Code

work for 2.1.0#135

Code

Merged

mmguero merged 182 commits intomastercisagov/Malcolm:masterfrom developmentcisagov/Malcolm:developmentCopy head branch name to clipboardJun 25, 2020

+7,432-1,099

Commits

Commits on Apr 8, 2020

• Merge branch 'master' into development

  mmguero

  committed
  7bcb322

  Copy full SHA for 7bcb322

Commits on Apr 9, 2020

• added Sniffpass and HTTP-Attack plugins for zeek

  mmguero

  committed
  a58a822

  Copy full SHA for a58a822

• documentation updates

  mmguero

  committed
  1c48b98

  Copy full SHA for 1c48b98

• clean up stuff from web generation we don't want

  mmguero

  committed
  9d611bc

  Copy full SHA for 9d611bc

• removed fixed timezone from dashboards (?) and updated notices

  mmguero

  committed
  e95d736

  Copy full SHA for e95d736

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  18b98db

  Copy full SHA for 18b98db

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  99a9710

  Copy full SHA for 99a9710

Commits on Apr 13, 2020

• rudimentary detection of telnet protocol

  mmguero

  committed
  3774c69

  Copy full SHA for 3774c69

• added telnet to list of insecure protocols

  mmguero

  committed
  ea06a8a

  Copy full SHA for ea06a8a

• bump version to 2.0.1 for development

  mmguero

  committed
  5952a30

  Copy full SHA for 5952a30

• include basic telnet detection in sensor iso

  mmguero

  committed
  b643c44

  Copy full SHA for b643c44

• Merge branch 'master' into development

  mmguero

  committed
  6ffa213

  Copy full SHA for 6ffa213

• more work on the telnet detection feature

  mmguero

  committed
  d921cf9

  Copy full SHA for d921cf9

Commits on Apr 14, 2020

• more work on the telnet detection feature

  mmguero

  committed
  7ca7add

  Copy full SHA for 7ca7add

• ensure local zeek policy gets set correctly

  mmguero

  committed
  fb5c313

  Copy full SHA for fb5c313

• issue #120, detect telnet, rsh, and rlogin traffic with zeek

  Show description for 40c2f11
  mmguero

  committed
  40c2f11

  Copy full SHA for 40c2f11

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  804f4a3

  Copy full SHA for 804f4a3

• according to semantic versioning, this version will be 2.1.0 since it introduces new backwards-compatible features

  mmguero

  committed
  1e8533a

  Copy full SHA for 1e8533a

• update zeek to 3.0.4 to address a security vulnerability

  mmguero

  committed
  32cf838

  Copy full SHA for 32cf838

• Merge branch 'topic/zeek304' into development

  mmguero

  committed
  d4f679a

  Copy full SHA for d4f679a

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  755198f

  Copy full SHA for 755198f

• update documentation

  mmguero

  committed
  e70af7a

  Copy full SHA for e70af7a

• Merge branch 'topic/zeek304' into development

  mmguero

  committed
  4f49ef4

  Copy full SHA for 4f49ef4

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  e6b55a4

  Copy full SHA for e6b55a4

• bump version to 2.0.1 for patch release for zeek 3.0.4 (see issue #123)

  mmguero

  committed
  64c9372

  Copy full SHA for 64c9372

• meh, might as well be 3.0.5 with the compilation fix for older compilers

  mmguero

  committed
  ee6e48b

  Copy full SHA for ee6e48b

• meh, might as well be 3.0.5 with the compilation fix for older compilers

  mmguero

  committed
  e485dba

  Copy full SHA for e485dba

Commits on Apr 15, 2020

• Merge branch 'topic/zeek304' into development

  mmguero

  committed
  e7577be

  Copy full SHA for e7577be

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  752f2ef

  Copy full SHA for 752f2ef

• Merge branch 'master' into development

  mmguero

  committed
  28df2c2

  Copy full SHA for 28df2c2

• Merge branch 'master' into development

  mmguero

  committed
  2c89921

  Copy full SHA for 2c89921

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  e64d213

  Copy full SHA for e64d213

• added telnet/rsh/rlogin dashboard for idaholab#120

  mmguero

  committed
  244f4a4

  Copy full SHA for 244f4a4

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  96fff20

  Copy full SHA for 96fff20

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  a7cf022

  Copy full SHA for a7cf022

• update sha256 sums

  mmguero

  committed
  0996e0a

  Copy full SHA for 0996e0a

Commits on Apr 16, 2020

• fix idaholab#122 by installing bro-xor-exe-plugin correctly

  Show description for f75f0b2
  mmguero

  committed
  f75f0b2

  Copy full SHA for f75f0b2

• added a build-time sanity check for the docker image to make sure all of the third-party plugins install and load correctly

