Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

2.4.80 #569

Merged
merged 97 commits into from
Jun 25, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
97 commits
Select commit Hold shift + click to select a range
3b5c951
Detection Templates
coreyogburn May 30, 2024
3a861d0
Merge pull request #530 from Security-Onion-Solutions/cogburn/detecti…
coreyogburn May 31, 2024
e41f8e5
GetAll now uses Options for it's Options
coreyogburn May 28, 2024
ab1fa7d
Tests for the options
coreyogburn May 31, 2024
52c1d58
Merge pull request #528 from Security-Onion-Solutions/cogburn/get-all…
coreyogburn May 31, 2024
0151c9e
Updated go-git
coreyogburn May 31, 2024
0a2f5eb
Merge pull request #532 from Security-Onion-Solutions/cogburn/circl-v…
coreyogburn May 31, 2024
35552b7
dateAwareSort for v-data-tables
coreyogburn May 29, 2024
e629790
Merge pull request #529 from Security-Onion-Solutions/cogburn/date-aw…
coreyogburn May 31, 2024
9b5fbaa
gmd work
jertel May 31, 2024
3abf673
gmd work
jertel May 31, 2024
7bf3704
gmd work
jertel May 31, 2024
9a9e382
Merge pull request #533 from Security-Onion-Solutions/jertel/gmd
jertel May 31, 2024
7dc4f85
Bulk Delete + Confirmation Dialog
coreyogburn May 31, 2024
8d945e8
Check for Community Rules
coreyogburn Jun 3, 2024
0d9c915
bulkAction Jest tests
coreyogburn Jun 3, 2024
fe95817
Merge pull request #534 from Security-Onion-Solutions/cogburn/bulk-de…
coreyogburn Jun 4, 2024
8721599
Only disallow bulk action w/community rules on Delete
coreyogburn Jun 4, 2024
259ebe5
Improve Performance
coreyogburn Jun 4, 2024
95dc1c4
Merge pull request #535 from Security-Onion-Solutions/cogburn/fix-build
coreyogburn Jun 4, 2024
f1e25c6
Use proxy for Repo and Zip network operations
coreyogburn Jun 6, 2024
133052c
Test use of proxy
coreyogburn Jun 6, 2024
8089596
Merge pull request #536 from Security-Onion-Solutions/cogburn/soc-proxy
coreyogburn Jun 6, 2024
4c293d3
RootCA and InsecureSkipVerify
coreyogburn Jun 6, 2024
6a558be
RootCA => AdditionalCA, some cleanup
coreyogburn Jun 7, 2024
8add717
Merge pull request #537 from Security-Onion-Solutions/cogburn/tls-opt…
coreyogburn Jun 7, 2024
c5dc260
Use the all.rules for integrity check
defensivedepth Jun 11, 2024
b22f727
Remove local rules config
defensivedepth Jun 11, 2024
8707510
Merge pull request #538 from Security-Onion-Solutions/2.4/fixintegrit…
defensivedepth Jun 11, 2024
74a92c4
Suricata, YARA, and Sigma source highlighting
coreyogburn Jun 10, 2024
3670e83
Highlighting on New Detection page
coreyogburn Jun 11, 2024
4daff2e
Merge pull request #539 from Security-Onion-Solutions/cogburn/syntax-…
coreyogburn Jun 11, 2024
9fb833b
Extract ElastAlert Description
coreyogburn Jun 11, 2024
3e1c59a
Merge pull request #540 from Security-Onion-Solutions/cogburn/sigma-d…
coreyogburn Jun 11, 2024
ed95521
Show tip when Bulk Action starts
coreyogburn Jun 11, 2024
81b39ba
Add tests
coreyogburn Jun 11, 2024
df36e43
Merge pull request #541 from Security-Onion-Solutions/cogburn/bulk-ba…
coreyogburn Jun 11, 2024
2b499bd
Deduplication of Detections by Public Id
coreyogburn Jun 12, 2024
4fdd51d
Merge pull request #542 from Security-Onion-Solutions/cogburn/detecti…
coreyogburn Jun 12, 2024
a2fa27a
Slimmed down Detections Configs
coreyogburn Jun 12, 2024
6ec1ad2
Revert to HuntingParameters
coreyogburn Jun 12, 2024
5bb5953
Merge pull request #543 from Security-Onion-Solutions/cogburn/refacto…
coreyogburn Jun 12, 2024
0482c34
Update i18n.js to add link translations for cold and warm ILM phases
dougburks Jun 13, 2024
6807ef1
Update index.html to add links for Elasticsearch ILM Warm and Cold ph…
dougburks Jun 13, 2024
115d680
toggle full query view
jertel Jun 13, 2024
f377f59
Update i18n.js with simplified wording
dougburks Jun 13, 2024
1f28998
Merge pull request #545 from Security-Onion-Solutions/jertel/bt
jertel Jun 13, 2024
5c6fd2c
Merge pull request #546 from Security-Onion-Solutions/dougburks-patch-1
dougburks Jun 13, 2024
f9259d3
IP/Var + Suricata Fixes
coreyogburn Jun 13, 2024
20321f0
Fix a test
coreyogburn Jun 13, 2024
