:00

filterlog

FIX: Update dashboard and hunt query for firewall logs #12021

2023-12-18 12:57:40 -05:00

global@custom

must use null check

2025-02-18 11:16:57 -06:00

http.status

FIX: Populate http.status_message field #3408

2021-03-11 16:42:20 -05:00

hydra

connect work

2024-10-16 13:44:01 -04:00

import.wel

Set values for '@timestamp' and 'event.ingested'

2023-01-31 08:04:49 -05:00

kismet.ad_hoc

Update ingest pipelines to match updated mappings

2024-04-10 16:13:06 -04:00

kismet.ap

Fix typo in ingest pipeline

2024-04-11 11:18:04 -04:00

kismet.bridged

Update ingest pipelines to match updated mappings

2024-04-10 16:13:06 -04:00

kismet.client

Update ingest pipelines to match updated mappings

2024-04-10 16:13:06 -04:00

kismet.common

Fix typo in ingest pipeline

2024-04-11 11:18:04 -04:00

kismet.device

Kismet integration: TODO Elasticsearch mappings

2024-03-29 13:56:01 -04:00

kismet.seenby

Kismet integration: TODO Elasticsearch mappings

2024-03-29 13:56:01 -04:00

kismet.wds

Kismet integration: TODO Elasticsearch mappings

2024-03-29 13:56:01 -04:00

kismet.wds_ap

Update ingest pipelines to match updated mappings

2024-04-10 16:13:06 -04:00

kratos

Fix Kratos parsing

2023-03-20 16:53:25 -04:00

logs-pfsense.log-1.20.2

pfsense integration - keep suricata events

2025-02-17 12:28:23 -06:00

logs-pfsense.log-1.20.2-suricata

update pfsense pipeline version. Remove unused component templates

2025-02-12 16:33:56 -06:00

logscan.alert

Only append source.ip to logscan.source.ips if it's been created

2021-08-02 09:50:49 -04:00

osquery.live_query

Initial support for Live Queries in Hunt

2021-03-04 18:21:13 -05:00

osquery.normalize

Initial support for Live Queries in Hunt

2021-03-04 18:21:13 -05:00

osquery.query_result

Differentiate between event & ingest timestamp

2021-04-13 12:55:40 -04:00

ossec

Fix Wazuh WEL Parsing

2022-01-10 13:55:38 -05:00

rita.beacons

Rename RITA pipelines

2024-01-22 20:15:48 +00:00

rita.connections

Rename RITA pipelines

2024-01-22 20:15:48 +00:00

rita.dns

Set RITA event.dataset value explicitly

2023-01-24 18:00:34 +00:00

strelka.file

Fix strelka rule.uuid

2024-05-23 05:59:31 -04:00

sublime

Add Sublime Platform ingest pipeline

2023-11-01 13:34:30 +00:00

suricata.alert

use so-elasticsearch-query where possible; simplify suricata.alerts index reroute

