CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-13 20:52:54 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
f6301bc3e51e47b9c028cba11169218ff122fa01
securityonion/salt/elasticsearch/files/ingest
History
reyesj2 6f42ff3442 suricata capture_file
2025-11-20 14:16:49 -06:00
..
beats.common
…
common.ip_validation
zeek dns.resolved_ip
2025-08-19 11:20:59 -05:00
common.nids
FIX: Update NIDS rule.reference in common.nids pipeline #11846
2023-11-29 09:46:11 -05:00
dns.tld
Improve support for Suricata metadata #2200
2021-02-22 10:27:24 -05:00
ecs
Add ECS testing pipeline
2021-11-08 20:08:56 +00:00
elasticagent.monitor
custom kquery
2025-09-04 15:37:28 -05:00
filterlog
…
global@custom
add event.module to elasticsearch server logs
2025-10-14 12:44:51 -05:00
http.status
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
hydra
…
kismet.ad_hoc
Update ingest pipelines to match updated mappings
2024-04-10 16:13:06 -04:00
kismet.ap
…
kismet.bridged
…
kismet.client
…
kismet.common
…
kismet.device
…
kismet.seenby
…
kismet.wds
…
kismet.wds_ap
…
kratos
…
logs-pfsense.log-1.23.1
es 8.18.6 pipeline upd
2025-08-28 19:45:17 -05:00
logs-pfsense.log-1.23.1-suricata
…
logscan.alert
Only append source.ip to logscan.source.ips if it's been created
2021-08-02 09:50:49 -04:00
osquery.live_query
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.normalize
Initial support for Live Queries in Hunt
2021-03-04 18:21:13 -05:00
osquery.query_result
Differentiate between event & ingest timestamp
2021-04-13 12:55:40 -04:00
ossec
Fix Wazuh WEL Parsing
2022-01-10 13:55:38 -05:00
rita.beacons
…
rita.connections
…
rita.dns
…
strelka.file
…
sublime
Add Sublime Platform ingest pipeline
2023-11-01 13:34:30 +00:00
suricata.alert
don't attempt rename if field doesn't exist -- reducing pipeline stat errors
2025-11-14 08:15:40 -06:00
suricata.alert_pfsense
…
suricata.common
suricata capture_file
2025-11-20 14:16:49 -06:00
suricata.common_pfsense
Fix suricata alerts for opnsense and pfsense
2024-09-17 19:24:31 +00:00
suricata.dhcp
FIX: Suricata DHCP logs not ingesting #10565
2023-06-10 11:42:41 -04:00
suricata.dnp3
…
suricata.dns
suricata 8 dns v3
2025-11-13 19:21:31 -06:00
suricata.dnsv3
…
suricata.fileinfo
…
suricata.flow
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
suricata.ftp
Improve support for Suricata metadata #2200
2021-02-22 13:00:14 -05:00
suricata.ftp_data
Add initial suricata.ftp_data pipeline
2020-12-10 14:14:50 +00:00
suricata.http
FIX: Populate http.status_message field #3408
2021-03-11 16:42:20 -05:00
suricata.ike
Change description
2024-01-17 14:06:16 +00:00
suricata.krb5
…
suricata.nfs
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.rdp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.sip
Add mor suricata ingest parser types
2020-06-02 14:34:38 -04:00
suricata.smb
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.smtp
Fix Protocol
2020-06-12 12:28:29 -04:00
suricata.snmp
Pull in Suricata changes
2021-02-19 11:01:15 -05:00
suricata.ssh
Fix Protocol
2020-06-12 12:28:29 -04:00
suricata.tftp
…
suricata.tld
ignore errors on tld script
2025-11-14 09:25:19 -06:00
suricata.tls
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
syslog
Update with changes from Abe's PR and other fixes
2022-03-25 13:57:44 -04:00
sysmon
update sysmon ingest parser and Sysmon File dashboard
2023-01-03 09:02:17 -05:00
win.eventlogs
…
zeek.analyzer
…
zeek.bacnet
…
zeek.bacnet_discovery
…
zeek.bacnet_property
…
zeek.bsap_ip_header
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_ip_rdb
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_ip_unknown
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_header
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_rdb
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.bsap_serial_rdb_ext
…
zeek.bsap_serial_unknown
…
zeek.cip
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.cip_identity
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.cip_io
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.common
…
zeek.common_ssl
…
zeek.conn
ja4 ignore empty strings
2025-07-17 10:47:00 -05:00
zeek.cotp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dce_rpc
…
