outflanknl/RedELK issues and pull requests

#311 - Added filebeat configuration for Havoc C2 logs

Pull Request - State: open - Opened by dazzyddos about 2 months ago - 1 comment
Labels: c2servers

#310 - RedELK Modification to Support Cobaltstrike 4.10

Pull Request - State: closed - Opened by OG-Sadpanda 2 months ago - 1 comment
Labels: elkserver, c2servers

#309 - Bump urllib3 from 1.26.18 to 1.26.19 in /elkserver/docker/redelk-base/redelkinstalldata/scripts

Pull Request - State: closed - Opened by dependabot[bot] 3 months ago
Labels: elkserver, docker, dependencies

#308 - Small bug fixes

Pull Request - State: closed - Opened by nurfed1 9 months ago - 2 comments
Labels: elkserver, installer

#307 - MsSQL setup trouble

Issue - State: closed - Opened by hvprvtr 10 months ago

#306 - BounceBack redirector support

Issue - State: closed - Opened by D00Movenok 11 months ago - 1 comment

#305 - Bump urllib3 from 1.26.17 to 1.26.18 in /elkserver/docker/redelk-base/redelkinstalldata/scripts

Pull Request - State: closed - Opened by dependabot[bot] 11 months ago
Labels: elkserver, docker, dependencies

#304 - Add bloodhound community

Pull Request - State: closed - Opened by alcastronic 11 months ago - 6 comments
Labels: elkserver, installer

#303 - Bump urllib3 from 1.26.5 to 1.26.17 in /elkserver/docker/redelk-base/redelkinstalldata/scripts

Pull Request - State: closed - Opened by dependabot[bot] 12 months ago - 2 comments
Labels: elkserver, docker, dependencies

#302 - Basic sanity check of openssl config file in initial install script

Pull Request - State: closed - Opened by MarcOverIP about 1 year ago
Labels: installer

#301 - error handling copy downloads scripts

Pull Request - State: closed - Opened by MarcOverIP about 1 year ago
Labels: c2servers

#300 - Integration of Bloodhound Community Edition

Issue - State: open - Opened by alcastronic about 1 year ago - 9 comments

#299 - Nothing being indexed into implantsdb

Issue - State: closed - Opened by RossLopez about 1 year ago - 2 comments

#298 - Simplified and updated GH Actions

Pull Request - State: open - Opened by fastlorenzo over 1 year ago
Labels: elkserver, documentation, docker, githubci

#297 - Bumped Elastic Stack to 7.17.9

Pull Request - State: closed - Opened by fastlorenzo over 1 year ago - 1 comment
Labels: elkserver, installer, docker, c2servers, redirs

#296 - Bugfix/237 logstash warnings

Pull Request - State: closed - Opened by MarcOverIP over 1 year ago
Labels: elkserver, installer, docker, c2servers, redirs

#295 - Add containers to GHCR / Review build pipeline

Issue - State: open - Opened by fastlorenzo over 1 year ago - 1 comment

#294 - Feature/283 config files from source control

Pull Request - State: closed - Opened by MarcOverIP over 1 year ago
Labels: elkserver, installer, c2servers, redirs

#293 - Slack message includes project name

Pull Request - State: closed - Opened by MarcOverIP over 1 year ago
Labels: elkserver, docker

#292 - this should fetch server v2 implants back into redelk

Pull Request - State: closed - Opened by xychix over 1 year ago - 4 comments
Labels: elkserver, installer, docker, c2servers, redirs

#291 - Cobalt Strike enrichment stacktrace errors

Issue - State: open - Opened by MarcOverIP almost 2 years ago

#290 - quick dump of small notes and issues

Issue - State: open - Opened by MarcOverIP almost 2 years ago

#289 - Fix pgrep call

Pull Request - State: closed - Opened by fastlorenzo almost 2 years ago
Labels: elkserver, docker