  mmguero

  committed
  f20761b

  Copy full SHA for f20761b

Commits on Apr 21, 2020

• Merge branch 'master' into development

  mmguero

  committed
  830c7d0

  Copy full SHA for 830c7d0

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  55a3c11

  Copy full SHA for 55a3c11

• Merge branch 'master' into development

  mmguero

  committed
  f77c772

  Copy full SHA for f77c772

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  a11d1ad

  Copy full SHA for a11d1ad

• Merge branch 'master' into development

  mmguero

  committed
  052d621

  Copy full SHA for 052d621

• Merge branch 'master' into development

  mmguero

  committed
  03e939c

  Copy full SHA for 03e939c

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  2e2a6a0

  Copy full SHA for 2e2a6a0

Commits on Apr 22, 2020

• update version for docs

  mmguero

  committed
  9acef89

  Copy full SHA for 9acef89

• include network visualization for possible use in future dashboards

  mmguero

  committed
  dbda02b

  Copy full SHA for dbda02b

• dockerfile cleanpu

  mmguero

  committed
  12e8a9d

  Copy full SHA for 12e8a9d

• use Dockerfile ADD instead of 'git clone' to get certain repositories

  mmguero

  committed
  663f079

  Copy full SHA for 663f079

Commits on Apr 23, 2020

• categorize xor-decrypted files by saving the original FUID in parent_fuid and normalizing the source

  mmguero

  committed
  a088e4a

  Copy full SHA for a088e4a

• make sure both original and decrypted FUID show up in notice log for pe_xor decrypted files

  mmguero

  committed
  79cc0fd

  Copy full SHA for 79cc0fd

• fix recognition of names of file extracted by mitre-attack/bzar when scanned and triggering signatures

  Show description for 1e6ecda
  mmguero

  committed
  1e6ecda

  Copy full SHA for 1e6ecda

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  c0051a1

  Copy full SHA for c0051a1

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  dce859e

  Copy full SHA for dce859e

• make sure SNMP Registers actions (GetResponse, GetRequest, SetRequest, GetBulkRequest)

  mmguero

  committed
  dc4a717

  Copy full SHA for dc4a717

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  ff985c2

  Copy full SHA for ff985c2

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  01e6204

  Copy full SHA for 01e6204

• added missing file for kibana plugin patch

  mmguero

  committed
  c75784e

  Copy full SHA for c75784e

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  288698a

  Copy full SHA for 288698a

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  a5f315e

  Copy full SHA for a5f315e

Commits on Apr 27, 2020

• Merge branch 'master' into development

  mmguero

  committed
  fbf92da

  Copy full SHA for fbf92da

Commits on Apr 29, 2020

• for idaholab#127, create a field mapping template for elasticsearch

  mmguero

  committed
  f6cba3d

  Copy full SHA for f6cba3d

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  6996273

  Copy full SHA for 6996273

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  8f35e2c

  Copy full SHA for 8f35e2c

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  d53d547

  Copy full SHA for d53d547

Commits on Apr 30, 2020

• disabled by default, but starting to work on idaholab#79 mapping fields to ECS fields

