Docker Hub Rate Limits Effective November 1, 2020

Introduction

Docker has announced rate limits for Docker pulls that go into effect November 1, 2020. We suspect that most Security Onion users will NOT notice this change. Additional details are below. We are monitoring this situation closely and will send out additional information as necessary.

Docker Hub Rate Limits

From https://www.docker.com/blog/docker-hub-image-retention-policy-delayed-and-subscription-updates/:

"Anonymous free users will be limited to 100 pulls per six hours, and authenticated free users will be limited to 200 pulls per six hours. Docker Pro and Team subscribers can pull container images from Docker Hub without restriction as long as the quantities are not excessive or abusive."

For more information, please see:

https://www.docker.com/increase-rate-limits

https://docs.docker.com/docker-hub/download-rate-limit/

https://www.docker.com/pricing/resource-consumption-updates

When does Security Onion do a Docker Pull?

During installation, Security Onion should only do a "docker pull" if performing a network installation (since ISO installations already have the Docker images).

After installation, Security Onion should only do a "docker pull" when you run soup and soup downloads updated Docker images.

The rest of this blog post will focus on soup updating Docker images.

Security Onion 16.04

Security Onion 16.04 installations include a total of 7 Docker images. If you run soup on an older version of Security Onion 16.04 and it pulls updated Docker images, then that would be 7 docker pulls. This wouldn't come anywhere near the rate limit of 100 pulls per six hours. However, if you have a distributed deployment with multiple nodes all behind a single NAT IP address, then it's possible to start approaching that rate limit. If you experience the rate limit, there are a couple of possible solutions. The first option is to authenticate to Docker to increase the rate limit. The second option is to upgrade to Security Onion 2 which should be less likely to hit the rate limit as we'll describe in the next section. Upgrading to Security Onion 2 is a good idea anyway since Security Onion 16.04 reaches End Of Life in April 2021.

Security Onion 2

Security Onion 2 distributes all components via Docker images. Depending on installation type, that could be upwards of 30 Docker images. If you run soup on an older version of Security Onion 2 and it pulls updated Docker images, then that could be up to 30 docker pulls. Even in the case of a distributed deployment with multiple nodes all behind a single NAT IP address, the default configuration is for the manager to update the Docker images for the entire deployment so it should only be 30 docker pulls for the entire deployment. Therefore, Security Onion 2 should be less likely to hit the rate limit than Security Onion 16.04.

Conclusion

We suspect that most Security Onion users will NOT notice this change. We are monitoring this situation closely and will send out additional information as necessary. If you have any questions or concerns, please reach out to the appropriate community support forum as described here:
https://blog.securityonion.net/2020/10/community-support-forum-changes-for.html

Security Onion Essentials training available now for FREE!

We've just released Security Onion Essentials training for our new Security Onion 2 platform and it's FREE! You can find it on our website at:

https://securityonion.net/training

Are You Seeing What I Am Netsyncing? Analyzing Netsync Activity with Security Onion 2

This blog post was written by Wes Lambert (@therealwlambert), with the assistance of Andrew Schwartz (@4ndr3w6S). Additional thanks go to Doug Burks (@dougburks) and Phil Plantamura (@philplantamura) for their invaluable feedback and review.

Continuing on the excellent work done by Andrew and the TrustedSec team (The Tale Of The Lost, But Not Forgotten, Undocumented Netsync: Part 2) this post is a network-based analysis of the Netsync attack via Mimikatz. Keep in mind, this analysis does not include that of host-based technologies, or the data captured/generated by them, although said data could provide even greater context and investigational capability when utilized with Security Onion.

To read the full article, please see:

https://drive.google.com/file/d/1xKuzWswUeDZrX3HPDZp74BUKQG5LoZ4S/view?usp=sharing

Security Onion 2.3.2 now available!

We recently released Security Onion 2.3:
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

Today, we are releasing Security Onion 2.3.2, which resolves a few issues:
https://docs.securityonion.net/en/2.3/release-notes.html#changes

Documentation

We've started migrating our documentation to 2.3:
https://docs.securityonion.net/en/2.3/

However, this is a work in progress and some documentation may be missing or incorrect. Please let us know if you notice any issues.

Known Issues

https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

New Installations

If you want to do a new installation, please review the 2.3 documentation and then you can find instructions here:
https://docs.securityonion.net/en/2.3/download.html

Existing 2.x Installations

If you have an existing 2.3 GA installation, please see:
https://docs.securityonion.net/en/2.3/soup.html

If you have an existing 2.x Release Candidate (RC1, RC2, or RC3) installation, please see the in-place upgrade notes here:
https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

Security Onion 16.04 EOL

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. Please make plans to replace or upgrade any existing Security Onion 16.04 deployments before then:
https://blog.securityonion.net/2020/10/6-month-eol-notice-for-security-onion.html

Upgrading from Security Onion 16.04

If you're currently running Security Onion 16.04, please see the following for upgrade options:
https://docs.securityonion.net/en/2.3/appendix.html

Questions or Problems

If you have questions or problems, please see our community support forum guidelines:
https://docs.securityonion.net/en/2.3/community-support.html

You can then find the community support forum at:
https://securityonion.net/discuss

Screenshot

Security Onion 2.3.2 ISO Boot Menu

For a full screenshot tour, please see the Security Onion 2.3 blog post:
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

Security Onion 2.3.1 now available!