#288 - ES document conflicterrors

Issue - State: open - Opened by MarcOverIP almost 2 years ago

#287 - VT quota management

Issue - State: open - Opened by MarcOverIP almost 2 years ago - 1 comment

#286 - Hybrid Anlaysis - SSL handshake failure

Issue - State: closed - Opened by MarcOverIP almost 2 years ago - 1 comment

#285 - Hybrid Analysis - error handling around max API hits

Issue - State: open - Opened by MarcOverIP almost 2 years ago - 1 comment

#284 - fix: updated linter action

Pull Request - State: closed - Opened by fastlorenzo almost 2 years ago
Labels: githubci

#283 - Remove config files from source control

Issue - State: closed - Opened by fastlorenzo almost 2 years ago - 3 comments
Labels: enhancement

#282 - Implement domains as a list

Pull Request - State: closed - Opened by fastlorenzo almost 2 years ago - 1 comment
Labels: elkserver, documentation, installer, docker, githubci, c2servers, helpers, redirs

#281 - Fixed linter + linted code

Pull Request - State: closed - Opened by fastlorenzo almost 2 years ago
Labels: elkserver, docker, githubci

#280 - Fix for unknown last_seen bug #279

Pull Request - State: closed - Opened by MarcOverIP almost 2 years ago
Labels: elkserver, docker

#279 - Greynoise error

Issue - State: closed - Opened by MarcOverIP almost 2 years ago

#278 - All alarms should report project_name

Issue - State: closed - Opened by MarcOverIP about 2 years ago - 2 comments
Labels: bug

#277 - Update run_daemon.sh and redelk-www permission

Pull Request - State: closed - Opened by sunnyneo about 2 years ago - 4 comments
Labels: elkserver, installer, docker

#276 - Cleanup ruby scripts

Pull Request - State: closed - Opened by MarcOverIP about 2 years ago
Labels: elkserver

#275 - Include missing modules in config.py

Pull Request - State: closed - Opened by MarcOverIP about 2 years ago - 1 comment
Labels: elkserver, docker

#274 - Alarm manual

Pull Request - State: closed - Opened by MarcOverIP about 2 years ago - 1 comment
Labels: elkserver, docker

#273 - Check for consistent usage of c2.log.type field

Issue - State: closed - Opened by MarcOverIP about 2 years ago - 1 comment

#272 - Check if all modules in config.py

Issue - State: closed - Opened by MarcOverIP about 2 years ago - 1 comment

#271 - Check and clean-up ruby scripts

Issue - State: closed - Opened by MarcOverIP about 2 years ago

#270 - Add support for domain lists (similar to IP lists)

Issue - State: closed - Opened by fastlorenzo about 2 years ago - 1 comment
Labels: needs testing

#269 - Added vscode extensions recommendations

Pull Request - State: closed - Opened by fastlorenzo about 2 years ago

#268 - Add mising modules in config.py

Issue - State: closed - Opened by fastlorenzo about 2 years ago

#267 - Added basic support for Sliver

Pull Request - State: open - Opened by whitecod about 2 years ago - 22 comments
Labels: help wanted, elkserver, documentation, installer, docker, githubci, c2servers, helpers, redirs, needs testing

#266 - Issue with dashboards missing "keyword"

Issue - State: closed - Opened by oribit about 2 years ago - 2 comments

#265 - Fix to only alarm when response is valid Json

Pull Request - State: closed - Opened by xychix about 2 years ago - 2 comments
Labels: elkserver, docker

#264 - Implant.log_file not showing c2logs

Issue - State: closed - Opened by m7x over 2 years ago - 1 comment

#263 - Glibc filebeat errors

Issue - State: closed - Opened by MarcOverIP over 2 years ago - 1 comment

#262 - Fix greynoise and traffic dashboard

Pull Request - State: closed - Opened by fastlorenzo over 2 years ago - 1 comment
Labels: elkserver, docker, helpers

