securityonion

beats.common

…

common.nids

Remove host field from NIDS logs

2023-03-13 14:07:17 -04:00

dns.tld

…

ecs

…

filterlog

…

http.status

…

import.wel

Set values for '@timestamp' and 'event.ingested'

2023-01-31 08:04:49 -05:00

kratos

Set event.dataset for all Kratos logs to 'access' for now

2023-01-25 08:19:50 -05:00

logscan.alert

…

osquery.live_query

…

osquery.normalize

…

osquery.query_result

…

ossec

…

rita.beacon

Set RITA event.dataset value explicitly

2023-01-24 18:00:34 +00:00

rita.connection

Set RITA event.dataset value explicitly

2023-01-24 18:00:34 +00:00

rita.dns

Set RITA event.dataset value explicitly

2023-01-24 18:00:34 +00:00

strelka.file

…

suricata.alert

…

suricata.common

rename suricata vlan field to network.vlan.id

2023-03-05 05:57:52 -05:00

suricata.dhcp

Improve Suricata DHCP parsing and dashboard

2023-01-31 08:33:38 -05:00

suricata.dnp3

…

suricata.dns

…

suricata.fileinfo

…

suricata.flow

…

suricata.ftp

…

suricata.ftp_data

…

suricata.http

…

suricata.ikev2

…

suricata.krb5

…

suricata.nfs

…

suricata.rdp

…

suricata.sip

…

suricata.smb

…

suricata.smtp

…

suricata.snmp

…

suricata.ssh

…

suricata.tftp

…

suricata.tls

…

syslog

…

sysmon

…

win.eventlogs

…

zeek.bacnet

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bacnet_discovery

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bacnet_property

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_ip_header

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_ip_rdb

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_ip_unknown

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_header

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_rdb

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_rdb_ext

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.bsap_serial_unknown

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.cip

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.cip_identity

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.cip_io

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.common

…

zeek.common_ssl

…

zeek.conn

update Elasticsearch ingest for Zeek conn vlan field

2023-03-03 15:22:43 -05:00

zeek.cotp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dce_rpc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dhcp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dnp3

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dnp3_control

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dnp3_objects

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dns

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.dpd

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_aoe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_arp_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_coe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_dev_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_foe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_log_address

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_registers

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ecat_soe_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.enip

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.files

Change event.dataset value from 'files' to 'file'

2023-01-27 11:02:44 -05:00

zeek.ftp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.http

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.intel

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.irc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.kerberos

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus_detailed

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus_mask_write_register

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.modbus_read_write_multiple_registers

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.mysql

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.notice

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ntlm

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session_client_software_cert

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session_diagnostic_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_activate_session_locale_id

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_description

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_diagnostic_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_request_continuation_point

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_response_references

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_browse_result

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session_discovery

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session_endpoints

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_session_user_token

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_create_subscription

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_diag_info_detail

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_description

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_discovery

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_locale_id

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_profile_uri

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_get_endpoints_user_token

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_opensecure_channel

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_array_dims

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_array_dims_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_diagnostic_info

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_extension_object

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_extension_object_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_nodes_to_read

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_results

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_results_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_status_code

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_variant_data

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_read_variant_data_link

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.opcua_binary_status_code_detail

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.pe

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.profinet

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.profinet_dce_rpc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.radius

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.rdp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.rfb

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm_plus

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm_read_szl

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.s7comm_upload_download

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.signatures

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.sip

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.smb_files

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.smb_mapping

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.smtp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.snmp

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.socks

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.software

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ssh

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.ssl

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.stun

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.stun_nat

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.syslog

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tds

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tds_rpc

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tds_sql_batch

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tunnel

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.tunnels

Change event.dataset value from 'tunnels' to 'tunnel'

2023-01-27 11:03:49 -05:00

zeek.weird

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.wireguard

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00

zeek.x509

Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.

2023-01-23 21:44:46 +00:00