Snort 2.9.16.0 now available for Security Onion!

The following packages are now available for Security Onion:

securityonion-daq - 2.0.7-1ubuntu1securityonion2
securityonion-snort - 2.9.16.0-1ubuntu1securityonion1

These packages resolve the following issue:

Snort 2.9.16.0 #1755
https://github.com/Security-Onion-Solutions/security-onion/issues/1755

Thanks
Thanks to Cisco for Snort 2.9.16.0!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
We've got a new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes.  We also offer online classes as well.  For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Suricata 4.1.8 now available for Security Onion!

securityonion-suricata - 4.1.8-1ubuntu1securityonion1 is now available for Security Onion and should resolve the following issue:

Suricata 4.1.8 #1760
https://github.com/Security-Onion-Solutions/security-onion/issues/1760

Thanks
Thanks to the Suricata team for Suricata 4.1.8!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Building a Minimal VM for sosetup-minimal

Please let us know if there are other topics you'd like us to cover in future videos!

Elastic 6.8.8 now available for Security Onion!

UPDATE 2020-04-22 7:00 Looks like there is an issue with domainstats in this release.  So if you're running domainstats, please do not update until we have resolved this issue.

UPDATE 2020-04-22 8:27 We've pushed a new domainstats image which should resolve this issue.

The following updates are now available for Security Onion!

• Elastic 6.8.8 Docker images
• securityonion-elastic - 20190510-1ubuntu1securityonion93

These updates should resolve the following issues:

Elastic 6.8.8 #1746
https://github.com/Security-Onion-Solutions/security-onion/issues/1746

LOGSTASH_MINIMAL doesn't include Beat config #1751
https://github.com/Security-Onion-Solutions/security-onion/issues/1751

securityonion-elastic: improve elasticsearch ingest parsing for sysmon logs via Wazuh #1754
https://github.com/Security-Onion-Solutions/security-onion/issues/1754

securityonion-elastic: bro_files file_ip should be copied to source_ip #1742
https://github.com/Security-Onion-Solutions/security-onion/issues/1742

securityonion-elastic: remove [data][sysmon][targetfilename] from winlogbeat sysmon parsing #1752
https://github.com/Security-Onion-Solutions/security-onion/issues/1752

securityonion-elastic: so-elastic-reset does not remove closed indices #1759
https://github.com/Security-Onion-Solutions/security-onion/issues/1759

securityonion-elastic: so-elastic-reset needs to disable elastalert and then re-enable afterward #1735
https://github.com/Security-Onion-Solutions/security-onion/issues/1735

so-import-pcap-configure: running alone results in error #1740
https://github.com/Security-Onion-Solutions/security-onion/issues/1740

Unanchored regexes in 8001_postprocess_common_ip_augmentation.conf wrongly skip geoip #1244
https://github.com/Security-Onion-Solutions/security-onion/issues/1244

Thanks
Thanks to the Elastic team for Elastic 6.8.8!
Thanks to Wes Lambert and John Bernal for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Security Onion Hybrid Hunter 1.2.1 - Beta 1 Available for Testing!

In 2018, Security Onion Solutions started working on the next major version of Security Onion, code-named Hybrid Hunter:
https://blog.securityonion.net/2018/11/security-onion-hybrid-hunter-101-tech.html

Today we are proud to release Security Onion codenamed “Hybrid Hunter” 1.2.1 aka Beta 1. Hybrid Hunter 1.2.1 officially supports Ubuntu 18.04 and CentOS 7, which means it no longer supports Ubuntu 16.04.  Our ISO image will continue to be based on CentOS 7 for the foreseeable future. There are plans to support CentOS 8 once podman reaches full compatibility with docker.

This release moves us to Elastic 7 and begins to embrace Elastic Common Schema (ECS). This change includes overhauled dashboards and a new prefix of "so-" for Elasticsearch indices. Among other advantages, migrating to ECS means that other products using ECS should more easily inter-operate with Hybrid Hunter. Over the next few releases, we plan to embrace ECS more fully. Stay tuned!

Finally, we are very excited to announce the introduction of the Security Onion Console! Over the next few releases, we will continue to improve and add more functionality to the Security Onion Console. Check it out and let us know what you think!

