2.4.70-20240529

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.70-20240529.iso

What's Changed

• Update VERSION by @TOoSmOotH in #12619
• reschedule close/lock jobs by @jertel in #12601
• FIX: Annotations for BPF and Suricata PCAP #12626 by @dougburks in #12627
• Change Detections defaults by @defensivedepth in #12611
• Remove temp YARA by @weslambert in #12632
• FEATURE: Add Events column layout for event.module system #12628 by @dougburks in #12634
• disregard benign telegraf error by @jertel in #12638
• FEATURE: Add event.dataset to all Events column layouts #12641 by @dougburks in #12642
• FIX: Specify that static IP address is recommended #12643 by @dougburks in #12644
• Update ElastAlert Config with Default Repos by @coreyogburn in #12640
• FIX: http.response.status_code by @weslambert in #12650
• Enable Detections by @defensivedepth in #12639
• Allow for additional af-packet tuning options for Suricata by @m0duspwnens in #12651
• FEATURE: pfSense Suricata logs by @weslambert in #12652
• Initial cut to remove Playbook and deps by @defensivedepth in #12658
• Remove Playbook ref by @defensivedepth in #12659
• FEATURE: Include additional groupby fields in Dashboards relating to sankey diagrams #12657 by @dougburks in #12663
• Initial cut to remove Playbook and deps by @defensivedepth in #12660
• Add bindings for sigma repos by @defensivedepth in #12656
• FEATURE: Add Events table columns for event.module elastic_agent #12666 by @dougburks in #12667
• Fix Input Validation to allow for IPv6 by @TOoSmOotH in #12674
• disregard errors in removed applications that occurred before th… by @jertel in #12683
• FEATURE: Add process.command_line to Process Info and Process Ancestry dashboards #12694 by @dougburks in #12695
• New Settings for Manual Sync in Detections by @coreyogburn in #12696
• FEATURE: Add Events table columns for zeek ssl and suricata ssl #12697 by @dougburks in #12698
• FEATURE: Add individual dashboards for Zeek SSL and Suricata SSL logs… by @dougburks in #12700
• Correct YAML by @coreyogburn in #12702
• Add default columns by @defensivedepth in #12720
• FEATURE: Add Events table columns for event.module strelka #12716 by @dougburks in #12722
• FEATURE: Add Events table columns for event.module playbook #12703 by @dougburks in #12723
• FEATURE: Add Events table columns for event.module strelka #12716 by @dougburks in #12724
• FEATURE: Add Events table columns for event.module strelka #12716 by @dougburks in #12725
• Feature - auto-enabled Sigma rules by @defensivedepth in #12732
• Add cef by @weslambert in #12735
• Add Elastic Agent Status Metrics by @TOoSmOotH in #12734
• FEATURE: Add dashboard for SOC Login Failures #12738 by @dougburks in #12739
• FEATURE: Add Events table columns for event.module kratos #12740 by @dougburks in #12742
• Change code to allow for non root by @TOoSmOotH in #12741
• SOC Telemetry by @jertel in #12731
• Update SOC Config with State File Paths by @coreyogburn in #12744
• do not prompt about telemetry on airgap installs by @jertel in #12747
• Exclude Elastalert EQL errors by @defensivedepth in #12748
• Clarify annotation description re: Airgap by @jertel in #12749
• FEATURE: Add Events table columns for event.module sigma #12743 by @dougburks in #12751
• Allow 2.3 to update by @TOoSmOotH in #12752
• FEATURE: Add dashboards specific to Elastic Agent #12746 by @dougburks in #12753
• skip telemetry summary in airgap mode by @jertel in #12754
• 2.4/soup playbook by @defensivedepth in #12682
• 2.4/detections defaults by @defensivedepth in #12755
• Use list not string by @defensivedepth in #12756
• Update so-log-check by @TOoSmOotH in #12759
• Detection Author as a Keyword instead of Text by @coreyogburn in #12760
• Ship Defender logs + more by @defensivedepth in #12766
• Enable Detections Adv by default by @defensivedepth in #12780
• Update analyst.json by @TOoSmOotH in #12769
• Fix fingerprint paths by @defensivedepth in #12791
• Add docs for ruleset change by @defensivedepth in #12793
• Update limited-analyst.json by @TOoSmOotH in #12810
• FEATURE: Add queue=True to so-checkin so that it will wait for any ru… by @dougburks in #12817
• FIX: Elastic retention setting not being honored when manager hostname is a subset of search node hostname #12819 by @dougburks in #12820
• Strelka fixes and more by @defensivedepth in #12805
• Kismet integration for WiFi devices by @reyesj2 in #12773
• Temp exclude yara runtime status log by @defensivedepth in #12841
• Fix warm description by @weslambert in #12844
• Fix description, regex, and type for cold, warm, and hot by @weslambert in #12848
• Remove hot max_age by @weslambert in #12852
• Issue/12637 by @m0duspwnens in #12859
• Add runtime status logs by @defensivedepth in #12861
• Change index sorting to account for older so-prefixed indices by @weslambert in #12858
• allow for enabled/disable of so-elasticsearch-indices-delete cronjob by @m0duspwnens in #12860
• Exclude suricata from disk space-based index deletion by @weslambert in #12864
• only apply ulimits to suricata container if user enable mmap-locked by @m0duspwnens in #12865
• check status before stopping service by @petiepooo in #12846
• restrict workflows to so by @jertel in #12875
• Sigma pivot fix and cleanup by @defensivedepth in https://github.com/Security-O...

