Download the ISO
https://download.securityonion.net/file/securityonion/securityonion-2.4.70-20240529.iso
What's Changed
- Update VERSION by @TOoSmOotH in #12619
- reschedule close/lock jobs by @jertel in #12601
- FIX: Annotations for BPF and Suricata PCAP #12626 by @dougburks in #12627
- Change Detections defaults by @defensivedepth in #12611
- Remove temp YARA by @weslambert in #12632
- FEATURE: Add Events column layout for event.module system #12628 by @dougburks in #12634
- disregard benign telegraf error by @jertel in #12638
- FEATURE: Add event.dataset to all Events column layouts #12641 by @dougburks in #12642
- FIX: Specify that static IP address is recommended #12643 by @dougburks in #12644
- Update ElastAlert Config with Default Repos by @coreyogburn in #12640
- FIX: http.response.status_code by @weslambert in #12650
- Enable Detections by @defensivedepth in #12639
- Allow for additional af-packet tuning options for Suricata by @m0duspwnens in #12651
- FEATURE: pfSense Suricata logs by @weslambert in #12652
- Initial cut to remove Playbook and deps by @defensivedepth in #12658
- Remove Playbook ref by @defensivedepth in #12659
- FEATURE: Include additional groupby fields in Dashboards relating to sankey diagrams #12657 by @dougburks in #12663
- Initial cut to remove Playbook and deps by @defensivedepth in #12660
- Add bindings for sigma repos by @defensivedepth in #12656
- FEATURE: Add Events table columns for event.module elastic_agent #12666 by @dougburks in #12667
- Fix Input Validation to allow for IPv6 by @TOoSmOotH in #12674
- disregard errors in removed applications that occurred before th… by @jertel in #12683
- FEATURE: Add process.command_line to Process Info and Process Ancestry dashboards #12694 by @dougburks in #12695
- New Settings for Manual Sync in Detections by @coreyogburn in #12696
- FEATURE: Add Events table columns for zeek ssl and suricata ssl #12697 by @dougburks in #12698
- FEATURE: Add individual dashboards for Zeek SSL and Suricata SSL logs… by @dougburks in #12700
- Correct YAML by @coreyogburn in #12702
- Add default columns by @defensivedepth in #12720
- FEATURE: Add Events table columns for event.module strelka #12716 by @dougburks in #12722
- FEATURE: Add Events table columns for event.module playbook #12703 by @dougburks in #12723
- FEATURE: Add Events table columns for event.module strelka #12716 by @dougburks in #12724
- FEATURE: Add Events table columns for event.module strelka #12716 by @dougburks in #12725
- Feature - auto-enabled Sigma rules by @defensivedepth in #12732
- Add cef by @weslambert in #12735
- Add Elastic Agent Status Metrics by @TOoSmOotH in #12734
- FEATURE: Add dashboard for SOC Login Failures #12738 by @dougburks in #12739
- FEATURE: Add Events table columns for event.module kratos #12740 by @dougburks in #12742
- Change code to allow for non root by @TOoSmOotH in #12741
- SOC Telemetry by @jertel in #12731
- Update SOC Config with State File Paths by @coreyogburn in #12744
- do not prompt about telemetry on airgap installs by @jertel in #12747
- Exclude Elastalert EQL errors by @defensivedepth in #12748
- Clarify annotation description re: Airgap by @jertel in #12749
- FEATURE: Add Events table columns for event.module sigma #12743 by @dougburks in #12751
- Allow 2.3 to update by @TOoSmOotH in #12752
- FEATURE: Add dashboards specific to Elastic Agent #12746 by @dougburks in #12753
- skip telemetry summary in airgap mode by @jertel in #12754
- 2.4/soup playbook by @defensivedepth in #12682
- 2.4/detections defaults by @defensivedepth in #12755
- Use list not string by @defensivedepth in #12756
- Update so-log-check by @TOoSmOotH in #12759
- Detection Author as a Keyword instead of Text by @coreyogburn in #12760
