Did you know that Security Onion provides both network AND host visibility?

Security Onion started in 2008 as a Network Security Monitoring (NSM) platform. Over the years, more and more of our network traffic has become encrypted. That's a good thing for privacy but it makes our jobs as defenders a little more difficult. To fill in those blind spots, we've spent the last several years making sure that Security Onion is equally as powerful on the host side as it is on the network side. Here's a diagram showing an overview of Security Onion consuming not just network traffic from your taps or span ports but also logs from your endpoints:

The following screenshot shows a comprehensive Security Onion deployment that does both network monitoring and host monitoring as well:

Security Onion includes a complete set of dashboards for each of those different kinds of endpoint data:

The Elastic Agent Overview dashboard gives you an overview of the comprehensive telemetry that is provided by the Elastic Agent when installed on your servers, desktops, and laptops:

You can read more about our endpoint capabilities in the Host Visibility section of our documentation:

https://docs.securityonion.net/en/2.4/host.html

How a Single Piece of Paper Can Saturate a WAN Link

At work, one of our remote business units was experiencing slowness in their WAN link. Our Network Architect began looking into the problem and found that one particular device on their network was sending enormous amounts of traffic over the link. Looking into it further, he discovered that the device was one of our security cameras in the business unit's server room. He then came to see us and asked about the camera.

This particular camera is motion-activated and therefore shouldn't have been capturing all the time, but it was. We looked at some of the videos and, at first, didn't see anything out of the ordinary. After racking our brains for a few minutes, we finally noticed that there was a piece of paper taped to the front of one of the server racks. The paper was taped in the middle, allowing the sides to flap in the wind of the air conditioner. This created just enough motion to trigger the camera to record and transmit its video.

All of this resulted in a call to the technician at the business unit that went something like this:

"We've discovered the problem with your WAN link. Please go to your server room and remove the piece of paper taped to the front of the server rack. Your WAN link should then magically speed up. Thank you."

My modest proposal is that paper is obviously increasing our bandwidth costs and we should therefore go completely paperless.