From 85bc8e3de41c395576b344adf0c943537351ea2c Mon Sep 17 00:00:00 2001 From: Linda Lovero-Waterhouse Date: Mon, 27 Nov 2023 15:10:22 -0500 Subject: [PATCH 1/6] fixed typos --- README.md | 2 +- docs/markdown/logging-guidance/filtering.md | 2 +- docs/markdown/maintenance/upgrading.md | 5 ++--- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index b0c49605..9c89258b 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Logging Made Easy can: ## Disclaimer -**LME is currently still early in development. The current release is version 1.0** +**LME is currently still early in development.** ***If you have an existing install of the LME Alpha (v0.5 or older) some manual intervention will be required in order to upgrade to the latest version, please see [Upgrading](/docs/markdown/maintenance/upgrading.md) for further information.*** diff --git a/docs/markdown/logging-guidance/filtering.md b/docs/markdown/logging-guidance/filtering.md index b279947c..2e2fac4a 100644 --- a/docs/markdown/logging-guidance/filtering.md +++ b/docs/markdown/logging-guidance/filtering.md @@ -2,7 +2,7 @@ There may come a time where a log is not particularly useful or an aspect of LME proves overly verbose (e.g.: [Dashboard spamming events](https://github.com/cisagov/LME/issues/22). We try our best to make everything useful by default but cannot predict every eventuality since all environments will be different. So to enable users to make the LME system more useful (and hopefully commit their own pull requests back with updates :) ), we are documenting here how you can filter out logs in the: -1. Dashbaord +1. Dashboard 2. Host logging utility (e.g. winlogbeat) 3. Serverside (e.g. logstash) diff --git a/docs/markdown/maintenance/upgrading.md b/docs/markdown/maintenance/upgrading.md index bdb28433..5e7bf038 100644 --- a/docs/markdown/maintenance/upgrading.md +++ b/docs/markdown/maintenance/upgrading.md @@ -1,7 +1,7 @@ # Upgrading ## 1 Upgrade Paths -LME is currently on v1.0. +LME is currently on v1.x.x. Below you can find the upgrade paths that are currently supported and what steps are required for these upgrades. Note that major version upgrades tend to include significant changes, and so will require manual intervention and will not be automatically applied, even if auto-updates are enabled. @@ -23,7 +23,7 @@ sudo cp /opt/lme_old/files_for_windows.zip /opt/lme/ sudo cp /opt/lme_old/lme.conf /opt/lme/ sudo cp /opt/lme_old/lme_update.sh /opt/lme/ ``` -Finally, you'll need to grab your old dashbouard_update password and add it into the new dashboard_update script: +Finally, you'll need to grab your old dashboard_update password and add it into the new dashboard_update script: ``` OLD_Password=[OLD_PASSWORD_HERE] sudo cp /opt/lme/Chapter\ 3\ Files/dashboard_update.sh /opt/lme/ @@ -60,7 +60,6 @@ Most data from the old LME should display just fine in the new dashboards, but t cd /opt/lme/ sudo ./dashboard_update.sh ``` -If there are issues its possible the version didn't update in `/opt/lme/lme.conf`. Change it to `1.0` if it did not. The rules built-in to the Elastic SIEM can then be updated to the latest version by following the instructions listed in [Chapter 4](/docs/markdown/chapter4.md#42-enable-the-detection-engine) and selecting the option to update the prebuilt rules when prompted, before making sure all of the rules are activated: From 05879377b9f1bc22546f5feee92bdbdb7957a676 Mon Sep 17 00:00:00 2001 From: Linda Lovero-Waterhouse Date: Mon, 27 Nov 2023 16:36:34 -0500 Subject: [PATCH 2/6] added link to releases directory so we don't have to specify current release number --- docs/markdown/maintenance/upgrading.