To read more and download Hybrid Hunter, please see:
https://github.com/Security-Onion-Solutions/securityonion-saltstack/wiki/ISO
https://github.com/Security-Onion-Solutions/securityonion-saltstack/blob/master/README.md

If you have any questions about Hybrid Hunter, please post a message on our reddit community and prefix the title with [Hybrid Hunter]!
https://www.reddit.com/r/securityonion/


Major Highlights in this Release

• Full support for Ubuntu 18.04. Ubuntu 16.04 is no longer supported for Hybrid Hunter.
• Elastic 7.6.1 with ECS support
• New set of Kibana dashboards that align with ECS
• Introduction of the Security Onion Console. Once logged in you are directly taken to the SOC.
• New authentication using Kratos
• Community ID support for Zeek, osquery, and Suricata. You can now tie host events to connection logs!
• During install you must specify how you would like to access the SOC UI. This is for strict cookie security.
• Ability to list and delete web users from the SOC UI
• The soremote account is now used to add nodes to the grid vs using socore.
• Eval mode no longer uses Logstash for parsing (Filebeat -> ES Ingest)
• Ingest node parsing for osquery-shipped logs (osquery, Windows event logs, Sysmon)
• Fleet standalone mode with improved Web UI & API access control
• Improved Fleet integration support
• Playbook now has full Windows Sigma community ruleset builtin
• Automatic Sigma community rule updates
• Playbook stability enhancements
• Zeek health check. Zeek will now auto restart if a worker crashes
• zeekctl is now managed by salt
• Grafana dashboard improvements and cleanup
• Moved logstash configs to pillars
• Salt logs moved to /opt/so/log/salt
• Strelka integrated for file-oriented detection/analysis at scale

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

Josh Brower
Jason Ertel
Wes Lambert
Josh Patterson
Mike Reeves
William Wernert


Screenshots

Security Onion Console - User Administration

Security Onion Console - User Details

Security Onion Console - Deleting User

Security Onion Console - Downloads

Zeek 3.0.5 now available for Security Onion!

The following updates are now available for Security Onion!

securityonion-bro - 3.0.5-1ubuntu1securityonion1 (Zeek 3.0.5)
securityonion-bro-afpacket - 1.3.0-1ubuntu1securityonion22
securityonion-bro-scripts - 20121004-0ubuntu0securityonion105

These updates should resolve the following issues:

Zeek 3.0.5 #1757
https://github.com/Security-Onion-Solutions/security-onion/issues/1757

Thanks
Thanks to the Zeek team for Zeek 3.0.5!
Thanks to Wes Lambert for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

securityonion-sostat - 20120722-0ubuntu0securityonion144 now available for Security Onion!

securityonion-sostat - 20120722-0ubuntu0securityonion144 is now available for Security Onion and should resolve the following issue:

sostat: don't show pf_ring output if af_packet in use #1623
https://github.com/Security-Onion-Solutions/security-onion/issues/1623

Thanks
Thanks to Wes Lambert for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion328 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion328 is now available for Security Onion and should resolve the following issue:

securityonion-setup: change /nsm/bro to /nsm/zeek in a few user facing messages #1753
https://github.com/Security-Onion-Solutions/security-onion/issues/1753

Thanks
Thanks to Wes Lambert for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Looking Back Over 1 Million Security Onion ISO Downloads

Our Security Onion ISO image has been downloaded over 1 million times!  Thanks to our entire community for your support!  If you haven't already downloaded your copy, head on over to https://securityonion.net/download!

When I started Security Onion way back in 2008, I never would have imagined that we would hit 1 million downloads.  Let's take a walk down memory lane and see how we got here.

