Security Onion: August 2019

Security Onion 16.04.6.2 is now available!

Security Onion 16.04.6.2

Major Changes Since Last ISO Image

Elastic 6.8.2
Wazuh 3.9.5
CyberChef 9.2.0
Bro 2.6.3
Snort 2.9.13.0
PulledPork 0.7.3
Users can now run Setup interactively via GUI or CLI
Users can now optionally switch from open source Elastic Stack to Elastic Features using so-elastic-features
Users can now optionally enable native Elastic auth using so-elastic-auth (which automatically runs so-elastic-features and then configures all processes for native Elastic auth)
so-import-pcap has been overhauled!
fixed lots of bugs!

sosetup-minimal
sosetup-minimal will run the normal sosetup and then reconfigure the Elastic Stack to run in minimal mode. This minimal mode is designed to minimize RAM and CPU usage. This means that sosetup-minimal can run Evaluation Mode in only 4GB RAM! However, please note that the minimal Logstash config is intended to only do a basic parsing of NIDS alerts and JSON-formatted Bro logs so it won't support additional logs like sysmon and autoruns by default. It also doesn't do additional decoration or augmentation like domainstats or freqserver. You can see an example of sosetup-minimal in the Screenshot Tour at the end of this blog post.

Thanks
Thanks to Josh Brower for testing this ISO image!

Package Updates
This release also includes the following updated packages:
pinguybuilder - 20180514-1ubuntu1securityonion19
securityonion-iso - 20151016-1ubuntu1securityonion33

These packages resolve the following issues:

pinguybuilder: increment version to 16.04.6.2 #1624
https://github.com/Security-Onion-Solutions/security-onion/issues/1624

so-iso-build: purge /var/ossec/queue/diff #1543
https://github.com/Security-Onion-Solutions/security-onion/issues/1543

Issues Resolved
For a list of all issues resolved in this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/projects/7

Release Notes
For more information about this release, please see:
https://securityonion.net/docs/release-notes.html

Installation Guide
We've updated the Installation guide to reflect the download locations for the new ISO image:
https://securityonion.net/docs/installation.html

Existing Deployments
If you have existing 16.04 installations, there is no need to download the new ISO image. You can simply continue using our standard update process to install updated packages as they are made available:
https://securityonion.net/docs/Upgrade

If you have existing installations of Security Onion 14.04, you can upgrade from 14.04 to 16.04:
https://securityonion.net/docs/upgrading-from-14.04-to-16.04.html

Conference
Only a few weeks left to register for Security Onion Conference 2019 on Friday, October 4, 2019!
https://socaugusta2019.eventbrite.com/

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Security Onion Training classes coming up in Columbia MD and Augusta GA! If you can't make it to an onsite class, we have a new online training platform. For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site! Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Support
Need support? Please see:
https://securityonion.net/docs/Support

Screenshot Tour