- Ship Defender logs + more by @defensivedepth in #12766
- Enable Detections Adv by default by @defensivedepth in #12780
- Update analyst.json by @TOoSmOotH in #12769
- Fix fingerprint paths by @defensivedepth in #12791
- Add docs for ruleset change by @defensivedepth in #12793
- Update limited-analyst.json by @TOoSmOotH in #12810
- FEATURE: Add queue=True to so-checkin so that it will wait for any ru… by @dougburks in #12817
- FIX: Elastic retention setting not being honored when manager hostname is a subset of search node hostname #12819 by @dougburks in #12820
- Strelka fixes and more by @defensivedepth in #12805
- Kismet integration for WiFi devices by @reyesj2 in #12773
- Temp exclude yara runtime status log by @defensivedepth in #12841
- Fix warm description by @weslambert in #12844
- Fix description, regex, and type for cold, warm, and hot by @weslambert in #12848
- Remove hot max_age by @weslambert in #12852
- Issue/12637 by @m0duspwnens in #12859
- Add runtime status logs by @defensivedepth in #12861
- Change index sorting to account for older so-prefixed indices by @weslambert in #12858
- allow for enabled/disable of so-elasticsearch-indices-delete cronjob by @m0duspwnens in #12860
- Exclude suricata from disk space-based index deletion by @weslambert in #12864
- only apply ulimits to suricata container if user enable mmap-locked by @m0duspwnens in #12865
- check status before stopping service by @petiepooo in #12846
- restrict workflows to so by @jertel in #12875
- Sigma pivot fix and cleanup by @defensivedepth in #12876
- set Suricata as default pcap engine for eval by @m0duspwnens in #12880
- Update expected timestamp format in final pipeline for system events by @reyesj2 in #12881
- FIX: Elasticsearch min_age regex #12885 by @dougburks in #12886
- Mark Repos as Community by @coreyogburn in #12882
- FEATURE: Lower EVAL memory requirement to 8GB RAM #12896 by @dougburks in #12897
- update annotations for duplication by @jertel in #12893
- Cold min_age to 60d by @weslambert in #12900
- mark detections settings as read-only via the UI by @jertel in #12904
- Update config.sls by @TOoSmOotH in #12902
- Apply autoEnabledSigmaRules based on role if defined and default if not by @m0duspwnens in #12906
- Update mappings for detection fields by @weslambert in #12909
- FIX: Improve File dashboard #12914 by @dougburks in #12915
- run so-rule-update if ruleset or code changes for idstools by @m0duspwnens in #12918
- FIX: Update so-whiptail to make installation screen more consistent #12921 by @dougburks in #12922
- FEATURE: Add hyperlink to airgap screen in setup #12925 by @dougburks in #12926
- Orchit by @m0duspwnens in #12928
- Exclude new sigma rules by @defensivedepth in #12929
- FEATURE: Add Events table columns for tunnel logs #12937 by @dougburks in #12938
- FEATURE: Add Events table columns for stun logs #12940 by @dougburks in #12941
- FEATURE: Add event.dataset to all Events table layouts #12641 by @dougburks in #12942
- Initial airgap support for detections by @defensivedepth in #12939
- Restart Strelka backend when YARA rules change by @weslambert in #12948
- Fix YARA rules for distributed deployments by @weslambert in #12947
- Remove watch by @weslambert in #12951
- Add CEF by @weslambert in #12955
- test regexes for detections by @jertel in #12956
- Specify Error Retry Wait and Error Limit for All Detection Engines by @coreyogburn in #12957
- update suri regex for testing by @jertel in #12959
- Change so soc writes urls as a list by @TOoSmOotH in #12961
- remove old yara airgap code by @defensivedepth in #12964
- Make the url list read only by @TOoSmOotH in #12963
- searchnode installation improvements by @m0duspwnens in #12965