3e9e5b6
Data-Aid, gear, i18n
coreyogburn Jun 13, 2024
71574f1
Merge pull request #544 from Security-Onion-Solutions/cogburn/suricat…
coreyogburn Jun 13, 2024
bda98f4
Updated i18n
mc-wright Jun 14, 2024
13276f0
Merge pull request #547 from Security-Onion-Solutions/mwright/i18n-up…
mc-wright Jun 14, 2024
5d38621
Fixed bulk action count bug
mc-wright Jun 17, 2024
14017ec
Merge pull request #548 from Security-Onion-Solutions/mwright/bulkAct…
mc-wright Jun 17, 2024
8f7b6e7
Get count from server for bulk action tip
mc-wright Jun 17, 2024
af9d6c3
Updated tests to account for bulk action changes
mc-wright Jun 17, 2024
72d002a
FEATURE: Add new Process actions Security-Onion-Solutions/securityoni…
dougburks Jun 18, 2024
f036946
Merge pull request #550 from Security-Onion-Solutions/dougburks-patch-1
dougburks Jun 18, 2024
af429ff
Merge pull request #549 from Security-Onion-Solutions/mwright/accurCount
mc-wright Jun 18, 2024
1084f66
Comment bugfix
mc-wright Jun 18, 2024
f114234
Merge branch '2.4/dev' into mwright/commentBug
mc-wright Jun 18, 2024
2dfff2e
Merge pull request #551 from Security-Onion-Solutions/mwright/commentBug
mc-wright Jun 18, 2024
58f5477
Added license dropdown table in detection creation screen
mc-wright Jun 18, 2024
e4c6d18
Suricata Custom Rulesets
coreyogburn Jun 18, 2024
4751c8b
Less Generic Log Fields
coreyogburn Jun 18, 2024
4e770e9
Merge pull request #552 from Security-Onion-Solutions/cogburn/suricat…
coreyogburn Jun 18, 2024
618dc59
Merge pull request #553 from Security-Onion-Solutions/mwright/license…
mc-wright Jun 18, 2024
70fa1e9
Update i18n.js to make process.entity_id references consistent
dougburks Jun 20, 2024
b02e74f
Merge pull request #554 from Security-Onion-Solutions/dougburks-patch-1
dougburks Jun 20, 2024
fa29035
remove unintended apostrophe from data-aid attr
jertel Jun 20, 2024
8d04d0c
Merge pull request #555 from Security-Onion-Solutions/jertel/typo
jertel Jun 20, 2024
4a30d06
Fix Go Test
coreyogburn Jun 20, 2024
6a62561
Merge pull request #556 from Security-Onion-Solutions/cogburn/fix-test
coreyogburn Jun 20, 2024
e7a3acf
Account for customRulesets: null
coreyogburn Jun 20, 2024
d9dec2a
Merge pull request #557 from Security-Onion-Solutions/cogburn/custom-…
coreyogburn Jun 20, 2024
693cba9
When duplicating a suricata rule, ensure the msg option's value is qu…
coreyogburn Jun 20, 2024
18eaa4e
Merge pull request #558 from Security-Onion-Solutions/cogburn/suricat…
coreyogburn Jun 20, 2024
737913d
Improved Suricata Syntax Highlighting
coreyogburn Jun 20, 2024
289e5ab
Merge pull request #559 from Security-Onion-Solutions/cogburn/syntax-…
coreyogburn Jun 20, 2024
b12fc21
provide notice if license is expiring
jertel Jun 20, 2024
3ea5ea8
Merge branch '2.4/dev' into jertel/typo
jertel Jun 20, 2024
07f466f
Merge pull request #560 from Security-Onion-Solutions/jertel/typo
jertel Jun 20, 2024
a6e3d6b
New Query Param for Advanced Config
coreyogburn Jun 20, 2024
b8aa7e3
Suricata Rules can only be 1 Line
coreyogburn Jun 20, 2024
4b95bf6
Added test
coreyogburn Jun 20, 2024
57e1c64
Merge pull request #561 from Security-Onion-Solutions/cogburn/advance…
coreyogburn Jun 20, 2024
bb3cf34
Merge pull request #562 from Security-Onion-Solutions/cogburn/suricat…
coreyogburn Jun 20, 2024
108e497
Added test for new logic
coreyogburn Jun 21, 2024
3310c4f
Update URL for Override Edits
coreyogburn Jun 21, 2024
73145de
Merge pull request #563 from Security-Onion-Solutions/cogburn/suricat…
coreyogburn Jun 21, 2024
2d43646
Merge pull request #564 from Security-Onion-Solutions/cogburn/edit-co…
coreyogburn Jun 21, 2024
d1ea2fb
Allow for shorter PublicIDs
coreyogburn Jun 21, 2024
160f3d6
Merge pull request #565 from Security-Onion-Solutions/cogburn/short-p…
coreyogburn Jun 21, 2024
6bc0d6e
Suricata Integrity Check, Include Custom
coreyogburn Jun 21, 2024
dae170b
Merge pull request #566 from Security-Onion-Solutions/cogburn/suricat…
jertel Jun 21, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@ sensoroni
jobs/
logs/
nsm/
coverage/
.vscode/
.DS_Store
node_modules/