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/markdown/maintenance/upgrading.md b/docs/markdown/maintenance/upgrading.md index 5e7bf038..a15e1ddf 100644 --- a/docs/markdown/maintenance/upgrading.md +++ b/docs/markdown/maintenance/upgrading.md @@ -1,7 +1,7 @@ # Upgrading ## 1 Upgrade Paths -LME is currently on v1.x.x. +Please see https://github.com/cisagov/LME/releases/ for our latest release. Below you can find the upgrade paths that are currently supported and what steps are required for these upgrades. Note that major version upgrades tend to include significant changes, and so will require manual intervention and will not be automatically applied, even if auto-updates are enabled. From 7b3c93bbf9f41e79c89acd1565757d74f23403b7 Mon Sep 17 00:00:00 2001 From: Linda Lovero-Waterhouse Date: Tue, 28 Nov 2023 10:23:09 -0500 Subject: [PATCH 3/6] fixed more typos --- testing/Readme.md | 2 +- testing/SetupTestbed.ps1 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/testing/Readme.md b/testing/Readme.md index d2b6eed9..45301981 100644 --- a/testing/Readme.md +++ b/testing/Readme.md @@ -19,7 +19,7 @@ This script does not install LME; it simply creates a fresh environment that's r | $NumClients | -n | The number of Windows clients to create; maximum 16; defaults to 1 | No | | $AutoShutdownTime | | The auto-shutdown time in UTC (HHMM, e.g. 2230, 0000, 1900); auto-shutdown not configured if not provided | No | | $AutoShutdownEmail | | An email to be notified if a VM is auto-shutdown. | No | -| $AllowedSources | -s | Comma-Seperated list of CIDR prefixes or IP ranges, e.g. XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc..., that are allowed to connect to the VMs via RDP and ssh. | Yes | +| $AllowedSources | -s | Comma-Separated list of CIDR prefixes or IP ranges, e.g. XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc..., that are allowed to connect to the VMs via RDP and ssh. | Yes | | $NoPrompt | -y | Switch, run the script with no prompt (useful for automated runs). By default, the script will prompt the user to review paramters and confirm before continuing. | No | Example: diff --git a/testing/SetupTestbed.ps1 b/testing/SetupTestbed.ps1 index 4aafb125..4c5a347b 100644 --- a/testing/SetupTestbed.ps1 +++ b/testing/SetupTestbed.ps1 @@ -46,7 +46,7 @@ param ( [Alias("s")] [Parameter(Mandatory=$true, - HelpMessage="XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc... Comma-Seperated list of CIDR prefixes or IP ranges" + HelpMessage="XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc... Comma-Separated list of CIDR prefixes or IP ranges" )] [string]$AllowedSources, From 405e869ed619163a649976f377a7e5109344489b Mon Sep 17 00:00:00 2001 From: Linda Lovero-Waterhouse Date: Mon, 27 Nov 2023 15:10:22 -0500 Subject: [PATCH 4/6] fixed typos --- README.md | 2 +- docs/markdown/logging-guidance/filtering.md | 2 +- docs/markdown/maintenance/upgrading.md | 5 ++--- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index b0c49605..9c89258b 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Logging Made Easy can: ## Disclaimer -**LME is currently still early in development. The current release is version 1.0** +**LME is currently still early in development.** ***If you have an existing install of the LME Alpha (v0.5 or older) some manual intervention will be required in order to upgrade to the latest version, please see [Upgrading](/docs/markdown/maintenance/upgrading.md) for further information.*** diff --git a/docs/markdown/logging-guidance/filtering.md b/docs/markdown/logging-guidance/filtering.md index b279947c..2e2fac4a 100644 --- a/docs/markdown/logging-guidance/filtering.md +++ b/docs/markdown/logging-guidance/filtering.md @@ -2,7 +2,7 @@ There may come a time where a log is not particularly useful or an aspect of LME proves overly verbose (e.g.: [Dashboard spamming events](https://github.com/cisagov/LME/issues/22). We try our best to make everything useful by default but cannot predict every eventuality since all environments will be different. So to enable users to make the LME system more useful (and hopefully commit their own pull requests back with updates :) ), we are documenting here how you can filter out logs in the: -1. Dashbaord +1. Dashboard 2. Host logging utility (e.g. winlogbeat) 3. Serverside (e.g. logstash) diff --git a/docs/markdown/maintenance/upgrading.md b/docs/markdown/maintenance/upgrading.md index bdb28433..5e7bf038 100644 --- a/docs/markdown/maintenance/upgrading.md +++ b/docs/markdown/maintenance/upgrading.md @@ -1,7 +1,7 @@ # Upgrading ## 1 Upgrade Paths -LME is currently on v1.0. +LME is currently on v1.x.x. Below you can find the upgrade paths that are currently supported and what