  mmguero

  committed
  d5a9383

  Copy full SHA for d5a9383

Commits on May 5, 2020

• Merge branch 'master' into development

  mmguero

  committed
  345cffd

  Copy full SHA for 345cffd

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  19b69dd

  Copy full SHA for 19b69dd

• Merge branch 'master' into development

  mmguero

  committed
  9dfb497

  Copy full SHA for 9dfb497

Commits on May 6, 2020

• bump netsniff version to 0.6.7

  mmguero

  committed
  5cfb0cd

  Copy full SHA for 5cfb0cd

• fix issue with defaults not being set right for ldap

  mmguero

  committed
  ba08bc1

  Copy full SHA for ba08bc1

• bump zeek version

  mmguero

  committed
  cfbfa18

  Copy full SHA for cfbfa18

Commits on May 7, 2020

• documentation updates

  mmguero

  committed
  92746ca

  Copy full SHA for 92746ca

• documentation updates

  mmguero

  committed
  699edca

  Copy full SHA for 699edca

Commits on May 8, 2020

• documentation updates

  mmguero

  committed
  02ad506

  Copy full SHA for 02ad506

• documentation updates, and save hedgehog build artifacts

  mmguero

  committed
  766444a

  Copy full SHA for 766444a

• 2.1.0 development in progress

  mmguero

  committed
  b55330d

  Copy full SHA for b55330d

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  480b7a4

  Copy full SHA for 480b7a4

• documentation fixes

  mmguero

  committed
  f60fd44

  Copy full SHA for f60fd44

• documentation fixes

  mmguero

  committed
  81d5a7c

  Copy full SHA for 81d5a7c

• documentation fixes

  mmguero

  committed
  3f4cff6

  Copy full SHA for 3f4cff6

Commits on May 11, 2020

• Merge branch 'master' into development

  mmguero

  committed
  0f6d2fc

  Copy full SHA for 0f6d2fc

Commits on May 12, 2020

• Merge branch 'master' into development

  mmguero

  committed
  e920b30

  Copy full SHA for e920b30

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  ba190a6

  Copy full SHA for ba190a6

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  6e2706d

  Copy full SHA for 6e2706d

• bump moloch version to 2.3.0

  mmguero

  committed
  2f058df

  Copy full SHA for 2f058df

Commits on May 18, 2020

• updated elasticsearch version, working on ecs fields

  mmguero

  committed
  4beaa09

  Copy full SHA for 4beaa09

• more work on ecs normalization

  mmguero

  committed
  ef36c05

  Copy full SHA for ef36c05

Commits on May 19, 2020

• more work on ecs normalization

  mmguero

  committed
  cf25cfe

  Copy full SHA for cf25cfe

Commits on May 26, 2020

• Revert "updated elasticsearch version" due to discovery of elastic/elasticsearch#57006; should be fixed in 7.7.1

  Show description for 9d5a59e
  mmguero

  committed
  9d5a59e

  Copy full SHA for 9d5a59e

Commits on May 27, 2020

• Merge branch 'master' into development

  mmguero

  committed
  d6f7d3d

  Copy full SHA for d6f7d3d

• Merge branch 'master' into development

  mmguero

  committed
  c855e4e

  Copy full SHA for c855e4e

• Merge branch 'master' into development

  mmguero

  committed
  cd52898

  Copy full SHA for cd52898

Commits on May 28, 2020

• Merge remote-tracking branch 'upstream/master'

  mmguero

  committed
  41a8b3d

  Copy full SHA for 41a8b3d

• Merge branch 'master' into development

  mmguero

  committed
  8e18fde

  Copy full SHA for 8e18fde

Commits on May 29, 2020

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  9e02377

  Copy full SHA for 9e02377

• update download shas

  mmguero

  committed
  58b3acd

  Copy full SHA for 58b3acd

• update download shas

  mmguero

  committed
  ab53817

  Copy full SHA for ab53817

• Merge branch 'master' into development

  mmguero

  committed
  1ef863c

  Copy full SHA for 1ef863c

• added sankey visualization

  mmguero

  committed
  41f1770

  Copy full SHA for 41f1770

• testing on my own fork

  mmguero

  committed
  805c069

  Copy full SHA for 805c069

Commits on Jun 1, 2020

• sankey visualization fixes

  mmguero

  committed
  273dc06

  Copy full SHA for 273dc06

• sankey visualization fixes

  mmguero

  committed
  0c3cc93

  Copy full SHA for 0c3cc93

• added drilldown plugin for experimentation

  mmguero

  committed
  4558d35

  Copy full SHA for 4558d35

Commits on Jun 2, 2020

• use fork of drilldown plugin

  mmguero

  committed
  c66fec9

  Copy full SHA for c66fec9

• specify nginx rewrite rule for idkib2mol to allow kibana -> moloch drilldowns

  mmguero

  committed
  115ee2b

  Copy full SHA for 115ee2b

• for idaholab#133, specify drill-down mapping for zeek fields for kibana -> moloch drill-down

  mmguero

  committed
  0aa5a8a

  Copy full SHA for 0aa5a8a

• for idaholab#133, handle strings correctly with quotes for moloch expression

  mmguero

  committed
  bcf0960

  Copy full SHA for bcf0960

• for idaholab#133, even though moloch fields won't map correctly (for now), still create URL drilldown mappings