# Pytest output
__pycache__
Expand Down
54 changes: 31 additions & 23 deletions config/clientparameters.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,27 +16,27 @@ const DEFAULT_CHART_LABEL_OTHER_LIMIT = 10
const DEFAULT_CHART_LABEL_FIELD_SEPARATOR = ", "

type ClientParameters struct {
HuntingParams HuntingParameters `json:"hunt"`
AlertingParams HuntingParameters `json:"alerts"`
CasesParams HuntingParameters `json:"cases"`
CaseParams CaseParameters `json:"case"`
DashboardsParams HuntingParameters `json:"dashboards"`
JobParams HuntingParameters `json:"job"`
DetectionsParams DetectionParameters `json:"detections"`
DetectionParams DetectionParameters `json:"detection"`
DocsUrl string `json:"docsUrl"`
CheatsheetUrl string `json:"cheatsheetUrl"`
ReleaseNotesUrl string `json:"releaseNotesUrl"`
GridParams GridParameters `json:"grid"`
WebSocketTimeoutMs int `json:"webSocketTimeoutMs"`
TipTimeoutMs int `json:"tipTimeoutMs"`
ApiTimeoutMs int `json:"apiTimeoutMs"`
CacheExpirationMs int `json:"cacheExpirationMs"`
InactiveTools []string `json:"inactiveTools"`
Tools []ClientTool `json:"tools"`
CasesEnabled bool `json:"casesEnabled"`
EnableReverseLookup bool `json:"enableReverseLookup"`
DetectionsEnabled bool `json:"detectionsEnabled"`
HuntingParams HuntingParameters `json:"hunt"`
AlertingParams HuntingParameters `json:"alerts"`
CasesParams HuntingParameters `json:"cases"`
CaseParams CaseParameters `json:"case"`
DashboardsParams HuntingParameters `json:"dashboards"`
JobParams HuntingParameters `json:"job"`
DetectionsParams DetectionsParameters `json:"detections"`
DetectionParams DetectionParameters `json:"detection"`
DocsUrl string `json:"docsUrl"`
CheatsheetUrl string `json:"cheatsheetUrl"`
ReleaseNotesUrl string `json:"releaseNotesUrl"`
GridParams GridParameters `json:"grid"`
WebSocketTimeoutMs int `json:"webSocketTimeoutMs"`
TipTimeoutMs int `json:"tipTimeoutMs"`
ApiTimeoutMs int `json:"apiTimeoutMs"`
CacheExpirationMs int `json:"cacheExpirationMs"`
InactiveTools []string `json:"inactiveTools"`
Tools []ClientTool `json:"tools"`
CasesEnabled bool `json:"casesEnabled"`
EnableReverseLookup bool `json:"enableReverseLookup"`
DetectionsEnabled bool `json:"detectionsEnabled"`
}

