Zeek 3.0.13 now available for Security Onion 16.04!

Zeek 3.0.13 was recently released and is a security update:
https://github.com/zeek/zeek/releases/tag/v3.0.13

The following updates are now available for Security Onion 16.04!

• securityonion-bro - 3.0.13-1ubuntu1securityonion1 (Zeek 3.0.13)
• securityonion-bro-afpacket - 1.3.0-1ubuntu1securityonion33
• securityonion-bro-scripts - 20121004-0ubuntu0securityonion112

These updates should resolve the following issue:

Zeek 3.0.13 #1821
https://github.com/Security-Onion-Solutions/security-onion/issues/1821

Thanks

Thanks to the Zeek team for Zeek 3.0.13!

Thanks to Chris Morgret for testing and QA!

Updating

Please see the following page for full update instructions:
https://docs.securityonion.net/en/16.04/upgrade.html

Support

Need support?  Please see:
https://docs.securityonion.net/en/16.04/support.html

Thanks!

Elastic Stack 7.10.2 now available for Security Onion 16.04!

First, please note that Security Onion 16.04 reaches EOL in less than 2 months. Instead of applying this update, most Security Onion 16.04 users should upgrade directly to Security Onion 2:
https://blog.securityonion.net/2021/02/2-month-eol-notice-for-security-onion.html

If you do decide to proceed with this update for Security Onion 16.04, please be reminded of the recent Docker Hub rate limit changes:
https://blog.securityonion.net/2020/10/docker-hub-rate-limits-effective.html

Also please keep in mind that this is the last Elastic release under the Apache license. For more information about Elastic license changes, please see:
https://blog.securityonion.net/2021/02/elastic-license-changes-and-security.html

The following updates are now available for Security Onion 16.04!

• securityonion-elastic - 20190510-1ubuntu1securityonion135
• Elastic 7.10.2 Docker images

These updates should resolve the following issues:

Elastic 7.10.2 #1809
https://github.com/Security-Onion-Solutions/security-onion/issues/1809

Update Kibana dashboard hyperlinks to new url format #1810
https://github.com/Security-Onion-Solutions/security-onion/issues/1810

Delete old Logstash templates #1811
https://github.com/Security-Onion-Solutions/security-onion/issues/1811

Update Apache proxy for Elastic 7.10.2 #1812
https://github.com/Security-Onion-Solutions/security-onion/issues/1812

Update Kibana settings for 7.10.2 #1813
https://github.com/Security-Onion-Solutions/security-onion/issues/1813

Update Elastic auth settings for Elastic 7.10.2 #1817
https://github.com/Security-Onion-Solutions/security-onion/issues/1817

Test Elastic 7.10.2 #1816
https://github.com/Security-Onion-Solutions/security-onion/issues/1816

Thanks

Thanks to the Elastic team for Elastic 7.10.2!

Thanks to Chris Morgret for testing and QA!

Updating

Please see the following page for full update instructions:
https://docs.securityonion.net/en/16.04/upgrade.html

Support

Need support?  Please see:
https://docs.securityonion.net/en/16.04/support.html

Thanks!

Snort 3 and Security Onion 2

Recently, the Snort team released Snort 3! We want to congratulate them on bringing their product to market after much anticipation from the community. We're long-time Snort fans here. Like many of you, we understand Snort's value in the open source network IDS community and, yes, many of our team have lots of cute cushy pigs on our desks!

One of our guiding principles for Security Onion is to encourage, foster, and champion free and open security tools with the goal of providing defenders necessary tools to win. Snort has been one of those tools since Security Onion’s inception in 2008 and is still in our most recent Security Onion 16.04 release. When we released Security Onion 2 in October 2020, it did not include Snort since much has changed in the last decade. We added Suricata to produce NIDS alerts as well as network metadata (previously only provided by Zeek/Bro), all in one multi-threaded application. Security Onion moved away from the unsigned kernel module PF_RING to AF_PACKET, which made integration with Snort 2 a significant challenge. Snort 3 continued in development for a fair bit of time, and represents a fundamental shift in how Snort and, by extension, its rules, work. With the explosive growth of Security Onion 2, our internal road map is stacked with priority items and so we’re not able to integrate Snort 3 right now. However, once we free up some cycles, we will see what it would take to integrate Snort 3.

We strive to bring the best product to market in order to shift the advantage from the adversaries to you in our user community. To that end, improvement of the user experience with data remains our current priority. As always, we value your input. Reach out to us on our Community Support Forum if you have questions or additional feedback.

