Security Onion
Peel Back the Layers of Your Enterprise
Wednesday, May 1, 2024
Sneak Peek: New Detections Feature coming in Security Onion 2.4.70!
Monday, April 29, 2024
Security Onion Conference 2024 Save the Date and CFP
Our 11th annual Security Onion Conference is currently scheduled to be held in person in Augusta, GA on Friday, October 4, 2024. Registration will open July 18.
CFP
Want to speak at Security Onion Conference? We want to hear from you!
How are you...
...using Security Onion to find evil?
...handling lots of traffic using Security Onion?
...integrating Security Onion with other technologies?
...automating common tasks with your own scripts?
...using Security Onion in a unique way?
Each talk should be 45 minutes, including time for questions. Submit your talk here:
https://securityonion.net/cfp
Schedule
April 29 - CFP open
June 24 - CFP closes
July 18 - Speakers selected and notified
July 18 - Registration opens at Noon Eastern Time
September 30 through October 3 - Security Onion 4-day training in Augusta
October 4 - Security Onion Conference
October 5 - BSidesAugusta
Previous Conferences
Want to see talks from previous Security Onion Conferences?
https://securityonion.net/conf
Monday, April 22, 2024
New Security Onion Online Training Class - Detection Engineering with Security Onion!
We've just added an exciting new course to our online Security Onion 2.4 training catalog! It's called "Detection Engineering with Security Onion" and it's a scenario based approached to addressing detection gaps using Security Onion 2.4.
Security Onion training is BY defenders FOR defenders and your instructor for this class is Bryant Treacle!
This course is geared for those wanting to understand how to build a Detection Playbook with Security Onion 2.4. Students will gain both a theoretical and practical understanding of building detections in Security Onion, reinforced with real-life examples from network and host data sources.
This course briefly covers the following topics:
- The Detection Engineering process
- Writing, Testing & Deploying to Production - Suricata Rules
- Writing, Testing & Deploying to Production - Yara Signatures
- Configuring Zeek to extract additional filetypes
- Developing a host baseline using osquery packs
- Configuring an Security Onion Intrusion Detection Honeypot (IDH) Node.
Here's the full curriculum:
Upon completing the class, attendees will receive a Certificate of Completion.
Purchase "Detection Engineering with Security Onion" by itself or in a 3-course bundle!
For more information and to purchase, please see:
https://onlinetraining.securityonionsolutions.com/
Wednesday, April 17, 2024
Top 5 Reasons to Sign Up for our 4-day Security Onion Fundamentals for Analysts & Admins Class in June 2024
Our next class is in June. Why should you sign up? Here are the top 5 reasons!
1. Amazing instructors
Our instructors are not like other instructors that just read from a slide deck. Security Onion Solutions instructors have years of experience in threat hunting, enterprise security monitoring, and log management. They have worked in real-world operational security roles, engineered monitoring strategies and solutions, and handled real-world incidents. They bring their practical experience to the classroom, enabling students in both theory and hands-on application to hunt adversaries in environments large and small.
2. Comprehensive course material and labs
As a student, you will receive over 300 pages of course material filled with tips and tricks to help you peel back the layers of your enterprise and make your adversaries cry. That amazing content is reinforced by the immersive real-world case studies.
3. Training for Security Onion 2.4
We released Security Onion 2.4 last year with many new features and we've continued to add new features at each new release. This class will help you take advantage of all those new features!
4. We teach the only OFFICIAL training for Security Onion
Security Onion Solutions is the only official provider of Security Onion training. If you want the best training, get it from the company that developed the platform!
5. Support development of the free and open platform
Security Onion has been a free and open platform since 2008. We've invested many years of development into making Security Onion even better at helping you peel back the layers of your enterprise and making your adversaries cry. If you purchase training from us, you are helping to cover the cost of developing and maintaining the Security Onion platform, now and in the future.
Sign up today
There are a limited number of seats for this amazing class and the registration deadline is June 10, 2024. Don't delay, reserve your seat today!
https://securityonionjune2024.eventbrite.com/
Monday, April 8, 2024
Security Onion 2.3 has reached End Of Life
On 10/6/2023, we announced a 6-month EOL notice for Security Onion 2.3:
https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html
Security Onion 2.3 has now reached End Of Life. If you still have existing installations of Security Onion 2.3, please upgrade to Security Onion 2.4:
Tuesday, April 2, 2024
Security Onion and the xz Vulnerability
Recently, a vulnerability was reported in the xz library:
https://www.cve.org/CVERecord?id=CVE-2024-3094
https://nvd.nist.gov/vuln/detail/CVE-2024-3094
https://www.openwall.com/lists/oss-security/2024/03/29/4
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
Security Onion is NOT affected by this vulnerability.
