Elastic Stack Release Candidate 3

[dougburks]

• Elasticsearch

  • Elasticsearch 6.2.2
  • limit number of rotated log files to retain
  • increase index.refresh_interval to 30s
  • for new installs, set cluster.name to lower case hostname
  • for existing installs, migrate cluster.name from elasticsearch.yml to new

• Kibana

  • Kibana 6.2.2
  • IRC Destination Port viz doesn't show port
  • Help dashboard - add information for each dashboard
  • RDP Keyboard Layout typo
  • Modbus Destination IP Address typo
  • format bytes fields such as total_bytes, src_bytes, dst_bytes, etc. to bytes
  • format rtt field properly

• Logstash

  • Logstash 6.2.2
  • add congestion_interval and congestion_threshold to redis output - commit
  • limit number of rotated log files to retain
  • lowercase syslog-host_from
  • map well known fields properly

• redis

  • set maxmemory to be 10% of RAM by default
  • set maxmemory-policy noeviction

• so-import-pcap

  • generate Bro logs and preserve original timestamps
  • generate IDS alerts via snort or suricata and preserve original timestamps
  • write traffic out to dailylogs directories where sguil's pcap_agent can find it
  • handle single or multiple pcaps
  • prompt user before making changes to system

• sosetup-elastic

  • make sure that node terminology is consistent ("What is the hostname or IP address of the master server that this node should connect to?")
  • make sure that re-running Setup results in valid config (re-running Setup on an existing sensor that already has values in elasticsearch.yml results in duplicate values and service failure)

[dougburks]

Submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/xMrXbzfIieo/discussion

Published:
http://blog.securityonion.net/2018/03/security-onion-elastic-stack-release.html