zeek.dhcp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dnp3
…
zeek.dnp3_control
…
zeek.dnp3_objects
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.dns
…
zeek.ecat_aoe_info
…
zeek.ecat_arp_info
…
zeek.ecat_coe_info
…
zeek.ecat_dev_info
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ecat_foe_info
…
zeek.ecat_log_address
…
zeek.ecat_registers
…
zeek.ecat_soe_info
…
zeek.enip
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.files
change suricata parsers from dataset to event.dataset
2023-06-08 12:31:31 -04:00
zeek.ftp
…
zeek.http
ja4 ignore empty strings
2025-07-17 10:47:00 -05:00
zeek.http2
ja4 ignore empty strings
2025-07-17 10:47:00 -05:00
zeek.intel
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ipsec
…
zeek.irc
…
zeek.ja4ssh
ja4 ignore empty strings
2025-07-17 10:47:00 -05:00
zeek.kerberos
…
zeek.ldap
zeek ldap & ldap_search parsing
2025-01-09 16:06:10 -06:00
zeek.ldap_search
ldap_search include observer.name
2025-03-18 08:52:43 -05:00
zeek.modbus
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.modbus_detailed
…
zeek.modbus_mask_write_register
…
zeek.modbus_read_write_multiple_registers
…
zeek.mysql
…
zeek.notice
…
zeek.ntlm
…
zeek.ntp
…
zeek.opcua_binary
…
zeek.opcua_binary_activate_session
…
zeek.opcua_binary_activate_session_client_software_cert
…
zeek.opcua_binary_activate_session_diagnostic_info
…
zeek.opcua_binary_activate_session_locale_id
…
zeek.opcua_binary_browse
…
zeek.opcua_binary_browse_description
…
zeek.opcua_binary_browse_diagnostic_info
…
zeek.opcua_binary_browse_request_continuation_point
…
zeek.opcua_binary_browse_response_references
…
zeek.opcua_binary_browse_result
…
zeek.opcua_binary_create_session
…
zeek.opcua_binary_create_session_discovery
…
zeek.opcua_binary_create_session_endpoints
…
zeek.opcua_binary_create_session_user_token
…
zeek.opcua_binary_create_subscription
…
zeek.opcua_binary_diag_info_detail
…
zeek.opcua_binary_get_endpoints
…
zeek.opcua_binary_get_endpoints_description
…
zeek.opcua_binary_get_endpoints_discovery
…
zeek.opcua_binary_get_endpoints_locale_id
…
zeek.opcua_binary_get_endpoints_profile_uri
…
zeek.opcua_binary_get_endpoints_user_token
…
zeek.opcua_binary_opensecure_channel
…
zeek.opcua_binary_read
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.opcua_binary_read_array_dims
…
zeek.opcua_binary_read_array_dims_link
…
zeek.opcua_binary_read_diagnostic_info
…
zeek.opcua_binary_read_extension_object
…
zeek.opcua_binary_read_extension_object_link
…
zeek.opcua_binary_read_nodes_to_read
…
zeek.opcua_binary_read_results
…
zeek.opcua_binary_read_results_link
…
zeek.opcua_binary_read_status_code
…
zeek.opcua_binary_read_variant_data
…
zeek.opcua_binary_read_variant_data_link
…
zeek.opcua_binary_status_code_detail
…
zeek.pe
…
zeek.profinet
…
zeek.profinet_dce_rpc
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.quic
…
zeek.radius
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.rdp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.rfb
…
zeek.s7comm
…
zeek.s7comm_plus
…
zeek.s7comm_read_szl
…
zeek.s7comm_upload_download
…
zeek.signatures
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.sip
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.smb_files
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.smb_mapping
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.smtp
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.snmp
…
zeek.socks
…
zeek.software
zeek.software typo
2025-02-07 15:19:40 -06:00
zeek.ssh
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.ssl
…
zeek.stun
…
zeek.stun_nat
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.syslog
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tds
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tds_rpc
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tds_sql_batch
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.traceroute
…
zeek.tunnel
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.tunnels
…
zeek.weird
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.wireguard
Update Import and Zeek integration policies; also update Zeek ingest node pipelines to set event.dataset.
2023-01-23 21:44:46 +00:00
zeek.x509
ja4 ignore empty strings
2025-07-17 10:47:00 -05:00