9/3/2008 First Security Onion blog post
https://blog.securityonion.net/2008/09/security-onion.html

10/22/2008 Started working on the first Security Onion ISO based on Ubuntu 8.04
https://blog.securityonion.net/2008/10/security-onion-livecd.html

6/4/2009 first Security Onion release based on Xubuntu 9.04
https://blog.securityonion.net/2009/06/security-onion-livecd-is-now-available.html

6/16/2009 added Bro
https://blog.securityonion.net/2009/06/security-onion-livecd-20090613.html

8/16/2009 started building Security Onion community - mailing list, issue tracker, wiki
https://blog.securityonion.net/2009/08/security-onion-on-google-code.html

10/12/2010 new version of Security Onion based on Xubuntu 10.04 and including Suricata
https://blog.securityonion.net/2010/10/security-onion-live-20101010-edition.html

1/5/2011 new release includes Squert web interface, new Setup script, and OSSEC HIDS
https://blog.securityonion.net/2011/01/security-onion-20110101.html
https://blog.securityonion.net/2011/01/security-onion-20110101-setup-script.html
https://blog.securityonion.net/2011/01/security-onion-20110101-ossec-and-sguil.html

1/6/2011 Richard Bejtlich suggests in-place upgrade:
https://blog.securityonion.net/2011/01/security-onion-20110101.html?showComment=1294317204238#c2797095959331531686
https://blog.securityonion.net/2011/01/security-onion-upgrade-script.html

4/7/2011 distributed deployments
https://blog.securityonion.net/2011/04/security-onion-20110321-distributed.html

10/19/2011 disabling NIC offloading
https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html

12/31/2012 Security Onion 12.04 included all components built as Ubuntu packages
https://blog.securityonion.net/2012/12/security-onion-1204-is-now-available.html

6/10/2013 Security Onion 12.04.1
https://blog.securityonion.net/2013/06/security-onion-12041-iso-image-now.html

7/25/2013 Security Onion 12.04.2
https://blog.securityonion.net/2013/07/security-onion-12042-iso-image-now.html

9/12/2013 Mike Reeves developed OnionSalt for managing distributed deployments
https://blog.securityonion.net/2013/09/new-package-onionsalt-now-available-for.html

9/14/2013 Security Onion 12.04.3
https://blog.securityonion.net/2013/09/security-onion-12043-iso-image-now.html

2/28/2014 Security Onion 12.04.4
https://blog.securityonion.net/2014/02/security-onion-12044-iso-image-now.html

7/7/2014 Security Onion Solutions LLC
https://blog.securityonion.net/2014/07/introducing-security-onion-solutions-llc.html

9/12/2014 First ever Security Onion Conference and Security Onion 12.04.5
https://securityonion.readthedocs.io/en/latest/conference.html
https://www.eventbrite.com/e/security-onion-conference-soc-2014-tickets-12205183031#
https://blog.securityonion.net/2014/09/security-onion-12045-iso-image-now.html

2/16/2015 Security Onion 12.04.5.1
https://blog.securityonion.net/2015/02/security-onion-120451-iso-image-now.html

7/6/2015 Security Onion 12.04.5.2
https://blog.securityonion.net/2015/07/security-onion-120452-iso-image-now.html

9/12/2015 Security Onion 12.04.5.3
https://blog.securityonion.net/2015/09/security-onion-120453-iso-image-now.html

1/20/2016 Security Onion 14.04.3.1
https://blog.securityonion.net/2015/09/security-onion-120453-iso-image-now.html
https://blog.securityonion.net/2016/01/security-onion-140431-screenshot-tour.html

3/28/2016 Security Onion 14.04.4.1
https://blog.securityonion.net/2016/03/security-onion-140441-iso-image-now.html

6/13/2016 Security Onion 14.04.4.2
https://blog.securityonion.net/2016/06/security-onion-140442-iso-image-now.html

9/9/2016 Security Onion 14.04.5.1
https://blog.securityonion.net/2016/09/security-onion-140451-iso-image-now.html

2/20/2017 Security Onion 14.04.5.2
https://blog.securityonion.net/2017/02/security-onion-140452-iso-image-now.html

3/16/2017 started integrating the Elastic stack
https://blog.securityonion.net/2017/03/towards-elk-on-security-onion.html

4/9/2018 Security Onion 14.04.5.11 and Elastic GA
https://blog.securityonion.net/2018/04/security-onion-elastic-stack-general.html

4/18/2018 Security Onion 14.04.5.12
https://blog.securityonion.net/2018/04/security-onion-1404512-iso-image-now.html

