CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-05-31 23:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
ed87b08fc10d87508fe7317c00f84de4e2f3c302
securityonion/salt/elasticsearch/files/ingest
T
History
doug 07a4919cd3 remove old opcua files
2022-12-08 16:43:11 -05:00
..
beats.common
Support non-WEL Beats
2021-11-02 08:23:29 -04:00
common.nids
…
dns.tld
…
ecs
Add ECS testing pipeline
2021-11-08 20:08:56 +00:00
filterlog
FIX: Add event.category field to pfsense firewall logs #8112
2022-06-13 08:03:44 -04:00
http.status
…
import.wel
so-import-evtx - fix ingest formatting
2021-09-15 14:13:16 -04:00
kratos
Add ingest node pipeline for Kratos
2022-07-08 15:53:00 +00:00
logscan.alert
Only append source.ip to logscan.source.ips if it's been created
2021-08-02 09:50:49 -04:00
osquery.live_query
…
osquery.normalize
…
osquery.query_result
…
ossec
Fix Wazuh WEL Parsing
2022-01-10 13:55:38 -05:00
rita.beacon
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
rita.connection
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
rita.dns
Add RITA Elasticsearch ingest pipeline config
2022-03-22 17:38:22 +00:00
strelka.file
Replace staging path with processed path for analyzed files
2021-07-14 15:04:46 +00:00
suricata.alert
…
suricata.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
suricata.dhcp
…
suricata.dnp3
…
suricata.dns
…
suricata.fileinfo
Several Suricata things
2021-07-21 09:10:33 -04:00
suricata.flow
…
suricata.ftp
…
suricata.ftp_data
…
suricata.http
…
suricata.ikev2
…
suricata.krb5
…
suricata.nfs
…
suricata.rdp
…
suricata.sip
…
suricata.smb
…
suricata.smtp
…
suricata.snmp
…
suricata.ssh
…
suricata.tftp
…
suricata.tls
…
syslog
Update with changes from Abe's PR and other fixes
2022-03-25 13:57:44 -04:00
sysmon
sysmon fix by bryant
2022-09-19 14:47:45 -04:00
win.eventlogs
…
zeek.bacnet
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bacnet_discovery
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bacnet_property
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_ip_header
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_ip_rdb
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_ip_unknown
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_header
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_rdb
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_rdb_ext
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.bsap_serial_unknown
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cip
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cip_identity
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cip_io
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.common
Rename ingest.timestamp to event.ingested
2022-03-01 15:05:08 +00:00
zeek.common_ssl
…
zeek.conn
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.cotp
Add COTP and TDS ingest pipelines
2022-11-22 13:36:27 +00:00
zeek.dce_rpc
…
zeek.dhcp
…
zeek.dnp3
…
zeek.dnp3_control
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.dnp3_objects
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.dns
Avoid changing _index for imported logs
2022-02-26 10:36:09 -05:00
zeek.dpd
…
zeek.ecat_aoe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_arp_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_coe_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.ecat_dev_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.ecat_foe_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.ecat_log_address
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_registers
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.ecat_soe_info
Update ingest node pipelines for ICS/SCADA protocols
2022-11-16 21:11:21 +00:00
zeek.enip
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.files
…
zeek.ftp
…
zeek.http
…
zeek.intel
…
zeek.irc
…
zeek.kerberos
…
zeek.modbus
…
zeek.modbus_detailed
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.modbus_mask_write_register
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.modbus_read_write_multiple_registers
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.mysql
…
zeek.notice
…
zeek.ntlm
…
zeek.opcua_binary
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session_client_software_cert
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session_diagnostic_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_activate_session_locale_id
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_description
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_diagnostic_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_request_continuation_point
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_response_references
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_browse_result
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session_discovery
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session_endpoints
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_session_user_token
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_create_subscription
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_diag_info_detail
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_description
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_discovery
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_locale_id
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_profile_uri
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_get_endpoints_user_token
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_opensecure_channel
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_array_dims
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_array_dims_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_diagnostic_info
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_extension_object
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_extension_object_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_nodes_to_read
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_results
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_results_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_status_code
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_variant_data
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_read_variant_data_link
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.opcua_binary_status_code_detail
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.pe
…
zeek.profinet
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.profinet_dce_rpc
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.radius
…
zeek.rdp
…
zeek.rfb
…
zeek.s7comm
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.s7comm_plus
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.s7comm_read_szl
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.s7comm_upload_download
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.signatures
…
zeek.sip
…
zeek.smb_files
…
zeek.smb_mapping
…
zeek.smtp
…
zeek.snmp
…
zeek.socks
…
zeek.software
…
zeek.ssh
…
zeek.ssl
…
zeek.stun
Fix spelling for 'stun.class' field name
2022-11-22 12:07:15 -05:00
zeek.stun_nat
Add additional ICS/SCADA ingest node pipelines
2022-11-17 16:03:21 +00:00
zeek.syslog
Change to label fields to comply with what's defined in Filebeat template
2022-03-04 16:29:01 -05:00
zeek.tds
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.tds_rpc
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.tds_sql_batch
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.tunnel
…
zeek.tunnels
…
zeek.weird
…
zeek.wireguard
Ensure ICS/SCADA pipelines are present
2022-12-06 15:58:47 +00:00
zeek.x509
…