2 month EOL notice for Security Onion 16.04

On 10/16/2020, we released Security Onion 2 and announced a 6-month EOL notice for Security Onion 16.04:
https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. We will not provide any support for Security Onion 16.04 after April 16, 2021.  Please plan to upgrade or replace any existing 16.04 systems before then. If you have existing installations of Security Onion 16.04, you can upgrade to Security Onion 2:
https://docs.securityonion.net/en/2.3/appendix.html

Elastic License Changes and Security Onion

Elastic License Changes

Elastic has finalized their new Elastic License v2:
https://www.elastic.co/blog/elastic-license-v2
https://www.elastic.co/licensing/elastic-license

For additional background, please see:
https://www.elastic.co/blog/licensing-change
https://www.elastic.co/pricing/faq/licensing
https://www.elastic.co/blog/license-change-clarification
https://www.elastic.co/blog/why-license-change-AWS

To summarize those articles, Elastic is changing their licensing and the Elastic Stack will no longer be available under the Apache license. Basic usage continues to be free, but source code will be dual licensed as either SSPL or Elastic License and binary packages will only be available under the Elastic License.

Here are some important points from https://www.elastic.co/blog/elastic-license-v2:

The Elastic License v2 (ELv2) is a very simple, non-copyleft license, allowing for the right to "use, copy, distribute, make available, and prepare derivative works of the software” and has only three high-level limitations. You cannot:

Provide the products to others as a managed service 

Circumvent the license key functionality or remove/obscure features protected by license keys 

Remove or obscure any licensing, copyright, or other notices

Security Onion and the Elastic Stack

Up until now, Security Onion has distributed the Apache-licensed version of the Elastic Stack by default and provided an option for users to accept the Elastic License and switch to the Features version. Starting in Elastic 7.11, there will be no more Apache version and so we will be distributing the Elastic version under the Elastic License.

We expect that the majority of our users will accept the Elastic License. Those that do will get more features than they previously had under the Apache license.

For those that can't accept the Elastic License or would prefer an open source license, we plan to investigate open source forks as they become available. If we find a suitable open source fork, then we will consider making it an option to users so that you can either accept our default of Elastic License or switch to an open source license.

Next Steps

We are planning releases for both Security Onion 16.04 and Security Onion 2 to include Elastic 7.10.2, which is currently the last version of the Elastic Stack available under the Apache license. We will then start working on integrating Elastic 7.11 into Security Onion 2 under the Elastic License.

Examples

• If you're currently running Security Onion 16.04, then this shouldn't affect you immediately. Currently, we don't have any plans to make any Elastic licensing changes to Security Onion 16.04 since it reaches End of Life on 4/16/2021. However, you should plan to upgrade to Security Onion 2 soon.
• If you're running Security Onion 2 using the current default of Apache-licensed Elastic, then a future update will ask if you want to accept the new Elastic License and, if so, you will then have the option to continue as a free user or upgrade to an Elastic paid plan.
• If you're currently running Security Onion 2 and have manually switched to Elastic Features, then a future update will ask if you want to accept the new Elastic License and you can continue operating as you are today, either as a free user or upgrading to an Elastic paid plan.

Q&A

Does this Elastic License change affect Security Onion 16.04 or Security Onion 2?

This Elastic License change primarily affects Security Onion 2. Since Security Onion 16.04 reaches End of Life on 4/16/2021, we are planning for it to remain on Elastic 7.10.2 which is still under the Apache license. Once Elastic 7.11 is released, we will then start working towards integrating that into Security Onion 2.

Does this Elastic License change mean that Elastic now costs money?

No, if you accept the Elastic License, then you can continue using Elastic for free with the basic feature set.

Which Security Onion components are changing license?

Elastic components are changing to the Elastic License. All other Security Onion components remain under their existing open source licenses.

Is the Elastic License an OSI-approved open source license?

No, the Elastic License is not an OSI-approved open source license. This applies to both Elastic License v1 and Elastic License v2.

Is SSPL an OSI-approved open source license?

No, SSPL is not an OSI-approved open source license. 

Does SSPL apply to Security Onion?

No, SSPL only applies if you are working directly with the dual-licensed Elastic source code and explicitly choose SSPL instead of the Elastic license. Security Onion distributes binary packages, which will only be under the Elastic License and not SSPL.

Is Security Onion allowed to distribute Elastic under the Elastic License?

In 2019, Security Onion Solutions signed an agreement with Elastic allowing us to distribute Elastic Features under Elastic License v1. The new Elastic License v2 explicitly allows for distribution.

What if I have additional questions?

If you have questions specific to Security Onion 2, you can use our community discussions site:

https://securityonion.net/discuss

If you have questions specific to the Elastic License or SSPL, Elastic has published the following email address:

elastic_license@elastic.co

UPDATE 2021/02/10 - Improved the answer to "Does SSPL apply to Security Onion?"