2.3.300-20240401

Merge pull request #12693 from Security-Onion-Solutions/dev

2.3.300

Security Onion 2.4.60-20240320

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.60-20240320.iso

What's Changed

• Cogburn/detection playbooks by @defensivedepth in #12296
• 2.4/dev by @defensivedepth in #12357
• Update VERSION by @TOoSmOotH in #12385
• replace correlate icon to avoid confusion with searcheng.in by @jertel in #12386
• Update soup by @TOoSmOotH in #12348
• add lock threads by @jertel in #12396
• add missing template by @jertel in #12408
• Initial Support for Detections Module by @defensivedepth in #12412
• nest under policy by @m0duspwnens in #12411
• Fix Loss Calculation for Stenographer by @TOoSmOotH in #12416
• convert x to . for soc ui to config by @m0duspwnens in #12423
• Feature/sigma pipeline by @defensivedepth in #12430
• Add Detection AutoUpdate config by @defensivedepth in #12431
• Update pattern for endpoint diagnostic template by @weslambert in #12432
• Add multiple endpoint features by @dougburks in #12434
• Airgap Support - Detections module by @defensivedepth in #12437
• Issue/12391 by @m0duspwnens in #12449
• Roll Suricata logs daily to prevent alerts from being deleted when not meeting size threshold by @weslambert in #12450
• Feature/detections airgap by @defensivedepth in #12456
• Manage the repo files by @TOoSmOotH in #12405
• FIX: EA installers not downloadable from SOC & fix logging by @reyesj2 in #12469
• 2.4/sigma pipeline by @defensivedepth in #12482
• Fix FIM by @defensivedepth in #12487
• Suricata PCAP by @TOoSmOotH in #12271
• fix sensoroni for non sensor by @m0duspwnens in #12497
• Update so-minion by @TOoSmOotH in #12502
• Additional Integrations #5 by @weslambert in #12500
• fix oinkcodes with leading zeros by @jertel in #12507
• fix pcapspace function by @m0duspwnens in #12508
• PCAP annotations by @jertel in #12511
• Add Exclusion toggle by @defensivedepth in #12510
• detections annotations by @jertel in #12514
• Change Factoring for so-minion pcap disk space by @TOoSmOotH in #12513
• Add error.message mapping for system.syslog by @weslambert in #12519
• gracefully handle status check failure on ubuntu by @jertel in #12521
• unswap files by @jertel in #12526
• allow managersearch to receiver redis and 5644 by @m0duspwnens in #12537
• FIX: Update SOC annotations for Stenographer PCAP #12539 by @dougburks in #12540
• Fix Space Free for Steno by @TOoSmOotH in #12527
• Updated RulesRepo for New Strelka Structure by @coreyogburn in #12542
• Update soc_pcap.yaml by @dougburks in #12545
• Run scan against default scap security guide so that resulting score is accurate by @reyesj2 in #12553
• Create local salt directory by @reyesj2 in #12555
• pcap improvements by @jertel in #12544
• auto-convert email addresses to lowercase during setup by @jertel in #12560
• transitional pcap by @m0duspwnens in #12561
• Add yara update back by @defensivedepth in #12563
• 2.4/detections defaults by @defensivedepth in #12565
• Update soc_suricata.yaml by @TOoSmOotH in #12564
• Update so-saltstack-update to use 2.4/main by @TOoSmOotH in #12567
• Gen packages post-SOUP by @defensivedepth in #12576
• remove modules if detections disabled by @m0duspwnens in #12577
• Update init.sls by @m0duspwnens in #12579
• removed unused property by @jertel in #12581
• handle airgap when detections not enabled by @jertel in #12584
• Update soc_suricata.yaml by @TOoSmOotH in #12587

