Security Onion: June 2021

Thursday, June 10, 2021

Security Onion 2.3.52 Hotfix available!

Security Onion Solutions recently released Security Onion 2.3.52. Today, we are releasing a hotfix (SALTYSOUP) that resolves an issue that some users experienced when trying to update older installations. The conditions for the issue are as follows:

Security Onion 2.3.21 or lower
CentOS-based installation (using CentOS ISO image or our Security Onion ISO image)
Internet-connected (not airgapped)

If your installation meets that criteria and you had an issue running "soup", you should be able to run it successfully now.

Documentation

You can find our documentation here:
https://docs.securityonion.net/en/2.3/

Documentation is always a work in progress and some documentation may be missing or incorrect. Please let us know if you notice any issues.

Known Issues

Please review the Known Issues list:
https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

New Installations

If you want to perform a new installation, please review the 2.3 documentation and then you can find instructions here: 
https://docs.securityonion.net/en/2.3/download.html

Existing 2.3 Installations

If you have an existing Security Onion 2.3 installation, please see: 
https://docs.securityonion.net/en/2.3/soup.html

AWS Marketplace

For new Security Onion 2 installations, version 2.3.52 is available on AWS Marketplace via the official Security Onion 2 AMI:
https://securityonion.net/aws/?ref=_ptnr_soc_blog_210610

AMI Documentation:
https://securityonion.net/docs/cloud-ami

Existing Security Onion 2 AMI users should use the "soup" command to upgrade:
https://docs.securityonion.net/en/2.3/soup.html

Security Onion 16.04 EOL

As a reminder, Security Onion 16.04 has reached End Of Life (EOL):
https://blog.securityonion.net/2021/04/security-onion-1604-has-reached-end-of.html

If you're still running Security Onion 16.04, please see the following for upgrade options: 
https://docs.securityonion.net/en/2.3/appendix.html

Questions or Problems

If you have questions or problems, please see our community support forum guidelines: 
https://docs.securityonion.net/en/2.3/community-support.html

You can then find the community support forum at: 
https://securityonion.net/discuss

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training, including our new Detection Playbook class!

https://securityonion.net/training

Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonionsolutions.com/hardware

Wednesday, June 9, 2021

Security Onion Conference 2021 Save the Date and CFP

This year's Security Onion Conference is currently scheduled to be held in person in Augusta, GA on Friday, October 1, 2021 (please mark your calendar!). Registration will open August 2.

CFP

Want to speak at Security Onion Conference? We want to hear from you!

How are you...

...using Security Onion to find evil?

...handling lots of traffic using Security Onion?

...consuming host telemetry with Security Onion?

...integrating Security Onion with other technologies?

...automating common tasks with your own scripts?

...using Security Onion in a unique way?

Each talk should be 30 minutes with an additional 10 minutes for questions.

Submit your talk here!

https://securityonion.net/cfp

Schedule

June 9 - CFP open

July 15 - CFP closes

July 28 - Speakers selected and notified

August 2 - Registration opens

September 27 - September 30 - Security Onion 4-day training in Augusta

October 1 - Security Onion Conference

October 2 - BSidesAugusta

Previous Conferences

Want to see talks from previous Security Onion Conferences?

https://securityonion.net/conf

Monday, June 7, 2021

Upcoming Security Onion 2.3.60 Release

The Security Onion Solutions team has been working hard the past few months to bring some exciting features to the release of Security Onion 2.3.60. As we get closer to this release, we’d like to share some of the major changes that you will notice.

Elastic 7.13.2

We are pleased to announce that Elastic 7.13.2 will be included in the 2.3.60 release. This version of Elastic enables us to utilize some of the newer features in the Elastic stack that will improve the overall user experience.

Elastic Authentication

New installations of Security Onion 2.3.60 will utilize Elastic authentication by default. This will allow you to log into Kibana using your Security Onion Console (SOC) credentials. These credentials are synced between Kibana and SOC.

For existing installations, once you run soup to upgrade to Security Onion 2.3.60, you will then be able to enable Elastic authentication manually. All SOC users are required to change their passwords in order to sync with Kibana, so if users do not change their password they will have access to SOC but will not be able to log into Kibana.

Filebeat Module Support

Starting in Security Onion 2.3.60, we are enabling all Filebeat module pipelines. This will make it much easier for you to send additional log types to Security Onion and get them parsed and indexed properly. We will continue to use the existing Security Onion taxonomy for Zeek, Wazuh, Suricata and osquery logs but will be migrating it in a future release for full Elastic Common Schema (ECS) compliance.

Connectivity Changes

New installations of Security Onion 2.3.60 will not have any anonymous access to Elasticsearch or Kibana. Existing installations will allow anonymous connections until you manually enable Elastic authentication. Once this happens all unauthenticated access will be denied.

ETA

We don't have a specific release date for Security Onion 2.3.60 yet, but we are working as hard as we can to get this release ready. Stay tuned!

Security Onion 2.3.52 Now Available!

Recently, Security Onion Solutions released Security Onion 2.3.50:
https://blog.securityonion.net/2021/04/security-onion-2350-now-available.html

Today, we are releasing Security Onion 2.3.52 which fixes some important issues:
https://docs.securityonion.net/en/2.3/release-notes.html#changes