  mmguero

  committed
  aab4ce6

  Copy full SHA for aab4ce6

Commits on Jun 3, 2020

• moloch test harness

  mmguero

  committed
  2827551

  Copy full SHA for 2827551

• take ECS stuff out of development branch (will work on it in topic/ecs)

  mmguero

  committed
  350a500

  Copy full SHA for 350a500

• take drilldown stuff out of development branch (will work on it in topic/drilldown)

  mmguero

  committed
  85e7293

  Copy full SHA for 85e7293

• Merge branch 'development' into topic/drilldown

  Show description for f5b51a7
  mmguero

  committed
  f5b51a7

  Copy full SHA for f5b51a7

• Merge branch 'master' into development

  mmguero

  committed
  52d1810

  Copy full SHA for 52d1810

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  d527dac

  Copy full SHA for d527dac

• Merge remote-tracking branch 'upstream/master'

  mmguero

  committed
  838c138

  Copy full SHA for 838c138

• Merge branch 'master' into development

  mmguero

  committed
  97c4038

  Copy full SHA for 97c4038

• Merge branch 'development' into topic/drilldown

  mmguero

  committed
  0b4c8bc

  Copy full SHA for 0b4c8bc

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  0db1b86

  Copy full SHA for 0db1b86

• test harness

  mmguero

  committed
  3941c7a

  Copy full SHA for 3941c7a

• Merge branch 'development' into topic/drilldown

  mmguero

  committed
  17299e7

  Copy full SHA for 17299e7

• use db: prefix for moloch (see arkime/arkime#1461) for constructing kibana -> moloch drilldown URLs

  mmguero

  committed
  bfcdeae

  Copy full SHA for bfcdeae

Commits on Jun 4, 2020

• kibana network visualization having issues with 7.7.1, disabling for now

  mmguero

  committed
  ca9049e

  Copy full SHA for ca9049e

• bump elasticsearch version to 7.7.1 and moloch version to 2.3.1

  mmguero

  committed
  0768990

  Copy full SHA for 0768990

• Merge branch 'development' into topic/drilldown

  mmguero

  committed
  61da6d1

  Copy full SHA for 61da6d1

• added -w option to allow elasticsearch to be populated with logs before starting curator, elastalert

  mmguero

  committed
  33971a4

  Copy full SHA for 33971a4

• Several of my kibana plugins are not working correctly in Kibana 7.7.x, so I am going to switch back to 7.6.x until I can work through those issues

  mmguero

  committed
  ed6d695

  Copy full SHA for ed6d695

• Merge branch 'development' into topic/drilldown

  mmguero

  committed
  d8b4da0

  Copy full SHA for d8b4da0

• fix something borked by copy/paste

  mmguero

  committed
  c3384ab

  Copy full SHA for c3384ab

• Merge branch 'development' into topic/drilldown

  mmguero

  committed
  2cf7c49

  Copy full SHA for 2cf7c49

• fix install of drilldown plugin for 7.6.2

  mmguero

  committed
  5336e18

  Copy full SHA for 5336e18

Commits on Jun 5, 2020

• have Kibana set up drilldown url mappings on each startup

  mmguero

  committed
  ded83f7

  Copy full SHA for ded83f7

• added some more drilldown links for kibana

  mmguero

  committed
  47ed823

  Copy full SHA for 47ed823

• match drilldowns in moloch and kibana

  mmguero

  committed
  2ac9b3e

  Copy full SHA for 2ac9b3e

• more working on drilldowns for common fields

  mmguero

  committed
  960c95f

  Copy full SHA for 960c95f

• more working on drilldowns for common fields

  mmguero

  committed
  e7a0a7b

  Copy full SHA for e7a0a7b

Commits on Jun 8, 2020

• fix drilldowns from moloch side

  mmguero

  committed
  90c5ef9

  Copy full SHA for 90c5ef9

• fix drilldowns on kibana side

  mmguero

  committed
  6ccc093

  Copy full SHA for 6ccc093

• reduce verbosity of message

  mmguero

  committed
  e143ca1

  Copy full SHA for e143ca1

• fix drilldowns on kibana side

  mmguero

  committed
  e94f1e5

  Copy full SHA for e94f1e5

• update comments

  mmguero

  committed
  891a70d

  Copy full SHA for 891a70d

• Merge branch 'topic/drilldown' into development

  mmguero

  committed
  2773f99

  Copy full SHA for 2773f99

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  e297e8e

  Copy full SHA for e297e8e

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  b1f324f

  Copy full SHA for b1f324f

Commits on Jun 9, 2020

• added plugin for zeek to detect cve_2020_0601

  mmguero

  committed
  c6ed402

  Copy full SHA for c6ed402

• update zeek to 3.0.7 (https://github.com/zeek/zeek/releases/tag/v3.0.7)

  mmguero

  committed
  97dca9e

  Copy full SHA for 97dca9e

Commits on Jun 10, 2020

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  552ac5d

  Copy full SHA for 552ac5d

Commits on Jun 11, 2020

• added more actions (smtp, ssh, socks, ssl, rfb, etc.)

