* LME V0.4 Release Overhaul of a number of areas of the LME installation script to make the product compatible with the Elastic Common Schema (ECS) going forward and to fix integration with the Elastic SIEM. This also includes additional functionality to upgrade existing users to the new schema and documentation updates explaining the steps needed. A full changelog includes: * Updated to ELK stack 7.11.1 * Added quotes to logstash passwords to prevent issues with certain characters in passwords * Added additional output to deploy script to guide users through various stages of the install/update/uninstall process and reduce bug reports * Merged dashboard versions into single file managed by git and removed outdated visualisations * Updated existing documentation to fix inconsistencies and clarify instructions * Updated dashboards to ECS compliant fields * Updated dashboards to resolve several existing issues with null fields and to clarify the purpose of the MITRE alerts dashboard * Updated the WEC config to resolve duplicate query IDs, include additional events and store events in RenderedText format * Removed deprecated OSMap functionality * Migrated GeoIP enrichment from logstash filter to elastic pipeline * Included index mapping template exported from winlogbeat-7.11.1 and customised for LME, and updated install script to deploy this automatically for new installs * Added LME config file storing versioning and hostname info, created on install * Automated initial dashboard install and fixed dashboard update script so that it correctly deploys latest dashboards from git if enabled * Added new deploy script method to deploy new index mapping, pipeline updates, dashboard installs and write the config version to support manual upgrade for existing users * Added "upgrading" documentation to walk users through the manual steps required when calling the above method * Bug fixes for existing install function to correctly enable automatic updates for Ubuntu and to resolve vm.max_map_count configuration within Docker * Bug fixes for the uninstall function to ensure it properly cleans all the existing files up from the Docker stack and leaves the swarm * Added checks to ensure that LME is stored in the correct location (/opt/lme) and modified the deploy script so that it can be referenced from any working directory provided it's stored in the correct location * Modified the existing update and dashboard update methods to only run when the LME version is set to 0.4, to prevent existing installations automatically updating without manual user intervention (as this requires re-indexing) * Added alternative suggested sysmon.xml configuration option * Updated copyright and authors list * Updated instructions for pre-release branch Updated the documentation for the pre-release branch to include instructions for checking out into this branch, either as part of a new install or during the upgrade process. * Update chapter3.md Updated documentation for checking out the pre-release branch. * Added certificate renewal functionality Update to support the recreation of self-signed certificates from inside the deploy script, which will aid the process of making new certificates when the default self-signed certificates expiration date of two years from the initial install is reached. These changes also include updated documentation around certificate handling, including guidance on using manually created certificates instead of the default self-signed option, and migrating from one to another at a later date. Additionally, added some extra error handling to the deploy script to deal with pending updates or the script being run with the incorrect permissions, generally formatted the script and config files into a consistent standard to improve readability. * Updated pre-release documentation Updated the relevant instructions for upgrading using the master branch ahead of the inclusion of the 0.4 release.