Full Changelog: 2.4.50-20240220...2.4.60-20240320

2.3.290-20240229

Merge pull request #12463 from Security-Onion-Solutions/dev

2.3.290

Security Onion 2.4.50-20240220

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.50-20240220.iso

What's Changed

• Update VERSION by @TOoSmOotH in #12197
• Add Suricata IKE pipeline by @weslambert in #12201
• Add stig state by @reyesj2 in #12202
• Remove need for stig script by @reyesj2 in #12206
• Update metrics for telegraf by @reyesj2 in #12208
• Update soup by @reyesj2 in #12213
• Add stig pillar dir during soup by @reyesj2 in #12214
• Update suricata.common by @TOoSmOotH in #12216
• Disable stigs setting/verifying umask is set to 077. Known issue with … by @reyesj2 in #12220
• Additional integrations #4 by @weslambert in #12221
• Handle non-zero by @reyesj2 in #12230
• RITA Logs by @weslambert in #12227
• Exclude specific Strelka key values by @weslambert in #12241
• UPGRADE: Strelka 0.24.01.18 by @weslambert in #12240
• Fix quote by @weslambert in #12242
• standardize feature names by @jertel in #12248
• Fix PE Flags by @weslambert in #12250
• Add template for endpoint.diagnostic.collection by @weslambert in #12260
• Update soup by @reyesj2 in #12267
• Remove remediate from initial oscap scan by @reyesj2 in #12283
• fix salt lock for airgap version mismatches by @TOoSmOotH in #12293
• Manage custom Elasticsearch and Logstash pipelines in UI by @weslambert in #12297
• Jppffa by @m0duspwnens in #12294
• FEATURE: Improve Correlate and Hunt actions on SOC Actions menu #12315 by @dougburks in #12316
• FEATURE: Add new dashboards for community_id and firewall auth #12323 by @dougburks in #12324
• Salt3006.6 by @m0duspwnens in #12325
• Fixup shell by @defensivedepth in #12333
• Salt3006.6v2 by @m0duspwnens in #12337
• Add putty to SOD by @reyesj2 in #12332
• Wait for ES to be ready by @defensivedepth in #12343
• Feature/fleet artifacts by @defensivedepth in #12268
• FIX: Remove intca symlink on reinstall by @petiepooo in #12290
• FEATURE: Check for mountpoint during Elastic size limit calculations by @petiepooo in #12308
• Remove unused file by @reyesj2 in #12346
• Fix conflicting id by @defensivedepth in #12349
• FEATURE: Add new SOC action to show process ancestry #12345 by @dougburks in #12350
• Add table columns to process dashboard in defaults.yaml by @dougburks in #12355
• modify soup to update soup scripts using salt by @m0duspwnens in #12354
• `2450soup by @m0duspwnens in #12360

