CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-13 20:52:54 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
c1dfb9f9352816ed9fb86d70c2c11e5f8af8e8b6
securityonion/salt/elasticsearch/files/ingest
History
Wes c8ff2c7a06 Update RITA beacon parsing
2023-01-03 16:03:49 +00:00
..
beats.common
…
common.nids
…
dns.tld
…
ecs
…
filterlog
FIX: Add event.category field to pfsense firewall logs #8112
2022-06-13 08:03:44 -04:00
http.status
…
import.wel
…
kratos
Add ingest node pipeline for Kratos
2022-07-08 15:53:00 +00:00
logscan.alert
…
osquery.live_query
…
osquery.normalize
…
osquery.query_result
…
ossec
Fix Wazuh WEL Parsing
2022-01-10 13:55:38 -05:00
rita.beacon
Update RITA beacon parsing
2023-01-03 16:03:49 +00:00
rita.connection
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
rita.dns
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
strelka.file
…
suricata.alert
…
suricata.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
suricata.dhcp
…
suricata.dnp3
…
suricata.dns
…
suricata.fileinfo
…
suricata.flow
…
suricata.ftp
…
suricata.ftp_data
…
suricata.http
…
suricata.ikev2
…
suricata.krb5
…
suricata.nfs
…
suricata.rdp
…
suricata.sip
…
suricata.smb
…
suricata.smtp
…
suricata.snmp
…
suricata.ssh
…
suricata.tftp
…
suricata.tls
…
syslog
Update with changes from Abe's PR and other fixes
2022-03-25 13:57:44 -04:00
sysmon
update sysmon ingest parser and Sysmon File dashboard
2023-01-03 09:02:17 -05:00
win.eventlogs
…
zeek.bacnet
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bacnet_discovery
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bacnet_property
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_ip_header
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_ip_rdb
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_ip_unknown
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_header
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_rdb
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_rdb_ext
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_unknown
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cip
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cip_identity
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cip_io
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
zeek.common_ssl
…
zeek.conn
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cotp
Add COTP and TDS ingest pipelines
2022-11-22 13:36:27 +00:00
zeek.dce_rpc
…
zeek.dhcp
…
zeek.dnp3
…
zeek.dnp3_control
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.dnp3_objects
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.dns
Avoid changing _index for imported logs
2022-02-26 10:36:09 -05:00
zeek.dpd
…
zeek.ecat_aoe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_arp_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_coe_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.ecat_dev_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.ecat_foe_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.ecat_log_address
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_registers
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_soe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.enip
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.files
…
zeek.ftp
…
zeek.http
…
zeek.intel
…
zeek.irc
…
zeek.kerberos
…
zeek.modbus
…
zeek.modbus_detailed
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.modbus_mask_write_register
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.modbus_read_write_multiple_registers
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.mysql
…
zeek.notice
…
zeek.ntlm
…
zeek.opcua_binary
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session_client_software_cert
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session_diagnostic_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session_locale_id
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_description
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_diagnostic_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_request_continuation_point
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_response_references
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_result
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session_discovery
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session_endpoints
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session_user_token
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_subscription
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_diag_info_detail
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_description
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_discovery
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_locale_id
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_profile_uri
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_user_token
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_opensecure_channel
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_array_dims
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_array_dims_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_diagnostic_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_extension_object
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_extension_object_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_nodes_to_read
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_results
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_results_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_status_code
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_variant_data
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_variant_data_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_status_code_detail
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.pe
…
zeek.profinet
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.profinet_dce_rpc
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.radius
…
zeek.rdp
…
zeek.rfb
…
zeek.s7comm
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.s7comm_plus
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.s7comm_read_szl
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.s7comm_upload_download
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.signatures
…
zeek.sip
…
zeek.smb_files
…
zeek.smb_mapping
…
zeek.smtp
…
zeek.snmp
…
zeek.socks
…
zeek.software
…
zeek.ssh
…
zeek.ssl
…
zeek.stun
Fix spelling for 'stun.class' field name
2022-11-22 12:07:15 -05:00
zeek.stun_nat
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.syslog
Change to label fields to comply with what's defined in Filebeat template
2022-03-04 16:29:01 -05:00
zeek.tds
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.tds_rpc
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.tds_sql_batch
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.tunnel
…
zeek.tunnels
…
zeek.weird
…
zeek.wireguard
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.x509
…