Xplico 1.2.0 now available for Security Onion!

Thanks to Github user "bugcrash" for finding and reporting several segmentation faults in Xplico!  These issues have been resolved in Xplico 1.2.0:
https://github.com/xplico/xplico/releases/tag/v1.2.0

I've packaged Xplico 1.2.0 and nDPI 1.8 and the following packages are now available in our stable repo:
securityonion-ndpi - 1.8-1ubuntu1securityonion1
xplico - 1.2.0ubuntu1securityonion5

These new packages should resolve the following issues:

Xplico 1.2.0 #863
https://github.com/Security-Onion-Solutions/security-onion/issues/863

Segmentation fault /opt/xplico/bin/msite #1041
https://github.com/Security-Onion-Solutions/security-onion/issues/1041

Segmentation fault /opt/xplico/bin/trigcap #1045
https://github.com/Security-Onion-Solutions/security-onion/issues/1045

Segmentation fault /opt/xplico/bin/mfile #1046
https://github.com/Security-Onion-Solutions/security-onion/issues/1046

Segmentation fault /opt/xplico/bin/mfbc #1047
https://github.com/Security-Onion-Solutions/security-onion/issues/1047

Segmentation fault /opt/xplico/bin/mwebymsg #1048
https://github.com/Security-Onion-Solutions/security-onion/issues/1048

Segmentation fault /opt/xplico/bin/mwmail #1049
https://github.com/Security-Onion-Solutions/security-onion/issues/1049

Segmentation fault /opt/xplico/bin/xplico #1050
https://github.com/Security-Onion-Solutions/security-onion/issues/1050

Segmentation fault /opt/xplico/bin/mpaltalk #1051
https://github.com/Security-Onion-Solutions/security-onion/issues/1051

These packages have been tested by Wes Lambert.  Thanks, Wes!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Conference
Our annual Security Onion Conference will be Friday September 15, 2017:
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Squert 1.6.4 now available for Security Onion!

Pete Nelson submitted a pull request to improve Squert's ip2c cron job.  I've merged this pull request and also fixed an error when trying to remove comments.  The new package version is as follows:
securityonion-squert - 20161212-1ubuntu1securityonion12

This should resolve the following issues:

Issue 1066: Squert: error when removing comment
https://github.com/Security-Onion-Solutions/security-onion/issues/1066

Issue 1067: Squert: ip2c avoid hard loop when file unavailable
https://github.com/Security-Onion-Solutions/security-onion/issues/1067

This package has been tested by Wes Lambert and Pete Nelson.  Thanks, guys!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

You may need to Shift-Reload in your browser and/or empty browser cache to ensure you're running the latest Squert javascript.

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Conference
Our annual Security Onion Conference will be Friday September 15, 2017:
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-elsa-extras - 20151011-1ubuntu1securityonion49 resolves an issue with recent MySQL updates

Ubuntu released new MySQL packages recently:
https://www.ubuntu.com/usn/usn-3174-1/

These packages contain some changes which prevented ELSA from creating new database tables.  I've updated our securityonion-elsa-extras package to set the newly required MySQL permissions and the new package version is as follows:
securityonion-elsa-extras - 20151011-1ubuntu1securityonion49

This should resolve the following issue:

securityonion-elsa-extras: new MySQL packages require changes to elsa user #1065
https://github.com/Security-Onion-Solutions/security-onion/issues/1065

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Conference
Our annual Security Onion Conference will be Friday September 15, 2017:
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Latest MySQL packages may impact ELSA databases

Ubuntu released new MySQL packages yesterday:
https://www.ubuntu.com/usn/usn-3174-1/

These packages contain some changes which may impact ELSA databases.  It is recommended to not install these updates until we can confirm the extent of the changes and any workarounds necessary.

Updates will be posted here as they become available.

UPDATE 2017/01/20 5:00 PM Eastern:
A preliminary ELSA package update has been submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/xHmKLB8kNJg/discussion

UPDATE 2017/01/21 6:09 PM Eastern:
Adding a link to Issue 1065 for tracking:
https://github.com/Security-Onion-Solutions/security-onion/issues/1065

UPDATE 2017/01/23 6:13 AM Eastern:
Published updated ELSA package:
http://blog.securityonion.net/2017/01/securityonion-elsa-extras-20151011.html

NetworkMiner 2.1 now available for Security Onion!

NetworkMiner 2.1 was released recently:
http://www.netresec.com/?page=Blog&month=2017-01&post=NetworkMiner-2-1-Released

I've packaged NetworkMiner 2.1 and the new package version is as follows:
securityonion-networkminer - 20170112-1ubuntu1securityonion1

This should resolve the following issue:

Issue 1060: NetworkMiner 2.1
https://github.com/Security-Onion-Solutions/security-onion/issues/1060

This package has been tested by Wes Lambert and Erik Hjelmvik.  Thanks, guys!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Conference
Our annual Security Onion Conference will be Friday September 15, 2017:
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion155 resolves an issue

The following package is now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion155

This new package should resolve the following issue:

NSM: avoid loading IDS rules twice #1062
https://github.com/Security-Onion-Solutions/security-onion/issues/1062

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Conference
Our annual Security Onion Conference will be Friday September 15, 2017:
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Save the Date: Security Onion Conference 2017

Last year's Security Onion Conference was an overwhelming success!  Videos, slides, and pictures can be found here:
https://securityonion.net/conference

This year's Security Onion Conference will be held in Augusta GA on Friday September 15, 2017 (please mark your calendar!).  This is the day before BSides Augusta, so you may want to plan on attending both:
http://bsidesaugusta.org

We'll publish more details about the Security Onion Conference as they are finalized.