steps are required for these upgrades. Note that major version upgrades tend to include significant changes, and so will require manual intervention and will not be automatically applied, even if auto-updates are enabled. @@ -23,7 +23,7 @@ sudo cp /opt/lme_old/files_for_windows.zip /opt/lme/ sudo cp /opt/lme_old/lme.conf /opt/lme/ sudo cp /opt/lme_old/lme_update.sh /opt/lme/ ``` -Finally, you'll need to grab your old dashbouard_update password and add it into the new dashboard_update script: +Finally, you'll need to grab your old dashboard_update password and add it into the new dashboard_update script: ``` OLD_Password=[OLD_PASSWORD_HERE] sudo cp /opt/lme/Chapter\ 3\ Files/dashboard_update.sh /opt/lme/ @@ -60,7 +60,6 @@ Most data from the old LME should display just fine in the new dashboards, but t cd /opt/lme/ sudo ./dashboard_update.sh ``` -If there are issues its possible the version didn't update in `/opt/lme/lme.conf`. Change it to `1.0` if it did not. The rules built-in to the Elastic SIEM can then be updated to the latest version by following the instructions listed in [Chapter 4](/docs/markdown/chapter4.md#42-enable-the-detection-engine) and selecting the option to update the prebuilt rules when prompted, before making sure all of the rules are activated: From 545265c5bf6c6029ef7d391185ff854ef9ae97e7 Mon Sep 17 00:00:00 2001 From: Linda Lovero-Waterhouse Date: Mon, 27 Nov 2023 16:36:34 -0500 Subject: [PATCH 5/6] added link to releases directory so we don't have to specify current release number --- docs/markdown/maintenance/upgrading.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/markdown/maintenance/upgrading.md b/docs/markdown/maintenance/upgrading.md index 5e7bf038..a15e1ddf 100644 --- a/docs/markdown/maintenance/upgrading.md +++ b/docs/markdown/maintenance/upgrading.md @@ -1,7 +1,7 @@ # Upgrading ## 1 Upgrade Paths -LME is currently on v1.x.x. +Please see https://github.com/cisagov/LME/releases/ for our latest release. Below you can find the upgrade paths that are currently supported and what steps are required for these upgrades. Note that major version upgrades tend to include significant changes, and so will require manual intervention and will not be automatically applied, even if auto-updates are enabled. From 43656b29e943c4357ced39223cf30f16994af2cb Mon Sep 17 00:00:00 2001 From: Linda Lovero-Waterhouse Date: Tue, 28 Nov 2023 10:23:09 -0500 Subject: [PATCH 6/6] fixed more typos --- testing/Readme.md | 2 +- testing/SetupTestbed.ps1 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/testing/Readme.md b/testing/Readme.md index d2b6eed9..45301981 100644 --- a/testing/Readme.md +++ b/testing/Readme.md @@ -19,7 +19,7 @@ This script does not install LME; it simply creates a fresh environment that's r | $NumClients | -n | The number of Windows clients to create; maximum 16; defaults to 1 | No | | $AutoShutdownTime | | The auto-shutdown time in UTC (HHMM, e.g. 2230, 0000, 1900); auto-shutdown not configured if not provided | No | | $AutoShutdownEmail | | An email to be notified if a VM is auto-shutdown. | No | -| $AllowedSources | -s | Comma-Seperated list of CIDR prefixes or IP ranges, e.g. XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc..., that are allowed to connect to the VMs via RDP and ssh. | Yes | +| $AllowedSources | -s | Comma-Separated list of CIDR prefixes or IP ranges, e.g. XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc..., that are allowed to connect to the VMs via RDP and ssh. | Yes | | $NoPrompt | -y | Switch, run the script with no prompt (useful for automated runs). By default, the script will prompt the user to review paramters and confirm before continuing. | No | Example: diff --git a/testing/SetupTestbed.ps1 b/testing/SetupTestbed.ps1 index 4aafb125..4c5a347b 100644 --- a/testing/SetupTestbed.ps1 +++ b/testing/SetupTestbed.ps1 @@ -46,7 +46,7 @@ param ( [Alias("s")] [Parameter(Mandatory=$true, - HelpMessage="XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc... Comma-Seperated list of CIDR prefixes or IP ranges" + HelpMessage="XX.XX.XX.XX/YY,XX.XX.XX.XX/YY,etc... Comma-Separated list of CIDR prefixes or IP ranges" )] [string]$AllowedSources,