Monday, April 24, 2023

Security Onion 2.4 Beta 2 Release Now Available!

We recently released the first Beta version of Security Onion 2.4:

Today, we are excited to release the second Beta version of Security Onion 2.4!

Release Notes

Please review the Release Notes for changes in this release:

Known Issues

Here are some known issues that should be resolved in later releases:

  • You cannot do an in-place upgrade from 2.3 to 2.4. We are still investigating data migration.
  • You must perform a new installation of Rocky Linux 9 Minimal and have full Internet access. We hope to have a 2.4 ISO image in a future release.
  • Upgrades from this 2.4 Beta release to anything else will not be supported. Starting in RC2 we will support soup to upgrade 2.4 grids.
  • Airgap mode is not supported at this time. This is due to a 3rd party dependency but will be supported in RC1. 
  • Ubuntu 20.04 support is not available until RC1. This has to do with a 3rd party dependency. 
  • ATT&CK Navigator doesn’t work correctly yet.
  • so-import-evtx imports logs but they don't get parsed correctly.
  • The following installation modes are NOT supported at this time:
    • Heavy Node
    • Receiver Node
    • Analyst Workstation

Transition from 2.3 to 2.4

When we release the final version of Security Onion 2.4, we will announce an End Of Life (EOL) date for Security Onion 2.3. Security Onion 2.3 will continue to receive security patches and priority bug fixes until it reaches EOL.


You can find 2.4 documentation at:

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

Warnings and Disclaimers

  • This is Beta software. It is not a finished product.
  • Beta software is not officially supported for production usage.
  • Ask your doctor if Beta software is right for you.
  • Using Beta software can cause a disruption in the space time continuum.
  • If it breaks, you get to keep both pieces!

Enough warnings and disclaimers? Let’s go!


Our Security Onion 2.4 ISO image is not quite ready yet so for now you'll need to download Rocky Linux 9 Minimal:

Then check the checksum:

Next, install Rocky Linux 9 and start our Security Onion installation as shown here:

Once you've installed Rocky Linux 9 Minimal and started our Setup wizard, we highly recommend that you start with a simple IMPORT installation as shown here:

Once you have verified proper IMPORT installation, you can then try EVAL, STANDALONE, and DISTRIBUTED deployments as described here:

Questions, Problems, and Feedback

If you have any questions or problems relating to Security Onion 2.4, please use the new 2.4 category at our Discussions site:

We welcome your detailed feedback!

Screenshot Tour

No comments:

Search This Blog

Featured Post

Quick Malware Analysis: WORD MACRO --> SSLOAD --> COBALT STRIKE pcap from 2024-04-18

Thanks to Brad Duncan for sharing this pcap from 2024-04-18 on his malware traffic analysis site! Due to issues with Google flagging a warni...

Popular Posts

Blog Archive