- FIX: Adjust so-import-pcap so that suricata works when it is pcapengine #12969 by @dougburks in #12970
- Account for 0 active rules and change watch by @weslambert in #12974
- Use state by @weslambert in #12975
- Update config.sls by @TOoSmOotH in #12973
- fix strelka errors by @m0duspwnens in #12983
- tests will retry on any rule import failure by @jertel in #12984
- Add quick action to find related alerts for a detection by @jertel in #12987
- FIX: so-index-list typo #12988 by @dougburks in #12989
- Fix IDH node by @m0duspwnens in #12992
- support upgrade tests by @jertel in #12994
- Update README.md to reference new screenshots for 2.4.70 by @dougburks in #12998
- FEATURE: Add more fields to the SOC Dashboards URL for so-import-pcap #12972 by @dougburks in #12999
- Backup Suricata for migration by @TOoSmOotH in #13000
- 2.4/socdefaults by @defensivedepth in #13001
- create local directories during soup if needed by @m0duspwnens in #13003
- FIX: Detections alerts indices by @weslambert in #13004
- Remove old Strelka configuration for YARA by @weslambert in #12986
- FEATURE: Add NetFlow dashboard #13009 by @dougburks in #13010
- FEATURE: Add NetFlow dashboard #13009 by @dougburks in #13011
- remove idh.services from idh node pillar files by @m0duspwnens in #13013
- so-yaml in soup_scripts by @m0duspwnens in #13016
- Update enabled.sls by @TOoSmOotH in #13017
- Update enabled.sls by @TOoSmOotH in #13019
- Issue/13012 by @m0duspwnens in #13020
- alphabetical order by @defensivedepth in #13023
- add a newline to final output of so-elastic-agent-gen-installers by @m0duspwnens in #13022
- Update soup by @TOoSmOotH in #13024
- exclude detect-parse errors by @jertel in #13025
- dont merge policy from global_overrides if not defined in default index_settings by @m0duspwnens in #13028
- Revert "dont merge policy from global_overrides if not defined in default index_settings" by @m0duspwnens in #13029
- Issue/13021 by @m0duspwnens in #13031
- add support for custom alerters by @jertel in #13035
- Create YARA compile report for SOC integrity check by @weslambert in #13036
- Change Compilation Report Path by @coreyogburn in #13037
- Add Default IntegrityCheck Frequency Values by @coreyogburn in #13039
- Create helper script for tpm enrollment by @reyesj2 in #13040
- Annotate integrityCheckFrequencySeconds per det engine by @coreyogburn in #13041
- Update README.md with new Detections screenshot number by @dougburks in #13044
- Jertel/eaconfig by @jertel in #13047
- Exclude detections from template name matching by @weslambert in #13049
- Add rule.uuid for YARA matches by @weslambert in #13052
- Add rule.uuid to default groupbys by @defensivedepth in #13053
- fix elastalert settings by @jertel in #13054
- Change tab casing to be consistent with other whiptail prompts by @weslambert in #13061
- Fix casing issue by @defensivedepth in #13063
- Update defaults.yaml to fix order of groupby tables and eliminate dup… by @dougburks in #13066
- Fix strelka rule.uuid by @defensivedepth in #13067
- Update defaults.yaml by @TOoSmOotH in #13069
- Telfinwip by @m0duspwnens in #13071
- provide default columns when viewing SOC logs by @jertel in #13076
- Detections backup script by @defensivedepth in #13062
- Add instructions for sigma and yara repos by @defensivedepth in #13078
- Add IDH mappings by @defensivedepth in #13079
- Dont bail - just wait for enter by @defensivedepth in #13081
- Backup .yml files too by @defensivedepth in #13083
- Fix fi by @defensivedepth in #13084
- Check to see if local exists by @defensivedepth in #13085
- fix rsync by @defensivedepth in #13089
- 2.4.70 by @TOoSmOotH in #13090
- 2.4.70 by @TOoSmOotH in #13091
Full Changelog: 2.4.60-20240320...2.4.70-20240529