Tuesday, December 22, 2020

Security Onion 2.3.21 now available!

We recently released Security Onion 2.3:


Today, we are releasing Security Onion 2.3.21, which resolves a few issues:



We've started migrating our documentation to 2.3:


However, this is a work in progress and some documentation may be missing or incorrect. Please let us know if you notice any issues.

Known Issues

Please review the Known Issues list:

New Installations

If you want to perform a new installation, please review the 2.3 documentation and then you can find instructions here:


Existing 2.3 Installations

If you have an existing Security Onion 2.3 installation, please see:


Security Onion 16.04 EOL

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. Please make plans to replace or upgrade any existing Security Onion 16.04 deployments before then:


Upgrading from Security Onion 16.04

If you're currently running Security Onion 16.04, please see the following for upgrade options:


Questions or Problems

If you have questions or problems, please see our community support forum guidelines:


You can then find the community support forum at:



Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

  • Josh Brower
  • Jason Ertel
  • Wes Lambert
  • Josh Patterson
  • Mike Reeves
  • Bryant Treacle
  • William Wernert


Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training, including our new Developing Your Detection Playbook class!


Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!


Screenshot Tour

If you want the quickest and easiest way to try out Security Onion 2, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM!

Security Onion 2.3.21 ISO Boot Menu

ISO Installer

ISO Install Complete

Welcome to Setup

Choose the Setup type

Choose Standard or Airgap

Set hostname

Select management NIC

Configure management NIC

Configure networking

Configure networking

Configure networking

Configure networking

Configure networking

Initialize networking

Configure HOME_NET

Create user account

Set password

Confirm password

Choose how you want to access the web interface

Optionally run so-allow

Specify IP address or range to allow through firewall

Confirm options

Setup complete

After rebooting and logging in, optionally run so-analyst-install

so-analyst-install complete

Enter username to login to GNOME

Enter password to login to GNOME

GNOME Desktop

Analyst Workstation includes Chromium, NetworkMiner, Wireshark, and many other analyst tools

Login to Security Onion Console (SOC)

SOC Overview Page

Use so-import-pcap to import one or more pcap files

Use the hyperlink provided by so-import-pcap to view all alerts and logs

SOC's right-click menu has been updated and now includes a new Correlate option to find related logs

Correlate found several related logs

PCAP overview

Download the pcap and open directly in NetworkMiner for file extraction

PCAP transcript

All this in a minimal VM with only 4GB RAM!

No comments:

Search This Blog

Featured Post

Sneak Peek: New Detections Feature coming in Security Onion 2.4.70!

Our latest video is a sneak peek at a NEW feature coming to our FREE and OPEN Security Onion platform in the upcoming 2.4.70 release! This n...

Popular Posts

Blog Archive