Skip to content
This repository was archived by the owner on May 28, 2026. It is now read-only.

feat. entrega final#2

Merged
PostboxRetinal merged 56 commits into
mainfrom
develop
May 20, 2026
Merged

feat. entrega final#2
PostboxRetinal merged 56 commits into
mainfrom
develop

Conversation

@PostboxRetinal

@PostboxRetinal PostboxRetinal commented May 20, 2026

Copy link
Copy Markdown
Owner

Merge develop hacia master

Descripción

Se solicita integrar la rama develop en master para consolidar los avances validados del proyecto CloudSIEM.

Cambios incluidos

  • Documentación actualizada del proyecto.
  • Playbooks de respuesta a incidentes para fuerza bruta SSH y SQLi/rutas sensibles.
  • Correcciones de ortografía y tildes en la documentación.
  • Referencias a variables de entorno requeridas para despliegue local.
  • Enlace a la presentación disponible en docs/.
  • Corrección de referencias a playbooks en reglas SIEM.

Validaciones realizadas

  • Revisión de formato Markdown.
  • Verificación con git diff --check.
  • Validación de JSON/NDJSON de reglas modificadas.

Consideraciones

No se incluyen credenciales ni secretos en el repositorio.

PostboxRetinal and others added 30 commits April 22, 2026 18:23
@PostboxRetinal
refactor(readme). update team-level readme for dev branch
364fe4b 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(readme). fixed spanish typos
82ab4b5 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@JuanJaramillo12004
feat: Add Logstash SIEM pipeline configuration and supporting scripts
eb9c8df 
- Created `siem.conf` for parsing, enriching, and routing security logs from various sources including NGINX, authentication logs, and syslog.
- Implemented a test script `test-pipeline.sh` to validate Logstash pipeline functionality and monitor statistics.
- Developed `generate-test-logs.py` to produce realistic test logs for SIEM from multiple sources, including normal and attack scenarios.
- Introduced ILM policy configuration in `ilm-policy.json` for managing log retention and indexing.
- Added `verify-cluster.sh` to check the health of the ELK cluster and its components.
- Created `verify-ecs-mapping.py` to ensure ECS fields are correctly mapped in Elasticsearch for different log sources.
@JuanJaramillo12004
feat: Add new SIEM detection rules for SSH brute force, after-hours l…
bbbd420 
…ogins, HTTP 404 floods, port scans, and sensitive paths access; implement import script for rules management
@JuanJaramillo12004
feat: Update Docker and configuration files for improved compatibilit…
c418ec4 
…y and functionality; add new log files and Metricbeat configuration
@JuanJaramillo12004
feat: Enhance Docker Compose and import-rules script for improved Kib…
b58db96 
…ana integration; add automatic waiting for Kibana availability and adjust rules directory path
@JuanJaramillo12004
feat: Update rules-import service to use curl image and implement aut…
167ec0f 
…omatic waiting for Kibana availability; enhance rule import logic
@Joseligos
cambios a logstash, ya inicia
72a608d
@Joseligos
metricbeat, puede que no se utilice
a0ee27a
@PostboxRetinal
refactor(infra). bumped STACK version + removed literal burned constants
b2ca489 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@xJuanes21
feat: add system diagnostic script and incident response playbooks fo…
fe01b1b 
…r SQLi and brute force attacks
@PostboxRetinal
refactor(arch). lots of critical changes for bind mounts and linux sp…
ca12270 
…ecific overrides

Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(metricbeat). removed metricbeat partial integration
e7131e4 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(docs). updated custom instructions + README general guidance
7a4695b 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
fix(kibana). bumped security enablinb HTTP/2 + TLS, security stuff tbh
cf2418b 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(kibana). removed unneeded AI noisy dep 'fleet'
37462d1 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(kibana). removed unneded report export option
11e6081 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(kibana): move queries to HTTPS
76deb89 
Use HTTPS for Kibana/Filebeat/Elasticsearch calls, keep ES logs at WARN, add missing Filebeat TLS trust, remove Kibana telemetry noise, and drop the deprecated ILM freeze action.

Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(logging). added deprecated warn bypasses + geoip fixes
7acaafe 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
fix(docs). removed all kind of unwanted emojis
c8a5908 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(instructions). merged with andrej-karpathy-skill's file
1467a3e 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@xJuanes21
feat: add cross-platform container management script and project docu…
6048012 
…mentation
@PostboxRetinal
fix(compose). removed not working wrapper files
8457042 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@xJuanes21
feat: set setup.template.overwrite on true
1c24339
@Joseligos
downgrade a v8.3.3 del stack. ya funcionan las rules-import, falta co…
20021b1 
…nfigurar los dashboards para que se agreguen de forma correcta
@PostboxRetinal
refactor(siem). updated templates priority and compose ES roles. Tele…
7ae9008 
…metry opt out and SecuritySolution working now

Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@Joseligos
arreglados errores que no permitian que arrancara el container de kib…
db44e9c 
…ana. Todo lo demás funionando. Falta verificar los dashbaords.
@Joseligos
dashboards agregados bien. estan 'rotos' toca arreglarlos.
1677e71
@JuanJaramillo12004
feat: Enhance Kibana dashboard import and data view creation
2d45c15
@Joseligos
generate-test-logs funcionando en dataviews. reglas funcionando. dash…
92a17a2 
…boards generados correctamente, falta que sea todo lo necesario
Joseligos and others added 25 commits May 10, 2026 23:12
@Joseligos
archivos faltantes
60b14ab
@xJuanes21
refinamiento de dashboard ejecutivo (pendiente tendencia de alertas p…
c97938c 
…or semana y mapa geografico)
@xJuanes21
arreglo de mapa de ip sospechosas
2127513
@xJuanes21
problema de inicializacion de stack mitigado, ambos dashboards refina…
affc807 
…dos.
@Joseligos
cambios en cómo se generan los logs. Ahora estan divididos en 3 archi…
02c078a 
…vos -orchestrate, attack t normal
@Joseligos
reglas importadas correctamente. demás logs añadidos pero sin visuali…
200ed2a 
…zación. reglas de login y puertos no generan alertas
@PostboxRetinal
refactor(cleanup.) removed root elk folder
003e5fd 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
fix(logs). back to normal, try switching data timestamp
4e0c4bf 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(provisioning). patched and exported provisioning files. Miss…
e22712b 
…ing dep validation for verify_parse_rate

Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
fix(filters). updated to UTC-5 TMZ
4682e4c 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(dashboards). added new and polished gauges (mano se ve una re ch…
52cd07c 
…imba)

Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(triage). added polished executive fresh gauges (chimba^2)
f9a1b85 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(ci/cd). added python, YAML and shell lint checkers for main branch
217e971 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(gitignore). added missing ruff_cache dir
a167769 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(sentinel). added bicep IaC files + docs
2f464c1 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@Joseligos
cambios para que funcione en windows
f757481
@PostboxRetinal
bugfix(sentinel). stack should boot now as expected, Linux systems mu…
0b69e43 
…st boot using the new .sh wrapper

Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(format). normalized LF format along all repo files
70b79a8 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@Joseligos
cambios para que se vean todas las alertas de forma correcta
c384df3
@PostboxRetinal
Merge PR #1 from PostboxRetinal/feat/ml_sentinel
e845f3a 
feat. ML Azure Sentinel integration
@PostboxRetinal
refactor(gitignore). removed unexistent file paths
95fa181 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
fix(parsing). added TLS bypass by default to parsing py script
512ae87 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat(docs). final documentation
028afaf 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
refactor(readme). salvedaad de entornos para despliegue
e8f1076 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
feat. diapositivas
a6ceb5d 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal PostboxRetinal self-assigned this May 20, 2026
@PostboxRetinal PostboxRetinal added documentation Improvements or additions to documentation enhancement New feature or request labels May 20, 2026
@PostboxRetinal
fix(docs). merge fro README
a1de334 
Signed-off-by: PostboxRetinal <78338192+PostboxRetinal@users.noreply.github.com>
@PostboxRetinal
PostboxRetinal merged commit 6ca5742 into main May 20, 2026
2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

@PostboxRetinal PostboxRetinal

Labels

documentation Improvements or additions to documentation enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@PostboxRetinal @JuanJaramillo12004 @Joseligos @xJuanes21