We recently released Security Onion 2.3:
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

Today, we are releasing Security Onion 2.3.1, which resolves a few issues:
https://docs.securityonion.net/en/2.3/release-notes.html#changes

Documentation

We've started migrating our documentation to 2.3:
https://docs.securityonion.net/en/2.3/

However, this is a work in progress and some documentation may be missing or incorrect. Please let us know if you notice any issues.

Known Issues

https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

New Installations

If you want to do a new installation, please review the 2.3 documentation and then you can find instructions here:
https://docs.securityonion.net/en/2.3/download.html

Existing 2.x Installations

If you have an existing 2.3 GA installation, please see:
https://docs.securityonion.net/en/2.3/soup.html

If you have an existing 2.x Release Candidate (RC1, RC2, or RC3) installation, please see the in-place upgrade notes here:
https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

Security Onion 16.04 EOL

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. Please make plans to replace or upgrade any existing Security Onion 16.04 deployments before then:
https://blog.securityonion.net/2020/10/6-month-eol-notice-for-security-onion.html

Upgrading from Security Onion 16.04

If you're currently running Security Onion 16.04, please see the following for upgrade options:
https://docs.securityonion.net/en/2.3/appendix.html

Questions or Problems

If you have questions or problems, please see our community support forum guidelines:
https://docs.securityonion.net/en/2.3/community-support.html

You can then find the community support forum at:
https://securityonion.net/discuss

Screenshot

Security Onion 2.3.1 ISO Boot Menu

For a full screenshot tour, please see the Security Onion 2.3 blog post:
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

6 month EOL notice for Security Onion 16.04

Last Friday, we released Security Onion 2 and announced a 6-month EOL notice for Security Onion 16.04:
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. We will not provide any support for Security Onion 16.04 after April 16, 2021.  Please plan to upgrade or replace any existing 16.04 systems before then. If you have existing installations of Security Onion 16.04, you can upgrade to Security Onion 2:
https://docs.securityonion.net/en/2.3/appendix.html

Security Onion Conference 2020 recording is now available!

You can also find this video on the Conference page of our new website at:

https://securityonion.net/conference

Community Support Forum changes for Security Onion

Last Friday, we released Security Onion 2!
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

With that release comes some exciting new changes for our community support forums!

Effective immediately:

• If you have questions about the new Security Onion 2 platform, please use our new Github Discussions page!
  https://securityonion.net/discuss
  
  
• If you have questions about the legacy Security Onion 16.04 platform, please continue to use the 16.04 Google Groups:
  http://groups.google.com/group/security-onion

Please keep in mind that all community support is considered best effort. If you need private or priority support, please consider purchasing support from Security Onion Solutions:
https://securityonionsolutions.com/support/

Thanks!

Security Onion 2 Has Reached General Availability (GA)!

In 2018, Security Onion Solutions started working on the next major version of Security Onion, code-named Hybrid Hunter:
https://blog.securityonion.net/2018/11/security-onion-hybrid-hunter-101-tech.html

After 4 Technology Preview releases, 4 Alpha releases, and 3 Beta releases, we dropped the Hybrid Hunter code name and announced 2.0 (RC1), 2.1 (RC2), and 2.2 (RC3). This has been our most ambitious project to date, taking over 34 months and resulting in a whopping 5,034 git commits. Today, we are proud to announce that Security Onion 2.3 has reached General Availability (GA)! 

Changes from Security Onion 16.04

Here are some of the major differences of the new Security Onion 2.3 compared to Security Onion 16.04:

• Features a new web interface called Security Onion Console (SOC) that includes native alert management, threat hunting, and pcap retrieval
• Adds TheHive, Strelka, support for Sigma rules, Grafana/InfluxDB (independent health monitoring/alerting), Fleet (osquery management), and Playbook (detection playbook tool).
• Moves from Ubuntu packages to containers
• Supports both CentOS 7 and Ubuntu 18.04
• Changes pcap collection tool from netsniff-ng to Google Stenographer
• Upgrade to Elastic Stack 7.x and support the Elastic Common Schema (ECS)
• Completely replaces unsigned kernel module PF_RING with AF_PACKET
• Suricata completely replaces Snort. (We may elect to add Snort back after Snort 3.0 is officially released.)
• Removes Sguil, Squert, capME, and PHP
• Storage Nodes are now known as Search Nodes
• The first node in a distributed deployment is now called a Manager

Changes from Security Onion 2.2 RC3

If you tried out Security Onion 2.2 RC3, you will notice some changes in this release.