#261 - Permission and Implant Log URL issue

Pull Request - State: closed - Opened by sunnyneo over 2 years ago - 2 comments
Labels: elkserver, installer, docker

#260 - rsync performance tuning

Pull Request - State: closed - Opened by MarcOverIP over 2 years ago
Labels: c2servers

#259 - Performance issue with rsync on C2server

Issue - State: closed - Opened by sunnyneo over 2 years ago - 1 comment

#258 - Add slack connector for notifications

Pull Request - State: closed - Opened by Matthijsy over 2 years ago - 6 comments
Labels: elkserver, docker

#257 - Help with install

Issue - State: closed - Opened by pentest01 over 2 years ago - 1 comment

#256 - Help with install

Issue - State: closed - Opened by pentest01 over 2 years ago - 4 comments

#255 - Update makethumbnail.py

Pull Request - State: closed - Opened by sunnyneo over 2 years ago - 1 comment
Labels: elkserver, docker

#254 - Apache/nginx traffic not being parsed

Issue - State: closed - Opened by carlneuhaus over 2 years ago - 2 comments

#251 - Update cobaltstrike logstash to parse DNS beacon

Pull Request - State: closed - Opened by sunnyneo over 2 years ago
Labels: elkserver

#250 - Updated Kibana app to fix path for ATT&CK Navigator

Pull Request - State: closed - Opened by fastlorenzo over 2 years ago
Labels: elkserver, docker

#249 - import creds from .env file

Pull Request - State: closed - Opened by MarcOverIP over 2 years ago
Labels: helpers

#248 - 229 stage1 download logstash issue

Pull Request - State: closed - Opened by MarcOverIP over 2 years ago
Labels: elkserver

#241 - Added back Kibana app

Pull Request - State: closed - Opened by fastlorenzo over 2 years ago
Labels: elkserver, docker

#240 - Allow admin to set a projectname as prepend in mail-subjects

Pull Request - State: closed - Opened by xychix over 2 years ago - 1 comment
Labels: elkserver, docker

#237 - Fix some Logstash warnings

Issue - State: closed - Opened by MarcOverIP over 2 years ago - 2 comments

#229 - Logstash Stage1 Download filter parse failure

Issue - State: closed - Opened by MarcOverIP over 2 years ago
Labels: bug

#228 - Bluecheck content parsing and alarm

Issue - State: open - Opened by MarcOverIP over 2 years ago - 1 comment
Labels: alarm

#221 - export_kibana_config script not parsing Kibana settings?

Issue - State: closed - Opened by MarcOverIP over 2 years ago - 1 comment
Labels: helpers

#220 - Support for Sliver C2

Issue - State: open - Opened by hypnoticpattern over 2 years ago - 3 comments
Labels: enhancement, c2servers

#218 - Bump Elastic to 7.16.2 to fix #217

Pull Request - State: closed - Opened by fastlorenzo almost 3 years ago - 1 comment
Labels: elkserver, installer, docker, c2servers, redirs

#213 - Fixed HybridAnalysis results

Pull Request - State: closed - Opened by fastlorenzo almost 3 years ago
Labels: elkserver, docker

#211 - Fixed typo in IBM module (again)

Pull Request - State: closed - Opened by fastlorenzo almost 3 years ago
Labels: elkserver, docker

#208 - Moved error handling from modules to daemon script

Pull Request - State: closed - Opened by fastlorenzo almost 3 years ago
Labels: bug, elkserver, docker, alarm

#207 - Add missing Greynoise API key in header

Pull Request - State: closed - Opened by fastlorenzo almost 3 years ago
Labels: elkserver, docker

#193 - RedWarden redirector support

Issue - State: open - Opened by MarcOverIP about 3 years ago - 6 comments
Labels: enhancement, redirs

#189 - Fixed GH action for pylint

Pull Request - State: closed - Opened by fastlorenzo about 3 years ago
Labels: githubci