  mmguero

  committed
  c787d9c

  Copy full SHA for c787d9c

Commits on Jun 15, 2020

• more working on result normalization

  mmguero

  committed
  23d2f3f

  Copy full SHA for 23d2f3f

• various fixes for results

  mmguero

  committed
  94584fe

  Copy full SHA for 94584fe

• more working on result normalization

  mmguero

  committed
  6602119

  Copy full SHA for 6602119

• more working on result normalization

  mmguero

  committed
  d444444

  Copy full SHA for d444444

• fix connection state map

  mmguero

  committed
  ef0c1c2

  Copy full SHA for ef0c1c2

Commits on Jun 16, 2020

• updated various dashboards to include result

  mmguero

  committed
  dd935eb

  Copy full SHA for dd935eb

• updated various dashboards to include result

  mmguero

  committed
  18bfeda

  Copy full SHA for 18bfeda

• fix freq lookups by url encoding query parameters

  mmguero

  committed
  6fa8845

  Copy full SHA for 6fa8845

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  6dcce31

  Copy full SHA for 6dcce31

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  1f57d6f

  Copy full SHA for 1f57d6f

• sort dns randomness charts correctly

  mmguero

  committed
  73f5422

  Copy full SHA for 73f5422

• fix DNP3 IIN flags and ftp dashboard

  mmguero

  committed
  55cd24c

  Copy full SHA for 55cd24c

Commits on Jun 17, 2020

• fix way with more recent vagrant/virtualbox for checking output from vagrant run

  mmguero

  committed
  9e1d3db

  Copy full SHA for 9e1d3db

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  fea9315

  Copy full SHA for fea9315

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  32d7f89

  Copy full SHA for 32d7f89

• fix issue applying iin_flags to action if they weren't specified

  mmguero

  committed
  689d0da

  Copy full SHA for 689d0da

• fix issue applying iin_flags to action if they weren't specified

  mmguero

  committed
  9426bc5

  Copy full SHA for 9426bc5

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  0c90aa9

  Copy full SHA for 0c90aa9

• more tweaks to dnp3 action/result

  mmguero

  committed
  d094b54

  Copy full SHA for d094b54

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  1ea74e1

  Copy full SHA for 1ea74e1

• dashboard tweaks

  mmguero

  committed
  44a6303

  Copy full SHA for 44a6303

• dashboard tweaks

  mmguero

  committed
  28036e1

  Copy full SHA for 28036e1

• dashboard fixes/cleanup

  mmguero

  committed
  65636c5

  Copy full SHA for 65636c5

Commits on Jun 18, 2020

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  10fae15

  Copy full SHA for 10fae15

• fixes to HTTP And SNMP dashboards

  mmguero

  committed
  72d7500

  Copy full SHA for 72d7500

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  b69957c

  Copy full SHA for b69957c

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  5f4624b

  Copy full SHA for 5f4624b

Commits on Jun 19, 2020

• ended up with some bad JSON in a dashboard somehow :/

  mmguero

  committed
  cbc08aa

  Copy full SHA for cbc08aa

• ended up with some bad JSON in a dashboard somehow :/

  mmguero

  committed
  8baf079

  Copy full SHA for 8baf079

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  d7bee4d

  Copy full SHA for d7bee4d

• fix issue with split pie charts in kibana

  mmguero

  committed
  a01953b

  Copy full SHA for a01953b

• fix issue with split pie charts in kibana

  mmguero

  committed
  f3ea287

  Copy full SHA for f3ea287

• Merge remote-tracking branch 'upstream/development' into development

  mmguero

  committed
  da601d3

  Copy full SHA for da601d3

Commits on Jun 22, 2020

• Merge remote-tracking branch 'downstream/development' into development

  mmguero

  committed
  62c370d

  Copy full SHA for 62c370d