Searching for xz Vulnerability across non-Security Onion Devices
If you have Security Onion deployed in your enterprise with Elastic Agent deployed to your endpoints, you can use Osquery Manager to search for vulnerable xz packages as shown in these Github gists by James Spiteri.
Linux:
https://gist.github.com/jamesspi/ee8319f55d49b4f44345c626f80c430f
macOS:
https://gist.github.com/jamesspi/5cb060b5e0e2d43222a71c876b56daab
For example, here's the Linux query run across several Linux endpoints (hostnames excluded from the screenshot):
10% Early Bird discount for Security Onion Fundamentals for Analysts & Admins Class in June 2024!
We've scheduled the next run of our 4-day Security Onion Fundamentals for Analysts & Admins class!
Use promo code earlybird by April 16, 2024 to receive 10% off!
For more details and to register, please see:
https://securityonionjune2024.eventbrite.com
If you have any questions about this class, please use the Contact link on the bottom of the Eventbrite page.
For other training options, please see:
https://securityonionsolutions.com/training/
Monday, April 1, 2024
Security Onion 2.3.300 now available!
Security Onion 2.3.300 is now available! It includes updates for both Suricata and Strelka:
https://docs.securityonion.net/en/2.3/release-notes.html#changes
Please note that Zeek now includes Community ID by default. This could potentially cause a problem if you've modified your Zeek config in the past. If you have /opt/so/saltstack/local/pillar/zeek/init.sls, then you should move it another location so that it doesn't override the new Zeek config. For example, please see:
https://github.com/Security-Onion-Solutions/securityonion/discussions/11922
Also note that, if you are running Security Onion as a VM in Proxmox, you may need to update the CPU type of your Security Onion VM due to changes in Docker containers:
https://docs.securityonion.net/en/2.3/proxmox.html#cpu
2.3 EOL
This 2.3.300 release is the LAST release for Security Onion 2.3! Security Onion 2.3 will reach End Of Life (EOL) on April 6, 2024:
https://blog.securityonion.net/2023/10/6-month-eol-notice-for-security-onion-23.html
Please migrate to Security Onion 2.4 soon!
Documentation
You can find our online documentation here:
https://docs.securityonion.net/en/2.3/
New Installations
If you want to perform a new installation, please review the documentation and then you can find instructions here:
https://docs.securityonion.net/en/2.3/download.html
Existing 2.3 Installations
WARNING! If you have an existing Security Onion 2.3 installation that hasn't yet been updated to version 2.3.140 or higher, then you should be aware that the Elastic components will undergo a major version upgrade to version 8. Please review and follow the steps at the link below. Failure to do so could result in loss of access to all data stored inside of Elastic and a non-functioning Security Onion installation.
https://docs.securityonion.net/en/2.3/soup.html#elastic-8
Please be aware that custom settings in Kibana may be overwritten during upgrade. We recommend that you test the upgrade process on a test deployment before deploying to production. If you have a distributed deployment, then we recommend monitoring SOC Grid while your update is running to verify that all nodes update properly. If there are issues, you can review logs, services, and containers for any additional clues. If you need help, please see our support information below.
If you have custom Elasticsearch templates, please see:
https://docs.securityonion.net/en/2.3/elasticsearch.html#custom-templates
For more information about the update process, please see:
https://docs.securityonion.net/en/2.3/soup.html
AWS Marketplace
Existing Security Onion 2 AMI users should use the "soup" command to upgrade:
https://docs.securityonion.net/en/2.3/soup.html
AMI Documentation:
https://docs.securityonion.net/en/2.3/cloud-ami.html
Azure Marketplace
Existing Security Onion 2 users on Azure should use the "soup" command to upgrade:
https://docs.securityonion.net/en/2.3/soup.html
Azure Documentation:
https://docs.securityonion.net/en/2.3/cloud-azure.html
Questions or Problems
If you have questions or problems, please see our community support forum guidelines:
https://docs.securityonion.net/en/2.3/community-support.html
You can then find the community support forum at:
https://securityonion.net/discuss
Thanks
Lots of love went into this release!
Special thanks to all our folks working so hard to make this release happen!
- Josh Brower
- Jason Ertel
- Wes Lambert
- Corey Ogburn
- Josh Patterson
- Mike Reeves
Training
Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training!
https://securityonion.net/training
Hardware Appliances
We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!
https://securityonionsolutions.com/hardware
Screenshot Tour
If you want the quickest and easiest way to try out Security Onion 2, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM! For more information, please see:
https://docs.securityonion.net/en/2.3/first-time-users.html
Search This Blog
Featured Post
Sneak Peek: New Detections Feature coming in Security Onion 2.4.70!
Our latest video is a sneak peek at a NEW feature coming to our FREE and OPEN Security Onion platform in the upcoming 2.4.70 release! This n...
Popular Posts
-
After more than 12 months of development, 3 Beta releases, and 2 Release Candidates, we are thrilled to announce that Security Onion 2.4 has...