This release features a brand new web interface for alerts. This includes NIDS alerts from Suricata, HIDS alerts from Wazuh, Playbook alerts, and YARA matches from Strelka. This interface is specifically designed to help you triage alerts as quickly as possible. Slice and dice your alerts with multiple views and then pivot to full packet capture or our Hunt interface to investigate IP addresses or other items of interest. Once you've made a determination about an alert, you can either acknowledge it or escalate it to TheHive to create a case.

Next, we've continued to iterate on Hunt, improving its default queries and default pivot actions. Hunt now supports more customization as well.

Finally, we've continued to improve support for airgap deployments. Airgap deployments now include a local copy of the documentation. Also, airgap deployments now support updates using the latest ISO image.

Documentation

We've started migrating our documentation to 2.3:

https://docs.securityonion.net/en/2.3/

However, this is a work in progress and some documentation may be missing or incorrect. Please let us know if you notice any issues.

Security Onion 16.04 EOL

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. Please make plans to replace or upgrade any existing Security Onion 16.04 deployments before then.

Upgrading from Security Onion 16.04

If you're currently running Security Onion 16.04, please see the following for upgrade options:

https://docs.securityonion.net/en/2.3/appendix.html

Existing Installations

If you have an existing 2.x (RC1, RC2, or RC3) installation, please see the in-place upgrade notes here:
https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

New Installations

If you want to do a new installation, please review the 2.3 documentation and then you can find instructions here:

https://docs.securityonion.net/en/2.3/download.html

Questions or Problems

If you have questions or problems, please see our new community support forum:

https://docs.securityonion.net/en/2.3/community-support.html

Known Issues

https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

Changes from Previous Releases

https://docs.securityonion.net/en/2.3/release-notes.html#changes

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Wes Lambert
• Josh Patterson
• Mike Reeves
• Bryant Treacle
• William Wernert

Screenshot Tour

If you want the quickest and easiest way to try out Security Onion 2, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM!

ISO Boot Menu

ISO Installer

ISO Install Complete

Welcome to Setup

Choose the Setup type

Set hostname

Select management NIC

Configure management NIC

Configure networking

Configure networking

Configure networking

Configure networking

Configure networking

Configure HOME_NET

Create user account

Set password

Confirm password

Choose how you want to access the web interface

Optionally run so-allow

Specify IP address or range to allow through firewall

Confirm options

Setup complete

Optionally enable Analyst Workstation with so-analyst-install

Enter username to login to GNOME

Enter password to login to GNOME

GNOME Desktop

Analyst Workstation includes Chromium, NetworkMiner, and Wireshark

Login to Security Onion Console (SOC)

SOC Overview page

Use so-import-pcap to import one or more pcap files

Use the hyperlink provided by so-import-pcap to review all alerts and logs

New Alerts interface

Use the Quick Action Bar to pivot to the PCAP page for full packet capture

PCAP Overview

PCAP transcript

Download the pcap and open in NetworkMiner for file extraction

All this in a minimal VM with only 4GB RAM!

Suricata 4.1.9 now available for Security Onion 16.04!

securityonion-suricata - 4.1.9-1ubuntu1securityonion1 is now available for Security Onion 16.04 and should resolve the following issue:

Suricata 4.1.9 #1760
https://github.com/Security-Onion-Solutions/security-onion/issues/1788

Thanks

• Thanks to the Suricata team for Suricata 4.1.9!
• Thanks to Chris Morgret for testing!

Updating

Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support

Need support?  Please see:
https://securityonion.net/docs/Support

Documentation

You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training

Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances

For more information about our hardware appliances, please see:
https://securityonionsolutions.com

Thanks!

Zeek 3.0.11 now available for Security Onion 16.04!

Zeek 3.0.11 was recently released and is a security update:
https://github.com/zeek/zeek/releases/tag/v3.0.11

The following updates are now available for Security Onion 16.04!

• securityonion-bro - 3.0.11-1ubuntu1securityonion1 (Zeek 3.0.11)
• securityonion-bro-afpacket - 1.3.0-1ubuntu1securityonion29
• securityonion-bro-scripts - 20121004-0ubuntu0securityonion111

These updates should resolve the following issue:

Zeek 3.0.11 #1792
https://github.com/Security-Onion-Solutions/security-onion/issues/1792

Thanks

• Thanks to the Zeek team for Zeek 3.0.11!
• Thanks to Chris Morgret for testing and QA!

Updating

Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support

Need support?  Please see:
https://securityonion.net/docs/Support

Documentation

You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training

Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances

We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Security Onion Conference 2020 is 10/16/2020 and it's FREE!

Security Onion Conference 2020 will be held on October 16, 2020 as a virtual event!

Over 1,200 people have signed up so far!

We're going to make some major announcements, so you don't want to miss this!

Registration is open and it's FREE!

https://securityonionconference2020.eventbrite.com/