CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-08 18:22:47 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
d2bc1a5523de9665145f372efa9219a116a3029d
securityonion/salt/elasticsearch/files/ingest
History
Wes 05b9a067fd Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
..
beats.common
Support non-WEL Beats
2021-11-02 08:23:29 -04:00
common.nids
Change rule_ruleset to rule.ruleset
2020-10-20 22:14:23 -04:00
dns.tld
Improve support for Suricata metadata #2200
2021-02-22 10:27:24 -05:00
ecs
Add ECS testing pipeline
2021-11-08 20:08:56 +00:00
filterlog
FIX: Add event.category field to pfsense firewall logs #8112
2022-06-13 08:03:44 -04:00
http.status
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
import.wel
so-import-evtx - fix ingest formatting
2021-09-15 14:13:16 -04:00
kratos
Add ingest node pipeline for Kratos
2022-07-08 15:53:00 +00:00
logscan.alert
Only append source.ip to logscan.source.ips if it's been created
2021-08-02 09:50:49 -04:00
osquery.live_query
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.normalize
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.query_result
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
ossec
Fix Wazuh WEL Parsing
2022-01-10 13:55:38 -05:00
rita.beacon
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
rita.connection
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
rita.dns
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
strelka.file
Replace staging path with processed path for analyzed files
2021-07-14 15:04:46 +00:00
suricata.alert
Update common.nids
2020-10-07 15:14:08 +00:00
suricata.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
suricata.dhcp
FIX: Improve Suricata DHCP logging and parsing #3397
2021-03-11 11:01:51 -05:00
suricata.dnp3
…
suricata.dns
FIX: Suricata dns.response.code needs to be renamed to dns.response.code_name #4770
2021-07-12 13:24:21 -04:00
suricata.fileinfo
Several Suricata things
2021-07-21 09:10:33 -04:00
suricata.flow
…
suricata.ftp
Improve support for Suricata metadata #2200
2021-02-22 13:00:14 -05:00
suricata.ftp_data
Add initial suricata.ftp_data pipeline
2020-12-10 14:14:50 +00:00
suricata.http
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
suricata.ikev2
…
suricata.krb5
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.nfs
…
suricata.rdp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.sip
…
suricata.smb
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.smtp
…
suricata.snmp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.ssh
…
suricata.tftp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.tls
Improve support for Suricata metadata #2200
2021-02-22 10:27:24 -05:00
syslog
Update with changes from Abe's PR and other fixes
2022-03-25 13:57:44 -04:00
sysmon
sysmon fix by bryant
2022-09-19 14:47:45 -04:00
win.eventlogs
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
zeek.bacnet
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bacnet_discovery
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bacnet_property
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_ip_header
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_ip_rdb
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_ip_unknown
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_serial_header
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_serial_rdb
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_serial_rdb_ext
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.bsap_serial_unknown
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.cip
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.cip_identity
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.cip_io
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
zeek.common_ssl
…
zeek.conn
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.dce_rpc
…
zeek.dhcp
…
zeek.dnp3
…
zeek.dnp3_objects
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.dns
Avoid changing _index for imported logs
2022-02-26 10:36:09 -05:00
zeek.dpd
…
zeek.ecat_aoe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_arp_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_coe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_dev_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_foe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_log_address
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_registers
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_soe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.enip
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.files
…
zeek.ftp
…
zeek.http
…
zeek.intel
Fix Elasticsearch parsing for Zeek Intel Indicator #1309
2020-09-10 06:41:19 -04:00
zeek.irc
…
zeek.kerberos
…
zeek.modbus
…
zeek.modbus_detailed
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.modbus_mask_write_register
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.modbus_read_write_multiple_registers
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.mysql
…
zeek.notice
…
zeek.ntlm
…
zeek.opcua
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_activate_session
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_browse
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_browse_description
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_browse_response_references
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_browse_result
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_create_session
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_create_session_endpoints
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_create_session_user_token
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_create_subscription
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_get_endpoints
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_get_endpoints_description
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_get_endpoints_user_token
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_opensecure_channel
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_read
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_read_nodes_to_read
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_read_results
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_read_results_link
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.opcua_status_code_detail
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.pe
…
zeek.profinet
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.profinet_dce_rpc
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.radius
…
zeek.rdp
…
zeek.rfb
…
zeek.s7comm
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.s7comm_plus
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.signatures
…
zeek.sip
…
zeek.smb_files
…
zeek.smb_mapping
…
zeek.smtp
…
zeek.snmp
…
zeek.socks
…
zeek.software
…
zeek.ssh
…
zeek.ssl
…
zeek.stun
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.stun_nat
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.syslog
Change to label fields to comply with what's defined in Filebeat template
2022-03-04 16:29:01 -05:00
zeek.tunnel
…
zeek.tunnels
Let zeek.common handle common fields for zeek.tunnels
2020-10-06 20:12:23 +00:00
zeek.weird
…
zeek.wireguard
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.x509
…