New ELSA packages add support for Bro rfb.log

The following packages are now available:
securityonion-elsa-extras - 20151011-1ubuntu1securityonion48
securityonion-web-page - 20141015-0ubuntu0securityonion72

These new packages should resolve the following issues:

Issue 1036: securityonion-elsa-extras: add pattern for Bro rfb.log
https://github.com/Security-Onion-Solutions/security-onion/issues/1036

Issue 1037: securityonion-web-page: add ELSA queries for Bro rfb.log
https://github.com/Security-Onion-Solutions/security-onion/issues/1037

These packages have been tested by Wes Lambert.  Thanks, Wes!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-http-agent - 0.3.1-0ubuntu0securityonion7 resolves an issue

The following package is now available:
securityonion-http-agent - 0.3.1-0ubuntu0securityonion7

This new package should resolve the following issue:

securityonion-http-agent: update for Bro 2.5 #1058
https://github.com/Security-Onion-Solutions/security-onion/issues/1058

This package has been tested by Wes Lambert and Patrick Schilling.  Thanks, guys!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-onionsalt - 20140917-0ubuntu0securityonion21 resolves an issue

The following package is now available:
securityonion-onionsalt - 20140917-0ubuntu0securityonion21

This new package should resolve the following issue:

Issue 1018: salt: use /etc/sudoers.d/ instead of directly editing /etc/sudoers
https://github.com/Security-Onion-Solutions/security-onion/issues/1018

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion154 resolves an issue

The following package is now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion154

This new package should resolve the following issue:

Issue 1055: NSM: fix spelling error
https://github.com/Security-Onion-Solutions/security-onion/issues/1055

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-rule-update - 20151201-1ubuntu1securityonion10 resolves an issue

The following package is now available:
securityonion-rule-update - 20151201-1ubuntu1securityonion10

This new package should resolve the following issue:

Issue 1054: securityonion-rule-update: Restore stdout/stderr redirect in crontab
https://github.com/Security-Onion-Solutions/security-onion/issues/1054

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-sostat - 20120722-0ubuntu0securityonion69 resolves an issue

The following package is now available:
securityonion-sostat - 20120722-0ubuntu0securityonion69

This new package should resolve the following issues:

sostat: update location of sostat-interface in /var/ossec/etc/ossec.conf #1056
https://github.com/Security-Onion-Solutions/security-onion/issues/1056

sostat: sostat-redacted - change "Port" to "Port " #1057
https://github.com/Security-Onion-Solutions/security-onion/issues/1057

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Pulledpork, rule-update, and several other updates available for Security Onion!

The following packages are now available:
securityonion-menu - 20121026-0ubuntu0securityonion2
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion153
securityonion-pulledpork - 0.7.2-1ubuntu1securityonion4
securityonion-rule-update - 20151201-1ubuntu1securityonion9
securityonion-setup - 20120912-0ubuntu0securityonion233
securityonion-sguild-add-user - 20120726-0ubuntu0securityonion3
securityonion-sostat - 20120722-0ubuntu0securityonion67
securityonion-squert-cron - 20120722-0ubuntu0securityonion11
securityonion-sudoers - 20161221-1ubuntu1securityonion3

These new packages should resolve the following issues:

Issue 1017: PulledPork 0.7.2
https://github.com/Security-Onion-Solutions/security-onion/issues/1017

Issue 1034: securityonion-rule-update: update for PulledPork 0.7.2
https://github.com/Security-Onion-Solutions/security-onion/issues/1034

Issue 1035: Setup: update for PulledPork 0.7.2
https://github.com/Security-Onion-Solutions/security-onion/issues/1035

Issue 1040: securityonion-sudoers: remove secure_path
https://github.com/Security-Onion-Solutions/security-onion/issues/1040

Issue 1043: NSM: create /usr/sbin/broctl
https://github.com/Security-Onion-Solutions/security-onion/issues/1043

Issue 1044: sostat: use full path for bro-cut
https://github.com/Security-Onion-Solutions/security-onion/issues/1044

Issue 1042: Move scripts from /usr/bin/ to /usr/sbin/
https://github.com/Security-Onion-Solutions/security-onion/issues/1042

These packages have been tested by Wes Lambert and Rob Bardo.  Thanks!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Release Notes
If you're behind a proxy, you may need to pass the -W option to PulledPork:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Proxy#pulledpork

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

UPDATE 2017-01-09: Added Release Notes regarding PulledPork's -W option.

Snort 2.9.9.0 now available for Security Onion!

Snort 2.9.9.0 was recently released:
http://blog.snort.org/2016/12/snort-2990-has-been-released.html

I've packaged it and the following package is now available:
securityonion-snort - 2.9.9.0-1ubuntu1securityonion1

This new package should resolve the following issue:

Issue 1031: Snort 2.9.9.0
https://github.com/Security-Onion-Solutions/security-onion/issues/1031

This package has been tested by Wes Lambert.  Thanks, Wes!

Updating
This package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

This update will back up each of your existing snort.conf files to snort.conf.bak and migrate your HOME_NET and EXTERNAL_NET variables.  You'll then need to do the following:

• re-apply any other local customizations to your snort.conf file(s)
• update ruleset and restart Snort as follows:
  sudo rule-update

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!