Security Onion 2.4.111 now available!

In October, we released version 2.4.110:

https://blog.securityonion.net/2024/10/security-onion-24110-hurricane-helene.html

Last week, Suricata 7.0.8 was released and it resolves several security issues:

https://suricata.io/2024/12/12/suricata-7-0-8-released/

Today, we are releasing Security Onion 2.4.111 which includes Suricata 7.0.8:

https://docs.securityonion.net/en/2.4/release-notes.html

Known Issues

For a list of known issues, please see:

https://docs.securityonion.net/en/2.4/release-notes.html#known-issues

Existing 2.4 Installations

If you have an existing Security Onion 2.4 installation, you can update to the latest version using soup:

https://docs.securityonion.net/en/2.4/soup.html

Before updating your production deployment, we highly recommend testing the upgrade process on a test deployment that closely matches your production deployment if possible. This is especially important for releases that update components like Salt and Elastic.

New Installations

If this is your first time installing Security Onion 2.4, then we highly recommend starting with an IMPORT installation as shown at:

https://docs.securityonion.net/en/2.4/first-time-users.html

Once you’re comfortable with your IMPORT installation, then you can move on to more advanced installations as shown at:

https://docs.securityonion.net/en/2.4/architecture.html

Documentation

You can find our online documentation here:

https://docs.securityonion.net/en/2.4/

Documentation is always a work in progress. If you find documentation that needs to be updated, please let us know as described in the Feedback section below.

Questions, Problems, and Feedback

If you have any questions or problems relating to Security Onion 2.4, please use the 2.4 category at our Discussions site:

https://github.com/Security-Onion-Solutions/securityonion/discussions/categories/2-4

Security Onion Pro

We recently celebrated 10 years in business by announcing Security Onion Pro:

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

Security Onion Pro includes many enterprise features that folks have been asking for:

• Open ID Connect (OIDC)
• Data at Rest Encryption
• FIPS for the OS
• DoD STIG for the OS
• External Notifications in SOC
• Time Tracking inside of Cases
• Guaranteed Message Delivery

You can read more about these enterprise features at:

https://securityonion.com/pro

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!

https://securityonion.net/training

Security Onion Solutions Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonionsolutions.com/hardware

State of the Onion 2024

We usually have our State of the Onion at the annual Security Onion Conference, but we had to cancel the conference due to Hurricane Helene. As we wrap up 2024, it's a good time to review what we've accomplished in 2024!

Security Onion Pro

We celebrated 10 years as a company by announcing a new set of enterprise features called Security Onion Pro!

https://blog.securityonion.net/2024/07/celebrating-10-years-of-security-onion.html

2.3

Security Onion 2.3 reached End Of Life (EOL) and is no longer supported. If you are still running 2.3, please migrate to Security Onion 2.4 as soon as possible:

https://blog.securityonion.net/2024/04/security-onion-23-has-reached-end-of.html

Videos

Collecting Endpoint Logs with Elastic Agent

https://youtu.be/cGmQMsFuAvw

Ingesting PFSense Firewall Logs in Security Onion 2.4

https://youtu.be/aoH8qZwAxek

Security Onion Essentials 2024

https://blog.securityonion.net/2024/08/security-onion-essentials-2024.html

Tuning Rules with Security Onion Detections

https://youtu.be/DelAmqtU2hg

Releases

We managed to crank out 8 releases of Security Onion 2.4! These releases added things like our new Detections interface, AI summaries, and lots of dashboard updates!

2.4.40

SOC Grid improvements, Dashboards/Hunt improved Events table columns, new analyzers for Cases

https://blog.securityonion.net/2024/01/security-onion-2440-now-available.html

2.4.50

New Community ID and Firewall Auth dashboards, improved Correlate action, new Process ancestors action

https://blog.securityonion.net/2024/02/security-onion-2450-now-available.html

2.4.60

New Process Info action, more endpoint support, new dashboards, BETA Suricata PCAP

https://blog.securityonion.net/2024/03/security-onion-2460-now-available.html

2.4.70

Detections, Telemetry, ElastAlert notifications, more dashboards, Suricata 7.0.5, CyberChef 10.17.0, Zeek 6.0.4

https://blog.securityonion.net/2024/05/security-onion-2470-now-available.html

2.4.80

Kafka, Docker upgrade, Detections improvements

https://blog.securityonion.net/2024/06/security-onion-2480-now-available.html

2.4.90

Detections improvements, updates for Suricata, CyberChef, so-idh, so-nginx

https://blog.securityonion.net/2024/07/security-onion-2490-now-available.html

2.4.100

Elastic 8.14.3, resolve security issues in Docker images

https://blog.securityonion.net/2024/08/security-onion-24100-now-available.html

2.4.110

AI Summaries, Docker 27.2.0, Zeek 6.0.8, CyberChef 10.19.2, Standalone Suricata PCAP

https://blog.securityonion.net/2024/10/security-onion-24110-hurricane-helene.html

Coming Soon

We are working on version 2.4.120 and it is currently scheduled to release in early 2025. It will include lots of new features that will help you peel back the layers of your enterprise and make your adversaries cry!

Quick Malware Analysis: AGENTTESLA VARIANT USING FTP pcap from 2024-12-04

Thanks to Brad Duncan for sharing this pcap from 2024-12-04 on his malware traffic analysis site! Due to issues with Google flagging a warning for the site, we're not including the actual hyperlink but it should be easy to find.

We did a quick analysis of this pcap using Security Onion 2.4.110:

https://blog.securityonion.net/2024/10/security-onion-24110-hurricane-helene.html

If you'd like to follow along, you can do the following:

• install Security Onion 2.4.110 in a VM:
  https://docs.securityonion.net/en/2.4/first-time-users.html
• import the pcap using the SOC Grid interface:
  https://docs.securityonion.net/en/2.4/grid.html#icons-in-lower-left-corner
• optionally enable the DNS lookups feature:
  https://docs.securityonion.net/en/2.4/soc-customization.html?#reverse-dns-lookups

The screenshots at the bottom of this post show some of the interesting alerts, metadata logs, and session transcripts. Want more practice? Check out our other Quick Malware Analysis posts at:

https://blog.securityonion.net/search/label/quick%20malware%20analysis

About Security Onion

Security Onion is a versatile and scalable platform that can run on small virtual machines and can also scale up to the opposite end of the hardware spectrum to take advantage of extremely powerful server-class machines.  Security Onion can also scale horizontally, growing from a standalone single-machine deployment to a full distributed deployment with tens or hundreds of machines as dictated by your enterprise visibility needs. To learn more about Security Onion, please see:
https://securityonion.net

Screenshots

First, we start with the overview of all alerts and logs:

Next, let's look at just the alerts:

Let's drill into the ET MALWARE AgentTesla Exfil via FTP alert:

Let's pivot to full packet capture for the stream:

Switching to ASCII transcript makes it easier to read:

Let's see the related Zeek FTP logs:

We see the same TCP stream as the alert but we also see a new one so let's pivot to PCAP:

Now let's look at the FTP Data:

Here are the actual files transferred: