2.4.30-20231117

Merge pull request #11827 from Security-Onion-Solutions/hotfix/2.4.30

Hotfix 2.4.30

Security Onion 2.4.30-20231113

Download the ISO

https://download.securityonion.net/file/securityonion/securityonion-2.4.30-20231113.iso

What's Changed

• accept icmp on input chain by @m0duspwnens in #11496
• Update VERSION by @TOoSmOotH in #11497
• Minechanges by @m0duspwnens in #11503
• 2.4/main by @TOoSmOotH in #11533
• Update HOTFIX by @TOoSmOotH in #11534
• avoid rebooting when testing deb installs by @jertel in #11535
• only add heavynodes to remoteHostUrls by @jertel in #11552
• Zeek 6 upgrade by @reyesj2 in #11554
• Minechanges by @m0duspwnens in #11555
• mark suricata 7 log line as fp fo so-log-check by @m0duspwnens in #11558
• Elastic 8.10.4 by @weslambert in #11560
• Minechanges by @m0duspwnens in #11563
• Add note regarding DNS resolver by @weslambert in #11567
• Add back plugin-tds/ plugin-profinet. Using patched versions for Zeek 6 by @reyesj2 in #11568
• Minechanges by @m0duspwnens in #11572
• remove extra space by @m0duspwnens in #11573
• Additional integrations by @weslambert in #11570
• handle a minion not being in the mine data return by @m0duspwnens in #11582
• Minechanges by @m0duspwnens in #11592
• FIX: Add -watch to soctopus saltstate for file SOCtopus.conf. Makes contai… by @reyesj2 in #11594
• Parse pkt_src for Suricata logs by @weslambert in #11600
• Enable http2 for Suricata by @TOoSmOotH in #11606
• Upgrade/salt3006.3 by @m0duspwnens in #11612
• fix issue/11610 by @m0duspwnens in #11613
• Revert "Upgrade/salt3006.3" by @m0duspwnens in #11619
• Add kibana curl config by @defensivedepth in #11609
• oidc by @jertel in #11631
• UPGRADE: Influxdb 2.7.1 & telegraf 1.28.2 by @reyesj2 in #11633
• 2.4/kibanauser by @defensivedepth in #11637
• Warm Node UI Changes by @TOoSmOotH in #11623
• oidc by @jertel in #11643
• UPGRADE: influxdb 2.7.1 & telegraf 1.28.2 by @reyesj2 in #11644
• Upgrade/salt3006.3v2 by @m0duspwnens in #11647
• Remove ILM policies for Cases and OSQuery manager indices by @weslambert in #11648
• ensure networkminer is latest version by @m0duspwnens in #11659
• Add roles for eval mode by @weslambert in #11661
• Add import roles by @weslambert in #11664
• ignore specific Suricata errors by @jertel in #11665
• Remove unused scripts and functions by @TOoSmOotH in #11666
• Fix/soupagrepo by @m0duspwnens in #11670
• Remove legacy pillar info by @TOoSmOotH in #11671
• Foxtrot by @m0duspwnens in #11674
• Sublime Platform Integration by @weslambert in #11676
• Allow 16GB of memory by @TOoSmOotH in #11677
• adjust log filter to include all hosts by @jertel in #11687
• Add eval and import roles by @weslambert in #11688
• more log bypass by @jertel in #11689
• fix UPGRADECOMMAND used for distrib salt upgrade. remove unneeded vars by @m0duspwnens in #11690
• more log bypass by @jertel in #11691
• Add Elastic Fleet reset script by @defensivedepth in #11678
• Jertel/auto by @jertel in #11695
• Don't source so-elastic-fleet-common if not there by @weslambert in #11701
• ignore connectivity problems to docker containers during startup by @jertel in #11702
• Checkpoint and VSphere Integrations by @weslambert in #11704
• Dont overwrite metadata by @defensivedepth in #11708
• ignore malformed open canary log lines by @jertel in #11709
• exit 0 by @defensivedepth in #11710
• Update soc_elasticsearch.yaml by @TOoSmOotH in #11712
• Upgrade Elastic Agent by @defensivedepth in #11713
• apply es and soc states to manager if new search or hn are added by @m0duspwnens in #11714
• disregard false positives by @jertel in #11718
• Set execute permissions by @defensivedepth in #11722
• improve verbosity of setup logs by @jertel in #11726
• Change pipeline to 1.8.0 by @weslambert in #11732
• Change pipeline to 1.13.1 by @weslambert in #11735
• Improve error handling and add retry logic by @weslambert in #11734
• Remove template files by @weslambert in #11740
• remove comments from BPFs by @m0duspwnens in #11741
• add yaml helper script; refactor python testing by @jertel in #11742
• Additional fixes for index template check by @weslambert in #11743
• re-add source pkgs from accidental commit by @jertel in #11745
• remove state file by @defensivedepth in #11747
• Upgrade Defend Integration policy by @defensivedepth in #11750
• Remove unneeded datastreams by @defensivedepth in #11751
• Add Elastic Agent package and upgrade packages when elasticfleet.packages list changes by @weslambert in #11760
• Update soup by @TOoSmOotH in #11769
• 2.4.30 by @TOoSmOotH in #11776
• 2.4.30 by @TOoSmOotH in #11777

Full Changelog: 2.4.20-20231012...2.4.30-20231113

2.4.20-20231012

Download the ISO

https://github.com/Security-Onion-Solutions/securityonion/blob/2.4/main/DOWNLOAD_AND_VERIFY_ISO.md

What's Changed

• Add hotfix changes by @defensivedepth in #11522
• Apply state correctly by @defensivedepth in #11524
• Apply named state by @defensivedepth in #11525
• 2.4.20 hotfix by @TOoSmOotH in #11531
• Hotfix 2.4.20 by @TOoSmOotH in #11532

Full Changelog: 2.4.20-20231006...2.4.20-20231012

Security Onion 2.4.20-20231006

Download the ISO

https://github.com/Security-Onion-Solutions/securityonion/blob/2.4/main/DOWNLOAD_AND_VERIFY_ISO.md

What's Changed

• Update VERSION by @TOoSmOotH in #11047
• set timezone during setup. set salt log levels to info by @m0duspwnens in #11060
• Add soup for 2.4.20 by @TOoSmOotH in #11075
• force image pulls to go into soup log by @jertel in #11083
• Issue/10998 by @m0duspwnens in #11090
• Fix certs for Rec & Heavy by @defensivedepth in #11113
• add missing containers to soc_docker.yaml. force port bindings to []string by @m0duspwnens in #11124
• Exclude console log by @weslambert in #11123
• Merge in hotfix by @TOoSmOotH in #11128
• Update HOTFIX by @TOoSmOotH in #11129
• Update SOC event fields by @weslambert in #11139
• Add more Elastic Fleet integrations by @weslambert in #11153
• use consistent cert dir and reduce jinja complexity by @jertel in #11161
• allow testing runs to proceed with unsupported os by @jertel in #11165
• use the correct var by @jertel in #11166
• fix centos install by @jertel in #11169
• new python watchdog by @m0duspwnens in #11177
• ingest pfsense sample data by @jertel in #11178
• dont need to repo_sync rocky or centos by @m0duspwnens in #11184
• fix path to intermediate ca cert on heavy nodes by @jertel in #11186
• Failreposync by @m0duspwnens in #11190
• Fix Heavy Node for acks by @TOoSmOotH in #11193
• Add Apache package and templates by @weslambert in #11197
• Make sure a data stream is created for syslog by @weslambert in #11208
• Add syslog to heavynode by @weslambert in #11212
• Issue/10975 by @m0duspwnens in #11217
• Correct Fortigate Integration by @weslambert in #11219
• iso desktop join grid - set install_type and minion_type by @m0duspwnens in #11221
• Analyzer SOC Administration by @weslambert in #11218
• New Config Default: longRelayTimeoutMs by @coreyogburn in #11222
• Update motd.md by @dougburks in #11226
• Issue/10975 by @m0duspwnens in #11231
• Strelka entropy mapping by @weslambert in #11232
• Add so-elastic-agent by @weslambert in #11239
• testing; desktop; configuration improvements by @jertel in #11241
• ensure hostname is set by @jertel in #11243
• ensure hostname is set by @jertel in #11245
• MS testing by @jertel in #11249
• Issue/10975 by @m0duspwnens in #11255
• only ingest pfsense on sensor nodes by @jertel in #11256
• Remove templates by @weslambert in #11261
• Issue/11210 by @m0duspwnens in #11269
• addl node types by @jertel in #11271
• give priority to presets by @jertel in #11276
• Issue/11229 by @m0duspwnens in #11288
• dont manage sorules by @m0duspwnens in #11295
• FIX: SOC Config pcap doc links should point to steno docs #11302 by @dougburks in #11303
• Update so-minion by @TOoSmOotH in #11308
• exclude docker pull unauth errors from failing setup by @jertel in #11315
• Regex & Transform Role by @defensivedepth in #11317
• improvents for checking system requirements by @m0duspwnens in #11328
• Clean component template directory by @weslambert in #11329
• Change description to indicate that opencanary modules only apply to IDH nodes by @weslambert in #11297
• fix idstool extra_env for container by @m0duspwnens in #11344
• ensure all binds are present to avoid volume sprawl by @jertel in #11345
• ignore debian apt update output by @jertel in #11351
• Fix EVTX Imports by @weslambert in #11352
• FIX: SOC Config sensoroni doc links should point to correct docs #11362 by @dougburks in #11363
• Update soup to prune in background by @jertel in #11369
• /app/dashboards to /kibana/app/dashboards by @weslambert in #11289
• Add a note about testing analyzers outside of the Sensoroni Docker container by @weslambert in #11384
• Make scan.pe.image_version type of 'float' by @weslambert in #11391
• Issue/11390 by @m0duspwnens in #11393
• log check tool initial by @jertel in #11397
• skip zeek spool logs due to test data false positives by @jertel in #11398
• don't inspect imported zeek output by @jertel in #11399
• Update nginx.conf to use user nobody by @TOoSmOotH in #11403
• Fix/filecheckcron by @m0duspwnens in #11404
• deb OS doesn't use /var/log/cron, skip by @jertel in #11405
• ignore generic python stack trace log lines of code, rely on actual e… by @jertel in #11406
• Fix sendmail errors in zeek by @TOoSmOotH in #11408
• Fix zeek from creating summary files by @TOoSmOotH in #11409
• FIX: Remove telegraf beats EPS script by @TOoSmOotH in #11411
• ignore generic python stack trace log lines of code, rely on actual e… by @jertel in #11414
• Issue/11390 by @m0duspwnens in #11415
• Jertel/lc by @jertel in #11416
• logcheck improvements by @jertel in #11417
• more exclusions by @jertel in #11418
• Exclude known_certs by @weslambert in #11423
• exclude known issues by @jertel in #11422
• Fix Yara crontab by @TOoSmOotH in #11426
• Upgrade packages and load integrations when packages change by @weslambert in https://github.com/Se...

Security Onion 2.3.270-20231006

What's Changed

• Update VERSION by @TOoSmOotH in #10622
• Supersoup by @TOoSmOotH in #10916
• Soup by @TOoSmOotH in #10919
• Create template for Github Discussions in the 2.4 Category by @dougburks in #11102
• Merge 2.4 discussion template to dev by @dougburks in #11103
• Elastic 8.8.2 by @weslambert in #11183
• Remove migration version by @weslambert in #11187
• Update 2-4.yml discussion template with additional fields for CPU, RAM, and storage by @dougburks in #11227
• Merge master to dev for updated 2.4 discussion template by @dougburks in #11228
• Update soup for 2.3.270 by @dougburks in #11287
• Jertel/vol by @jertel in #11360
• Update soup by @TOoSmOotH in #11367
• 2.3.270 by @TOoSmOotH in #11373
• 2.3.270 by @TOoSmOotH in #11374

Full Changelog: 2.3.260-20230620...2.3.270-1006

2.4.10-20230821

Download the ISO

https://github.com/Security-Onion-Solutions/securityonion/blob/2.4/main/DOWNLOAD_AND_VERIFY_ISO.md

What's Changed

• Force package installation by @weslambert in #11064
• Fix so-elastic-fleet-package-load by @weslambert in #11068
• Assign pipeline to import by @weslambert in #11079
• Update HOTFIX by @TOoSmOotH in #11088
• force soup docker output to log by @jertel in #11100
• Update soup by @TOoSmOotH in #11098
• Fix Hotfix by @TOoSmOotH in #11101
• Fix certs on Rec and Heavy by @defensivedepth in #11116
• Update config.sls by @TOoSmOotH in #11120
• 2.4.10 Hotfix by @TOoSmOotH in #11126
• Hotfix/2.4.10 by @TOoSmOotH in #11127

Full Changelog: 2.4.10-20230815...2.4.10-202030821

2.4.10-20230815

What's Changed

• update version by @jertel in #10978
• Fix/tgrafzeekcloss by @m0duspwnens in #10983
• Set as default by @defensivedepth in #10977
• Fix/windows event table by @bryant-treacle in #10986
• Update soup for 2.4.10 by @dougburks in #10987
• Issue/10973 by @m0duspwnens in #10989
• Fix/desktop by @m0duspwnens in #10995
• RC2 Fixes by @defensivedepth in #10994
• Enable Agent Upgrade Check during highstate by @defensivedepth in #10997
• Issue/10954 by @m0duspwnens in #11000
• Move base_url to cert SAN by @defensivedepth in #11002
• Unset defaults by @defensivedepth in #11004
• Fix/esanno by @m0duspwnens in #11008
• ensure only 1 instance of so-rule-update runs. execute the cmd at the end of state run by @m0duspwnens in #11009
• Update motd.md by @dougburks in #11011
• set desktop background by @m0duspwnens in #11012
• Upgrade integration packages by @defensivedepth in #11014
• set SO desktop wallpaper for iso install by @m0duspwnens in #11016
• add missing annotations to avoid soc crash by @jertel in #11023
• Set default for import and eval only by @defensivedepth in #11021
• soup should respect current indentation in soc_global.sls by @dougburks in #11034
• 2.4.10 by @TOoSmOotH in #11042
• Jertel/up by @jertel in #11043
• Update DOWNLOAD_AND_VERIFY_ISO.md by @TOoSmOotH in #11044
• 2.4.10 by @jertel in #11040

Full Changelog: 2.4.5...2.4.10-20230815

Security Onion 2.4.5-20230807

What's Changed

• Update VERSION by @TOoSmOotH in #10870
• Update README.md to 2.4 RC2 by @dougburks in #10871
• New Action "Add to Case" by @coreyogburn in #10842
• Update so-yara-download by @TOoSmOotH in #10881
• Sensor Fix by @TOoSmOotH in #10885
• Iptables by @m0duspwnens in #10886
• Soup by @TOoSmOotH in #10887
• Update Soup by @TOoSmOotH in #10888
• add managersearch and standlone fw rules for searchnode by @m0duspwnens in #10889
• import DOCKER in idh.enabled by @m0duspwnens in #10891
• Elastic 8.8.2 by @weslambert in #10892
• Elastic 8.2.2 by @weslambert in #10893
• SOC Auth msg fix by @weslambert in #10894
• 2.4/heavyrc2 by @defensivedepth in #10897
• Fix Offload by @TOoSmOotH in #10899
• Move syslog to the INPUT chain where needed by @weslambert in #10904
• Update verbiage and links in soc_sensor.yaml by @dougburks in #10905
• Fix login flicker; so-status sluggishness by @jertel in #10910
• Mine error by @m0duspwnens in #10912
• EA Container Logs by @weslambert in #10907
• Add package list by @weslambert in #10914
• Set version for Elastic Defend and enable updates by @weslambert in #10915
• force portgroups added to hostgroups in roles to be list of strings by @m0duspwnens in #10918
• Pfsense fix by @weslambert in #10920
• Soupaloop by @m0duspwnens in #10923
• ensure suri rules are synced for import installs by @jertel in #10925
• Regen Agent Installers by @defensivedepth in #10924
• add mono-devel by @m0duspwnens in #10927
• add gtk2 by @m0duspwnens in #10930
• refactor elastic-agent download for soup ctrl+c anomalies by @jertel in #10931
• remove unused vars by @jertel in #10932
• ensure AIRGAP is lowercase and check for true by @m0duspwnens in #10934
• Update soup for airgap by @dougburks in #10937
• Desktopyummv by @m0duspwnens in #10938
• 2.4/fleet-Enhancements by @defensivedepth in #10926
• Update soup for airgap by @dougburks in #10939
• Update for 8.8.2 by @defensivedepth in #10941
• Add time shift for so-import-evtx by @weslambert in #10940
• Raid refactor + yara and rule proxy by @TOoSmOotH in #10944
• Don't watch certs on search nodes by @defensivedepth in #10946
• Generate community_id for defend endpoint logs by @defensivedepth in #10947
• Update so-whiptail by @dougburks in #10948
• Fix/idhfirewall by @m0duspwnens in #10950
• FEATURE: soup should rotate its log file #10951 by @dougburks in #10953
• Desktopyummv by @m0duspwnens in #10959
• Refactor to remove new line by @defensivedepth in #10960
• fix count of WORKERS for zeekcaptureloss script for telegraf by @m0duspwnens in #10961
• Revert yesterday's change to zeekcaptureloss.sh by @dougburks in #10964
• prepare for 2.4.5 ISO image release by @dougburks in #10968
• add spaces for proper rendering DOWNLOAD_AND_VERIFY_ISO.md by @dougburks in #10969
• 2.4/main to 2.4/dev by @dougburks in #10971
• 2.4.5 RC2 by @dougburks in #10970

Full Changelog: 2.4.4-20230728...2.4.5

Security Onion 2.4.4-20230728

Merge pull request #10868 from Security-Onion-Solutions/2.4/dev

2.4.4

Security Onion 2.4.3-20230711

Merge pull request #10755 from Security-Onion-Solutions/2.4/dev

2.4.3