Security Onion Conference 2024 Save the Date and CFP

Our 11th annual Security Onion Conference is currently scheduled to be held in person in Augusta, GA on Friday, October 4, 2024. Registration will open July 18.

CFP

Want to speak at Security Onion Conference? We want to hear from you!

How are you...

...using Security Onion to find evil?

...handling lots of traffic using Security Onion?

...integrating Security Onion with other technologies?

...automating common tasks with your own scripts?

...using Security Onion in a unique way?

Each talk should be 45 minutes, including time for questions. Submit your talk here:
https://securityonion.net/cfp

Schedule

April 29 - CFP open

June 24 - CFP closes

July 18 - Speakers selected and notified

July 18 - Registration opens at Noon Eastern Time

September 30 through October 3 - Security Onion 4-day training in Augusta

October 4 - Security Onion Conference

October 5 - BSidesAugusta

Previous Conferences

Want to see talks from previous Security Onion Conferences?

https://securityonion.net/conf

New Security Onion Online Training Class - Detection Engineering with Security Onion!

We've just added an exciting new course to our online Security Onion 2.4 training catalog! It's called "Detection Engineering with Security Onion" and it's a scenario based approached to addressing detection gaps using Security Onion 2.4.

Security Onion training is BY defenders FOR defenders and your instructor for this class is Bryant Treacle!

This course is geared for those wanting to understand how to build a Detection Playbook with Security Onion 2.4. Students will gain both a theoretical and practical understanding of building detections in Security Onion, reinforced with real-life examples from network and host data sources.

This course briefly covers the following topics:

• The Detection Engineering process
• Writing, Testing & Deploying to Production - Suricata Rules
• Writing, Testing & Deploying to Production - Yara Signatures
• Configuring Zeek to extract additional filetypes
• Developing a host baseline using osquery packs 
• Configuring an Security Onion Intrusion Detection Honeypot (IDH) Node.

Here's the full curriculum:

Upon completing the class, attendees will receive a Certificate of Completion.

Purchase "Detection Engineering with Security Onion" by itself or in a 3-course bundle!

For more information and to purchase, please see:

https://onlinetraining.securityonionsolutions.com/

Top 5 Reasons to Sign Up for our 4-day Security Onion Fundamentals for Analysts & Admins Class in June 2024

Security Onion Solutions has been teaching Security Onion classes since 2014. Since that time, we've taught students around the globe to help them peel back the layers of their enterprise and make their adversaries cry!

Our next class is in June. Why should you sign up? Here are the top 5 reasons!

1. Amazing instructors

Our instructors are not like other instructors that just read from a slide deck. Security Onion Solutions instructors have years of experience in threat hunting, enterprise security monitoring, and log management. They have worked in real-world operational security roles, engineered monitoring strategies and solutions, and handled real-world incidents. They bring their practical experience to the classroom, enabling students in both theory and hands-on application to hunt adversaries in environments large and small.

2. Comprehensive course material and labs

As a student, you will receive over 300 pages of course material filled with tips and tricks to help you peel back the layers of your enterprise and make your adversaries cry. That amazing content is reinforced by the immersive real-world case studies.

3. Training for Security Onion 2.4

We released Security Onion 2.4 last year with many new features and we've continued to add new features at each new release. This class will help you take advantage of all those new features!

4. We teach the only OFFICIAL training for Security Onion

Security Onion Solutions is the only official provider of Security Onion training. If you want the best training, get it from the company that developed the platform!

5. Support development of the free and open platform

Security Onion has been a free and open platform since 2008. We've invested many years of development into making Security Onion even better at helping you peel back the layers of your enterprise and making your adversaries cry. If you purchase training from us, you are helping to cover the cost of developing and maintaining the Security Onion platform, now and in the future.

Sign up today

There are a limited number of seats for this amazing class and the registration deadline is June 10, 2024. Don't delay, reserve your seat today!

https://securityonionjune2024.eventbrite.com/

Security Onion 2.3 has reached End Of Life

On 10/6/2023, we announced a 6-month EOL notice for Security Onion 2.3:

https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html

Security Onion 2.3 has now reached End Of Life. If you still have existing installations of Security Onion 2.3, please upgrade to Security Onion 2.4:

https://docs.securityonion.net/en/2.4/appendix.html

Security Onion and the xz Vulnerability

Recently, a vulnerability was reported in the xz library:

https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

https://www.cve.org/CVERecord?id=CVE-2024-3094

https://nvd.nist.gov/vuln/detail/CVE-2024-3094

https://www.openwall.com/lists/oss-security/2024/03/29/4

https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

Security Onion is NOT affected by this vulnerability.