func (config *ClientParameters) Verify() error {
Expand Down Expand Up @@ -190,15 +190,23 @@ type GridParameters struct {
StaleMetricsMs uint64 `json:"staleMetricsMs,omitempty"`
}

type DetectionParameters struct {
type DetectionsParameters struct {
HuntingParameters
Presets map[string]PresetParameters `json:"presets"`
}

type DetectionParameters struct {
Presets map[string]PresetParameters `json:"presets"`
SeverityTranslations map[string]string `json:"severityTranslations"`
TemplateDetections map[string]string `json:"templateDetections"`
}

func (params *DetectionParameters) Verify() error {
func (params *DetectionsParameters) Verify() error {
err := params.HuntingParameters.Verify()

return err
}

func (params *DetectionParameters) Verify() error {
return nil
}
7 changes: 7 additions & 0 deletions config/clientparameters_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -91,3 +91,10 @@ func TestVerifyCaseParams(tester *testing.T) {
assert.Nil(tester, err)
assert.Equal(tester, params.MostRecentlyUsedLimit, 0)
}

func TestVerifyDetectionsParams(t *testing.T) {
params := &DetectionsParameters{}
err := params.Verify()
assert.Nil(t, err)
verifyInitialHuntingParams(t, &params.HuntingParameters)
}
3 changes: 3 additions & 0 deletions config/serverconfig.go
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ type ServerConfig struct {
IdleConnectionTimeoutMs int `json:"idleConnectionTimeoutMs"`
TimezoneScript string `json:"timezoneScript"`
MaxUploadSizeBytes int `json:"maxUploadSizeBytes"`
Proxy string `json:"proxy"`
AdditionalCA string `json:"additionalCA"`
InsecureSkipVerify bool `json:"insecureSkipVerify"`
SrvKey string `json:"srvKey"`
SrvKeyBytes []byte
SrvExpSeconds int `json:"srvExpSeconds"`
Expand Down
25 changes: 12 additions & 13 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -11,31 +11,32 @@ require (
github.com/gorilla/websocket v1.5.1
github.com/influxdata/influxdb-client-go/v2 v2.13.0
github.com/kennygrant/sanitize v1.2.4
github.com/stretchr/testify v1.8.4
github.com/stretchr/testify v1.9.0
github.com/tidwall/gjson v1.17.0
golang.org/x/crypto v0.21.0
golang.org/x/net v0.23.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/crypto v0.23.0
golang.org/x/net v0.25.0 // indirect
golang.org/x/sys v0.20.0 // indirect
gopkg.in/yaml.v3 v3.0.1
)

require (
github.com/go-git/go-git/v5 v5.11.0
github.com/go-git/go-git/v5 v5.12.0
github.com/hashicorp/go-multierror v1.1.1
github.com/pierrec/lz4/v4 v4.1.21
github.com/pkg/errors v0.9.1
github.com/samber/lo v1.39.0
github.com/tj/assert v0.0.3
go.uber.org/mock v0.3.0
golang.org/x/mod v0.17.0
)

require (
dario.cat/mergo v1.0.0 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/ProtonMail/go-crypto v1.0.0 // indirect
github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
github.com/cloudflare/circl v1.3.3 // indirect
github.com/cyphar/filepath-securejoin v0.2.4 // indirect
github.com/cloudflare/circl v1.3.8 // indirect
github.com/cyphar/filepath-securejoin v0.2.5 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/elastic/elastic-transport-go/v8 v8.3.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
Expand All @@ -49,13 +50,11 @@ require (
github.com/oapi-codegen/runtime v1.0.0 // indirect
github.com/pjbgf/sha1cd v0.3.0 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/sergi/go-diff v1.1.0 // indirect
github.com/skeema/knownhosts v1.2.1 // indirect
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
github.com/skeema/knownhosts v1.2.2 // indirect
github.com/tidwall/match v1.1.1 // indirect
github.com/tidwall/pretty v1.2.1 // indirect
github.com/xanzy/ssh-agent v0.3.3 // indirect
golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 // indirect
golang.org/x/mod v0.14.0 // indirect
golang.org/x/tools v0.16.0 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
)
Loading
Loading