2025-01-17 13:29:46 -06:00

suricata.alert_pfsense

Fix suricata alerts for opnsense and pfsense

2024-09-17 19:24:31 +00:00

suricata.common

Add pfsense Suricata config

2024-03-21 20:07:59 +00:00

suricata.common_pfsense

Fix suricata alerts for opnsense and pfsense

2024-09-17 19:24:31 +00:00

suricata.dhcp

FIX: Suricata DHCP logs not ingesting #10565

2023-06-10 11:42:41 -04:00

suricata.dnp3

Add mor suricata ingest parser types

2020-06-02 14:34:38 -04:00

suricata.dns

FIX: Suricata DNS A and CNAME parsing #10117

2023-04-13 10:56:17 -04:00

suricata.fileinfo

change suricata parsers from dataset to event.dataset

2023-06-08 12:31:31 -04:00

suricata.flow

change suricata parsers from dataset to event.dataset

2023-06-08 12:31:31 -04:00

suricata.ftp

Improve support for Suricata metadata #2200

2021-02-22 13:00:14 -05:00

suricata.ftp_data

Add initial suricata.ftp_data pipeline

2020-12-10 14:14:50 +00:00

suricata.http

FIX: Populate http.status_message field #3408

2021-03-11 16:42:20 -05:00

suricata.ike

Change description

2024-01-17 14:06:16 +00:00

suricata.krb5

change suricata parsers from dataset to event.dataset

2023-06-08 12:31:31 -04:00

suricata.nfs

Add mor suricata ingest parser types

2020-06-02 14:34:38 -04:00

suricata.rdp

Pull in Suricata changes

2021-02-19 11:01:15 -05:00

suricata.sip

Add mor suricata ingest parser types

2020-06-02 14:34:38 -04:00

suricata.smb

Pull in Suricata changes

2021-02-19 11:01:15 -05:00

suricata.smtp

Fix Protocol

2020-06-12 12:28:29 -04:00

suricata.snmp

Pull in Suricata changes

2021-02-19 11:01:15 -05:00

suricata.ssh

Fix Protocol

2020-06-12 12:28:29 -04:00

suricata.tftp

Pull in Suricata changes

2021-02-19 11:01:15 -05:00

suricata.tls

change suricata parsers from dataset to event.dataset

2023-06-08 12:31:31 -04:00

syslog

Update with changes from Abe's PR and other fixes

2022-03-25 13:57:44 -04:00

sysmon

update sysmon ingest parser and Sysmon File dashboard

2023-01-03 09:02:17 -05:00

win.eventlogs

Differentiate between event & ingest timestamp

2021-04-13 12:55:40 -04:00

zeek.bacnet

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bacnet_discovery

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bacnet_property

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_ip_header

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_ip_rdb

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_ip_unknown

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_header

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_rdb

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_rdb_ext

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_unknown

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.cip

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.cip_identity

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.cip_io

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.common

add openvpn & ipsec support to Zeek

2024-12-05 09:52:55 -06:00

zeek.common_ssl

upadte ingest config

2020-03-11 12:13:53 +00:00

zeek.conn

fix error due to null reference

2024-12-06 09:07:16 -06:00

zeek.cotp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dce_rpc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dhcp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dnp3

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dnp3_control

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dnp3_objects

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dns

Check if 'dns.query' is null

2023-05-19 15:50:33 -04:00

zeek.dpd

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_aoe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_arp_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_coe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_dev_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_foe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_log_address

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_registers

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_soe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.enip

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.files

change suricata parsers from dataset to event.dataset

2023-06-08 12:31:31 -04:00

zeek.ftp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.http

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.http2

zeek http2

2024-11-14 09:09:23 -06:00

zeek.intel

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ipsec

add openvpn & ipsec support to Zeek

2024-12-05 09:52:55 -06:00

zeek.irc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.kerberos

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ldap

zeek ldap & ldap_search parsing

2025-01-09 16:06:10 -06:00

zeek.ldap_search

zeek ldap & ldap_search parsing

2025-01-09 16:06:10 -06:00

zeek.modbus

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus_detailed

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus_mask_write_register

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus_read_write_multiple_registers

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.mysql

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.notice

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ntlm

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session_client_software_cert

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session_diagnostic_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session_locale_id

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_description

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_diagnostic_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_request_continuation_point

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_response_references

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_result

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session_discovery

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session_endpoints

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session_user_token

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_subscription

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_diag_info_detail

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_description

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_discovery

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_locale_id

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_profile_uri

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_user_token

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_opensecure_channel

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_array_dims

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_array_dims_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_diagnostic_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_extension_object

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_extension_object_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_nodes_to_read

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_results

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_results_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_status_code

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_variant_data

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_variant_data_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_status_code_detail

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.pe

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.profinet

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.profinet_dce_rpc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.quic

Zeek QUIC support

2024-12-31 13:44:20 -06:00

zeek.radius

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.rdp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.rfb

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm_plus

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm_read_szl

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm_upload_download

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.signatures

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.sip

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.smb_files

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.smb_mapping

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.smtp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.snmp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.socks

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.software

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ssh

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ssl

Client and server fingerprints

2023-11-29 12:00:46 -05:00

zeek.stun

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.stun_nat

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.syslog

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tds

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tds_rpc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tds_sql_batch

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tunnel

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tunnels

Change event.dataset value from 'tunnels' to 'tunnel'

2023-01-27 11:03:49 -05:00

zeek.weird

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.wireguard

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.x509

Certificate hash

2023-11-29 12:01:43 -05:00