Full Changelog: 2.4.40-20240116...2.4.50-20240220

Security Onion 2.4.40-20240116

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.40-20240116.iso

What's Changed

• Update VERSION by @TOoSmOotH in #11778
• FIX: SOC Hunt HTTP EXE query #11784 by @dougburks in #11785
• avoid startup error by @jertel in #11792
• improve timing of responses by @jertel in #11809
• Merge hoftix back to 2.4/dev by @jertel in #11832
• add support for nested keys by @jertel in #11835
• Jertel/hfm by @jertel in #11855
• Ignore analyzer log by @weslambert in #11891
• Add certificate fingerprints by @weslambert in #11896
• FIX: Update NIDS rule.reference in common.nids pipeline #11846 by @dougburks in #11897
• Sublime Platform Analyzer by @weslambert in #11945
• Add eml observable type by @weslambert in #11950
• Fix indentation for rule_results by @weslambert in #11954
• Sublime Analyzer Documentation by @weslambert in #11955
• Merge Main into Dev by @TOoSmOotH in #11957
• FIX: Documentation links under SOC - Administration - Configuration need updating #11828 by @dougburks in #11960
• Remove Curator close configuration by @weslambert in #11967
• grid page enhancements by @jertel in #11970
• fix import stats by @jertel in #11981
• Remove Curator by @weslambert in #11990
• upgrade cla action by @jertel in #11998
• FIX: Update clear scripts #11991 by @dougburks in #12001
• Additional Integrations #2 by @weslambert in #12000
• more log false alarms by @jertel in #12012
• fix extra_hosts by @m0duspwnens in #12019
• Add force option to integrations by @weslambert in #12020
• FIX: Update dashboard and hunt query for firewall logs #12021 by @dougburks in #12023
• Fix receivers by @m0duspwnens in #12037
• exclude log false positives by @jertel in #12047
• 2.4/dev Analyzers for Threatfox, MalwareBazaar, Echotrail, Elasticsearch by @HoangLongVu in #12003
• FIX: Update dashboard and hunt query for firewall logs #12021 by @dougburks in #12048
• Fix analyzer images by @weslambert in #12052
• 2.4/main by @TOoSmOotH in #12053
• Curator Remove Changes by @weslambert in #12062
• Ignore Curator logs by @weslambert in #12063
• only run the file.absent state if there are files to delete by @jertel in #12067
• exclude transient influxdb error by @jertel in #12071
• show last highstate date/time on grid metrics screen; expose maxUploa… by @jertel in #12090
• Change salt-minion startup_states by @m0duspwnens in #12095
• 2.4/main by @TOoSmOotH in #12102
• Add brasero to packages list for SOD by @reyesj2 in #12109
• Issue/12033 by @m0duspwnens in #12116
• enable startup_states: highstate on managers during setup and not wit… by @m0duspwnens in #12118
• Update so-raid-status for SM based appliances by @TOoSmOotH in #12120
• Fix/fim by @defensivedepth in #12138
• Fix/fleet reset by @defensivedepth in #12141
• Salt3006.5 by @m0duspwnens in #12144
• exempt transient license check errors by @jertel in #12149
• Update so-functions by @TOoSmOotH in #12154
• Fix reinstall & reset stability by @defensivedepth in #12151
• Update soup by @TOoSmOotH in #12155
• Upgrade Navigator and fix Playbook layer by @defensivedepth in #12156
• Additional Supported Integrations #3 by @weslambert in #12160
• Check Kibana API not Web by @defensivedepth in #12161
• Make sure optional integration pillar values are merged with defaults by @weslambert in #12164
• Remove old nav layers by @defensivedepth in #12170
• Merge 2.4 dev by @weslambert in #12171
• Add endpoint metrics templates by @weslambert in #12173
• FIX: OTX pulses template by @weslambert in #12176
• Needsrestarted by @m0duspwnens in #12192

New Contributors

• @HoangLongVu made their first contribution in #12003

Full Changelog: 2.4.30-20231228...2.4.40-20240116

Security Onion 2.4.30-20231228

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231228.iso

Security Onion 2.4.30-20231219

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231219.iso

Security Onion 2.4.30-20231204

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231204.iso

What's Changed

• Update HOTFIX by @weslambert in #11902
• Update import-evtx-logs.json by @chateaulav in #11890
• move wait_for_salt_minion for hotfix by @m0duspwnens in #11923
• avoid exiting salt when ca state applied in post for 2.4.30 by @m0duspwnens in #11929

New Contributors

• @chateaulav made their first contribution in #11890

Full Changelog: 2.4.30-20231121...2.4.30-20231204

2.3.280

What's Changed

• Update VERSION by @jertel in #11506
• Zeek 6 upgrade by @reyesj2 in #11561
• Update soup by @TOoSmOotH in #11749
• Add EOL warning to README.md by @dougburks in #11771
• Elastic 8.10.4 by @weslambert in #11772
• Update soup by @m0duspwnens in #11798
• Update signing_policies.conf by @TOoSmOotH in #11831
• Update signing_policies.conf by @TOoSmOotH in #11834
• suricata interface None if so-import by @m0duspwnens in #11864
• enable highstate after starting minion by @m0duspwnens in #11873
• so-nginx watch managerssl to restart if changed by @m0duspwnens in #11874

Full Changelog: 2.3.270-1006...2.3.280-20231128