-
Introduction Recent events have forced us to change course on the base operating system (OS) for Security Onion 2.4. On 6/21/2023, Red Hat ...
-
We recently released the second Beta version of Security Onion 2.4: https://blog.securityonion.net/2023/04/security-onion-24-beta-2-release-...
Blog Archive
- May 2024 (1)
- April 2024 (7)
- March 2024 (5)
- February 2024 (3)
- January 2024 (3)
- December 2023 (15)
- November 2023 (27)
- October 2023 (18)
- September 2023 (3)
- August 2023 (8)
- July 2023 (4)
- June 2023 (3)
- May 2023 (2)
- April 2023 (4)
- March 2023 (4)
- February 2023 (5)
- January 2023 (3)
- December 2022 (5)
- November 2022 (2)
- October 2022 (9)
- September 2022 (3)
- August 2022 (8)
- July 2022 (7)
- June 2022 (9)
- May 2022 (14)
- April 2022 (7)
- March 2022 (6)
- February 2022 (11)
- January 2022 (12)
- December 2021 (19)
- November 2021 (25)
- October 2021 (22)
- September 2021 (23)
- August 2021 (30)
- July 2021 (13)
- June 2021 (4)
- May 2021 (3)
- April 2021 (4)
- March 2021 (7)
- February 2021 (5)
- January 2021 (4)
- December 2020 (13)
- November 2020 (5)
- October 2020 (12)
- September 2020 (3)
- August 2020 (6)
- July 2020 (8)
- June 2020 (5)
- May 2020 (9)
- April 2020 (11)
- March 2020 (7)
- February 2020 (4)
- January 2020 (1)
- December 2019 (6)
- November 2019 (4)
- October 2019 (8)
- September 2019 (7)
- August 2019 (7)
- July 2019 (4)
- June 2019 (7)
- May 2019 (20)
- April 2019 (8)
- March 2019 (7)
- February 2019 (7)
- January 2019 (12)
- December 2018 (12)
- November 2018 (13)
- October 2018 (10)
- September 2018 (4)
- August 2018 (16)
- July 2018 (11)
- June 2018 (13)
- May 2018 (4)
- April 2018 (11)
- March 2018 (9)
- February 2018 (10)
- January 2018 (9)
- December 2017 (7)
- November 2017 (7)
- October 2017 (9)
- September 2017 (4)
- August 2017 (7)
- July 2017 (5)
- June 2017 (8)
- May 2017 (4)
- April 2017 (2)
- March 2017 (1)
- February 2017 (3)
- January 2017 (15)
- December 2016 (9)
- November 2016 (3)
- October 2016 (5)
- September 2016 (13)
- August 2016 (12)
- July 2016 (10)
- June 2016 (7)
- May 2016 (7)
- April 2016 (7)
- March 2016 (10)
- February 2016 (13)
- January 2016 (10)
- December 2015 (1)
- November 2015 (1)
- October 2015 (3)
- September 2015 (5)
- August 2015 (7)
- July 2015 (7)
- June 2015 (12)
- May 2015 (6)
- April 2015 (6)
- March 2015 (6)
- February 2015 (10)
- January 2015 (11)
- December 2014 (5)
- November 2014 (3)
- October 2014 (6)
- September 2014 (20)
- August 2014 (7)
- July 2014 (10)
- June 2014 (10)
- May 2014 (3)
- April 2014 (9)
- March 2014 (6)
- February 2014 (9)
- January 2014 (8)
- December 2013 (5)
- November 2013 (2)
- October 2013 (7)
- September 2013 (5)
- August 2013 (7)
- July 2013 (9)
- June 2013 (7)
- May 2013 (11)
- April 2013 (3)
- March 2013 (3)
- February 2013 (3)
- January 2013 (3)
- December 2012 (3)
- November 2012 (1)
- October 2012 (1)
- September 2012 (1)
- August 2012 (2)
- May 2012 (4)
- April 2012 (6)
- March 2012 (8)
- February 2012 (4)
- January 2012 (13)
- December 2011 (9)
- November 2011 (8)
- October 2011 (8)
- September 2011 (8)
- July 2011 (4)
- June 2011 (5)
- May 2011 (2)
- April 2011 (1)
- February 2011 (1)
- January 2011 (11)
- November 2010 (4)
- October 2010 (8)
- August 2010 (1)
- July 2010 (2)
- June 2010 (1)
- May 2010 (1)
- April 2010 (2)
- February 2010 (3)
- January 2010 (1)
- September 2009 (1)
- August 2009 (3)
- July 2009 (4)
- June 2009 (3)
- May 2009 (1)
- April 2009 (8)
- February 2009 (1)
- January 2009 (9)
- November 2008 (2)
- October 2008 (4)
- September 2008 (3)