Searching for xz Vulnerability across non-Security Onion Devices

If you have Security Onion deployed in your enterprise with Elastic Agent deployed to your endpoints, you can use Osquery Manager to search for vulnerable xz packages as shown in these Github gists by James Spiteri.

Linux:

https://gist.github.com/jamesspi/ee8319f55d49b4f44345c626f80c430f

macOS:

https://gist.github.com/jamesspi/5cb060b5e0e2d43222a71c876b56daab

For example, here's the Linux query run across several Linux endpoints (hostnames excluded from the screenshot):

10% Early Bird discount for Security Onion Fundamentals for Analysts & Admins Class in June 2024!

 We've scheduled the next run of our 4-day Security Onion Fundamentals for Analysts & Admins class!

Use promo code earlybird by April 16, 2024 to receive 10% off!

For more details and to register, please see:

https://securityonionjune2024.eventbrite.com

If you have any questions about this class, please use the Contact link on the bottom of the Eventbrite page.

For other training options, please see:

https://securityonionsolutions.com/training/

Security Onion 2.3.300 now available!

Security Onion 2.3.300 is now available! It includes updates for both Suricata and Strelka:

https://docs.securityonion.net/en/2.3/release-notes.html#changes

Please note that Zeek now includes Community ID by default. This could potentially cause a problem if you've modified your Zeek config in the past. If you have /opt/so/saltstack/local/pillar/zeek/init.sls, then you should move it another location so that it doesn't override the new Zeek config. For example, please see:

https://github.com/Security-Onion-Solutions/securityonion/discussions/11922

Also note that, if you are running Security Onion as a VM in Proxmox, you may need to update the CPU type of your Security Onion VM due to changes in Docker containers:

https://docs.securityonion.net/en/2.3/proxmox.html#cpu

2.3 EOL

This 2.3.300 release is the LAST release for Security Onion 2.3! Security Onion 2.3 will reach End Of Life (EOL) on April 6, 2024:

https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html

Please migrate to Security Onion 2.4 soon!

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/2.3/

New Installations

If you want to perform a new installation, please review the documentation and then you can find instructions here:

https://docs.securityonion.net/en/2.3/download.html

Existing 2.3 Installations

WARNING! If you have an existing Security Onion 2.3 installation that hasn't yet been updated to version 2.3.140 or higher, then you should be aware that the Elastic components will undergo a major version upgrade to version 8. Please review and follow the steps at the link below. Failure to do so could result in loss of access to all data stored inside of Elastic and a non-functioning Security Onion installation.

https://docs.securityonion.net/en/2.3/soup.html#elastic-8

Please be aware that custom settings in Kibana may be overwritten during upgrade. We recommend that you test the upgrade process on a test deployment before deploying to production. If you have a distributed deployment, then we recommend monitoring SOC Grid while your update is running to verify that all nodes update properly. If there are issues, you can review logs, services, and containers for any additional clues. If you need help, please see our support information below.

If you have custom Elasticsearch templates, please see:

https://docs.securityonion.net/en/2.3/elasticsearch.html#custom-templates

For more information about the update process, please see:

https://docs.securityonion.net/en/2.3/soup.html

AWS Marketplace

Existing Security Onion 2 AMI users should use the "soup" command to upgrade:

https://docs.securityonion.net/en/2.3/soup.html

AMI Documentation:

https://docs.securityonion.net/en/2.3/cloud-ami.html

Azure Marketplace

Existing Security Onion 2 users on Azure should use the "soup" command to upgrade:

https://docs.securityonion.net/en/2.3/soup.html

Azure Documentation:

https://docs.securityonion.net/en/2.3/cloud-azure.html

Questions or Problems

If you have questions or problems, please see our community support forum guidelines:

https://docs.securityonion.net/en/2.3/community-support.html

You can then find the community support forum at:

https://securityonion.net/discuss

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Wes Lambert
• Corey Ogburn
• Josh Patterson
• Mike Reeves

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonionsolutions.com/hardware

Screenshot Tour

If you want the quickest and easiest way to try out Security Onion 2, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM! For more information, please see:

https://docs.securityonion.net/en/2.3/first-time-users.html