CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
c354924b6853a88050f58bd9babddbbfa7ef2b7d
securityonion/salt/elasticsearch/files/ingest
History
weslambert 660020cc76 Parse pkt_src for Suricata logs
2023-10-23 15:45:41 -04:00
..
.fleet_final_pipeline-1
Use event.created for timestamp
2023-09-19 13:32:03 +00:00
beats.common
Support non-WEL Beats
2021-11-02 08:23:29 -04:00
common.nids
Remove host field from NIDS logs
2023-03-13 14:07:17 -04:00
dns.tld
Improve support for Suricata metadata #2200
2021-02-22 10:27:24 -05:00
ecs
Add ECS testing pipeline
2021-11-08 20:08:56 +00:00
filterlog
Add event
2023-08-02 13:25:44 -04:00
http.status
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
import.wel
Set values for '@timestamp' and 'event.ingested'
2023-01-31 08:04:49 -05:00
kratos
Fix Kratos parsing
2023-03-20 16:53:25 -04:00
logscan.alert
Only append source.ip to logscan.source.ips if it's been created
2021-08-02 09:50:49 -04:00
osquery.live_query
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.normalize
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.query_result
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
ossec
Fix Wazuh WEL Parsing
2022-01-10 13:55:38 -05:00
rita.beacon
Set RITA event.dataset value explicitly
2023-01-24 18:00:34 +00:00
rita.connection
Set RITA event.dataset value explicitly
2023-01-24 18:00:34 +00:00
rita.dns
Set RITA event.dataset value explicitly
2023-01-24 18:00:34 +00:00
strelka.file
Change entropy value syntax
2023-08-31 15:09:19 +00:00
suricata.alert
Suricata Elasticsearch ingest node pipeline changes - set 'alert' dataset
2023-01-11 14:02:09 +00:00
suricata.common
Parse pkt_src for Suricata logs
2023-10-23 15:45:41 -04:00
suricata.dhcp
FIX: Suricata DHCP logs not ingesting #10565
2023-06-10 11:42:41 -04:00
suricata.dnp3
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.dns
FIX: Suricata DNS A and CNAME parsing #10117
2023-04-13 10:56:17 -04:00
suricata.fileinfo
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
suricata.flow
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
suricata.ftp
Improve support for Suricata metadata #2200
2021-02-22 13:00:14 -05:00
suricata.ftp_data
Add initial suricata.ftp_data pipeline
2020-12-10 14:14:50 +00:00
suricata.http
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
suricata.ikev2
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.krb5
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
suricata.nfs
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.rdp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.sip
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.smb
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.smtp
Fix Protocol
2020-06-12 12:28:29 -04:00
suricata.snmp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.ssh
Fix Protocol
2020-06-12 12:28:29 -04:00
suricata.tftp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.tls
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
syslog
Update with changes from Abe's PR and other fixes
2022-03-25 13:57:44 -04:00
sysmon
update sysmon ingest parser and Sysmon File dashboard
2023-01-03 09:02:17 -05:00
win.eventlogs
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
zeek.bacnet
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bacnet_discovery
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bacnet_property
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_ip_header
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_ip_rdb
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_ip_unknown
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_header
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_rdb
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_rdb_ext
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_unknown
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.cip
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.cip_identity
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.cip_io
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
zeek.common_ssl
upadte ingest config
2020-03-11 12:13:53 +00:00
zeek.conn
update Elasticsearch ingest for Zeek conn vlan field
2023-03-03 15:22:43 -05:00
zeek.cotp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dce_rpc
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dhcp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dnp3
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dnp3_control
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dnp3_objects
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dns
Check if 'dns.query' is null
2023-05-19 15:50:33 -04:00
zeek.dpd
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_aoe_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_arp_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_coe_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_dev_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_foe_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_log_address
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_registers
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_soe_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.enip
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.files
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
zeek.ftp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.http
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.intel
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.irc
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.kerberos
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.modbus
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.modbus_detailed
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.modbus_mask_write_register
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.modbus_read_write_multiple_registers
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.mysql
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.notice
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ntlm
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_activate_session
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_activate_session_client_software_cert
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_activate_session_diagnostic_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_activate_session_locale_id
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_browse
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_browse_description
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_browse_diagnostic_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_browse_request_continuation_point
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_browse_response_references
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_browse_result
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_create_session
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_create_session_discovery
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_create_session_endpoints
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_create_session_user_token
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_create_subscription
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_diag_info_detail
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_get_endpoints
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_get_endpoints_description
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_get_endpoints_discovery
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_get_endpoints_locale_id
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_get_endpoints_profile_uri
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_get_endpoints_user_token
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_opensecure_channel
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_array_dims
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_array_dims_link
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_diagnostic_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_extension_object
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_extension_object_link
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_nodes_to_read
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_results
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_results_link
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_status_code
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_variant_data
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_variant_data_link
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_status_code_detail
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.pe
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.profinet
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.profinet_dce_rpc
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.radius
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.rdp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.rfb
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.s7comm
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.s7comm_plus
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.s7comm_read_szl
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.s7comm_upload_download
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.signatures
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.sip
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.smb_files
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.smb_mapping
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.smtp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.snmp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.socks
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.software
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ssh
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ssl
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.stun
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.stun_nat
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.syslog
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tds
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tds_rpc
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tds_sql_batch
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tunnel
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tunnels
Change event.dataset value from 'tunnels' to 'tunnel'
2023-01-27 11:03:49 -05:00
zeek.weird
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.wireguard
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.x509
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00