5/1/2018 Security Onion 14.04.5.13
https://blog.securityonion.net/2018/05/security-onion-1404513-iso-image-now.html

5/31/2018 Security Onion 16.04.4.1
https://blog.securityonion.net/2018/05/security-onion-160441-iso-image-now.html

6/8/2018 over 600,000 Security Onion ISO downloads!
https://blog.securityonion.net/2018/06/security-onion-is-over-600000-downloads.html

6/25/2018 Security Onion 16.04.4.2
https://blog.securityonion.net/2018/06/security-onion-160442-now-available.html

7/24/2018 Security Onion 16.04.4.3
https://blog.securityonion.net/2018/07/security-onion-160443-now-available.html

8/6/2018 Security Onion 16.04.5.1
https://blog.securityonion.net/2018/08/security-onion-160451-now-available.html

9/4/2018 Security Onion 16.04.5.2
https://blog.securityonion.net/2018/09/security-onion-160452-now-available.html

10/19/2018 Security Onion 16.04.5.3
https://blog.securityonion.net/2018/10/security-onion-160453-now-available.html

11/3/2018 Security Onion Hybrid Hunter announced
https://blog.securityonion.net/2018/11/security-onion-hybrid-hunter-101-tech.html

11/26/2018 Security Onion 16.04.5.4
https://blog.securityonion.net/2018/11/security-onion-160454-now-available.html

12/17/2018 Security Onion 16.04.5.5
https://blog.securityonion.net/2018/12/security-onion-160455-now-available.html

1/14/2019 Security Onion 16.04.5.6
https://blog.securityonion.net/2019/01/security-onion-160456-now-available.html

5/20/2019 Security Onion 16.04.6.1
https://blog.securityonion.net/2019/05/security-onion-160461-now-available.html

8/28/2019 Security Onion 16.04.6.2
https://blog.securityonion.net/2019/08/security-onion-160462-now-available.html

12/4/2019 Security Onion 16.04.6.3
https://blog.securityonion.net/2019/12/security-onion-160463-now-available.html

2/18/2020 Security Onion 16.04.6.4
https://blog.securityonion.net/2020/02/security-onion-160464-iso-image-now.html

3/30/2020 Security Onion 16.04.6.5
https://blog.securityonion.net/2020/03/security-onion-160465-iso-image-now.html

As we look to the future, we are busy refining our next generation Hybrid Hunter platform and hope to release a Beta version soon!  Stay tuned!

20200323 Edition of Security Onion Documentation printed book now available!

Many folks have asked for a printed version of our official online documentation and we're excited to provide that!  Whether you work on airgapped networks or simply want a portable reference that doesn't require an Internet connection or batteries, this is what you've been asking for.

Thanks to Richard Bejtlich for writing the inspiring foreword!

Proceeds go to the Rural Technology Fund!

This 20200323 edition has been updated for our latest ISO image release and includes a 10% discount code for our online training!






This book covers the following Security Onion topics:

• Getting Started
• Analyst Tools
• Network Visibility
• Host Visibility
• Elastic Stack
• Updating
• Customizing for your Environment
• Tuning
• Tricks and Tips
• Services
• Utilities
• Help
• Integrations

Q&A

What is the difference between this book and the online documentation?

This book is the online documentation formatted specifically for print.  It also includes an inspiring foreword by Richard Bejtlich that is not available anywhere else!  Proceeds go to the Rural Technology Fund!  Finally, the printed book includes a 10% discount code for our online training.

Who should get this book?

You should get this book if you work on airgapped networks or simply want a portable reference that doesn't require an Internet connection or batteries! Also anyone who wants to donate to a worthy cause like Rural Technology Fund!

How often will the book be updated?

Currently, we plan to release a new edition of the book every time we release a new version of our ISO image.

What is the difference between this edition and the previous edition?

This edition has been updated for our latest ISO image release!

Where do we get it?

The following URL will always take you to the latest version of the printed book at Amazon:
https://securityonion.net/book

Building a Security Onion virtual machine for so-import-pcap

Please let us know if there are other topics you'd like us to cover in future videos!