#188 - FIxed merge error

Pull Request - State: closed - Opened by fastlorenzo about 3 years ago
Labels: elkserver, docker

#183 - Moved Greynoise support to Community API

Pull Request - State: closed - Opened by fastlorenzo about 3 years ago - 4 comments
Labels: elkserver, docker

#182 - Add pylint support (cont'd)

Pull Request - State: closed - Opened by fastlorenzo about 3 years ago
Labels: elkserver, docker, githubci

#180 - Fix python deps

Pull Request - State: closed - Opened by fastlorenzo about 3 years ago
Labels: elkserver, docker

#176 - New alarm: new implant from a new user

Issue - State: open - Opened by fastlorenzo over 3 years ago - 3 comments
Labels: enhancement, elkserver, alarm

#173 - Added pylint and re-formatted python code

Pull Request - State: closed - Opened by fastlorenzo over 3 years ago
Labels: elkserver, docker

#172 - Fix filehash alarm

Pull Request - State: closed - Opened by fastlorenzo over 3 years ago
Labels: elkserver, docker

#171 - Greynoise enrichment not working due to API change

Issue - State: closed - Opened by MarcOverIP over 3 years ago - 10 comments
Labels: bug, elkserver

#169 - Fix es fields

Pull Request - State: closed - Opened by fastlorenzo over 3 years ago
Labels: elkserver, docker

#167 - export_kibana_config script should import credentials

Issue - State: closed - Opened by MarcOverIP over 3 years ago
Labels: enhancement, helpers

#165 - Fix logging

Pull Request - State: closed - Opened by fastlorenzo over 3 years ago
Labels: elkserver, docker

#164 - Revert neo4j changes

Pull Request - State: closed - Opened by fastlorenzo over 3 years ago
Labels: elkserver, installer

#154 - Added possibility to set remote base path to get logs from

Pull Request - State: closed - Opened by fastlorenzo over 3 years ago - 7 comments
Labels: elkserver, docker

#142 - ES template missing for some fields

Issue - State: closed - Opened by MarcOverIP over 3 years ago - 5 comments
Labels: elkserver

#138 - New alarm: alarm_genericlog

Issue - State: closed - Opened by MarcOverIP over 3 years ago - 2 comments
Labels: enhancement, elkserver, alarm

#133 - Alarms should include a identifier for the operation

Issue - State: closed - Opened by MarcOverIP almost 4 years ago - 3 comments
Labels: enhancement, elkserver, alarm

#131 - New alarm: alarm_baddomain: domain has a 'bad' classification.

Issue - State: open - Opened by xychix almost 4 years ago - 5 comments
Labels: enhancement, elkserver, alarm

#129 - New alarm: alarm_domainchange :bluecheck index alarm - any change of domain classification

Issue - State: open - Opened by xychix almost 4 years ago - 2 comments
Labels: enhancement, elkserver, alarm

#126 - New alarm: Abuse.ch SSLBL SSL Certificate Blacklist

Issue - State: open - Opened by fastlorenzo almost 4 years ago - 2 comments
Labels: enhancement, elkserver, alarm

#125 - New alarm: Abuse.ch SSLBL Botnet C2 IP Blacklist

Issue - State: open - Opened by fastlorenzo almost 4 years ago - 3 comments
Labels: enhancement, elkserver, alarm

#100 - Added dry-run mode

Pull Request - State: closed - Opened by fastlorenzo almost 4 years ago - 2 comments
Labels: elkserver, installer

#99 - Randomize Neo4j password at install

Pull Request - State: closed - Opened by fastlorenzo almost 4 years ago - 3 comments
Labels: elkserver, installer, githubci

#98 - Add elkserver installer 'dry run' mode

Issue - State: closed - Opened by fastlorenzo almost 4 years ago

#97 - Randomize neo4j password at install

Issue - State: closed - Opened by fastlorenzo almost 4 years ago - 1 comment

GitHub / outflanknl/RedELK issues and pull requests