Did you know that Security Onion provides both network AND host visibility?

Security Onion started in 2008 as a Network Security Monitoring (NSM) platform. Over the years, more and more of our network traffic has become encrypted. That's a good thing for privacy but it makes our jobs as defenders a little more difficult. To fill in those blind spots, we've spent the last several years making sure that Security Onion is equally as powerful on the host side as it is on the network side. Here's a diagram showing an overview of Security Onion consuming not just network traffic from your taps or span ports but also logs from your endpoints:

The following screenshot shows a comprehensive Security Onion deployment that does both network monitoring and host monitoring as well:

Security Onion includes a complete set of dashboards for each of those different kinds of endpoint data:

The Elastic Agent Overview dashboard gives you an overview of the comprehensive telemetry that is provided by the Elastic Agent when installed on your servers, desktops, and laptops:

You can read more about our endpoint capabilities in the Host Visibility section of our documentation:

https://docs.securityonion.net/en/2.4/host.html

Security Onion 2.3.21 now available!

We recently released Security Onion 2.3:

https://blog.securityonion.net/2020/10/security-onion-2-has-reached-general.html

Today, we are releasing Security Onion 2.3.21, which resolves a few issues:

https://docs.securityonion.net/en/2.3/release-notes.html#changes

Documentation

We've started migrating our documentation to 2.3:

https://docs.securityonion.net/en/2.3/

However, this is a work in progress and some documentation may be missing or incorrect. Please let us know if you notice any issues.

Known Issues

Please review the Known Issues list:
https://docs.securityonion.net/en/2.3/release-notes.html#known-issues

New Installations

If you want to perform a new installation, please review the 2.3 documentation and then you can find instructions here:

https://docs.securityonion.net/en/2.3/download.html

Existing 2.3 Installations

If you have an existing Security Onion 2.3 installation, please see:

https://docs.securityonion.net/en/2.3/soup.html

Security Onion 16.04 EOL

Ubuntu 16.04 reaches EOL in April 2021 and so therefore Security Onion 16.04 does as well. Please make plans to replace or upgrade any existing Security Onion 16.04 deployments before then:

https://blog.securityonion.net/2020/12/4-month-eol-notice-for-security-onion.html

Upgrading from Security Onion 16.04

If you're currently running Security Onion 16.04, please see the following for upgrade options:

https://docs.securityonion.net/en/2.3/appendix.html

Questions or Problems

If you have questions or problems, please see our community support forum guidelines:

https://docs.securityonion.net/en/2.3/community-support.html

You can then find the community support forum at:

https://securityonion.net/discuss

Thanks

Lots of love went into this release!

Special thanks to all our folks working so hard to make this release happen!

• Josh Brower
• Jason Ertel
• Wes Lambert
• Josh Patterson
• Mike Reeves
• Bryant Treacle
• William Wernert

Training

Need training? Start with our free Security Onion Essentials training and then take a look at some of our other official Security Onion training, including our new Developing Your Detection Playbook class!

http://securityonion.net/training

Hardware Appliances

We know Security Onion's hardware needs, and our appliances are the perfect match for the platform. Leave the hardware research, testing, and support to us, so you can focus on what's important for your organization. Not only will you have confidence that your Security Onion deployment is running on the best-suited hardware, you will also be supporting future development and maintenance of the Security Onion project!

https://securityonionsolutions.com/hardware

Screenshot Tour

If you want the quickest and easiest way to try out Security Onion 2, just follow the screenshots below to install an Import node and then optionally enable the Analyst Workstation. This can be done in a minimal VM with only 4GB RAM!

Security Onion 2.3.21 ISO Boot Menu

ISO Installer

ISO Install Complete

Welcome to Setup

Choose the Setup type

Choose Standard or Airgap

Set hostname

Select management NIC

Configure management NIC

Configure networking

Configure networking

Configure networking

Configure networking

Configure networking

Initialize networking

Configure HOME_NET

Create user account

Set password

Confirm password

Choose how you want to access the web interface

Optionally run so-allow

Specify IP address or range to allow through firewall

Confirm options

Setup complete

After rebooting and logging in, optionally run so-analyst-install

so-analyst-install complete

Enter username to login to GNOME

Enter password to login to GNOME

GNOME Desktop

Analyst Workstation includes Chromium, NetworkMiner, Wireshark, and many other analyst tools

Login to Security Onion Console (SOC)

SOC Overview Page

Use so-import-pcap to import one or more pcap files

Use the hyperlink provided by so-import-pcap to view all alerts and logs

SOC's right-click menu has been updated and now includes a new Correlate option to find related logs

Correlate found several related logs

PCAP overview

Download the pcap and open directly in NetworkMiner for file extraction

PCAP transcript

All this in a minimal VM with only 4GB RAM!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion226 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion226 is now available for Security Onion and should resolve the following issue:

NSM: add ability to pin snort via IDS_LB_CPUS #1729
https://github.com/Security-Onion-Solutions/security-onion/issues/1729

You can read more about this new capability here:
https://securityonion.readthedocs.io/en/latest/performance.html#cpu-affinity-pinning

Thanks
Thanks to Pete Nelson for submitting the Pull Request!
Thanks to Bryant Treacle for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Zeek 3.0.1, Elastic 6.8.6, and CyberChef 9.12.0 now available for Security Onion!

The following updates are now available for Security Onion!

Elastic 6.8.6 Docker images
securityonion-bro - 3.0.1-1ubuntu1securityonion10 (Zeek 3.0.1)
securityonion-bro-afpacket - 1.3.0-1ubuntu1securityonion17
securityonion-bro-scripts - 20121004-0ubuntu0securityonion100
securityonion-elastic - 20190510-1ubuntu1securityonion83
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion225
securityonion-onionsalt - 20140917-0ubuntu0securityonion28
securityonion-samples-bro - 20170824-1ubuntu1securityonion4
securityonion-setup - 20120912-0ubuntu0securityonion325
securityonion-sostat - 20120722-0ubuntu0securityonion141
securityonion-tcpudpflow - 001-0ubuntu0securityonion10
securityonion-web-page - 20141015-0ubuntu0securityonion105

These updates should resolve the following issues:

Zeek 3.0.1 #1645
https://github.com/Security-Onion-Solutions/security-onion/issues/1645

Elastic 6.8.6 #1684
https://github.com/Security-Onion-Solutions/security-onion/issues/1684

CyberChef 9.12.0 #1689
https://github.com/Security-Onion-Solutions/security-onion/issues/1689

securityonion-bro-scripts: migrate from Bro to Zeek #1683
https://github.com/Security-Onion-Solutions/security-onion/issues/1683

securityonion-bro-scripts: remove conn-add-country #1630
https://github.com/Security-Onion-Solutions/security-onion/issues/1630

securityonion-bro-scripts: improve postinst to avoid errors when reinstalling #1711
https://github.com/Security-Onion-Solutions/security-onion/issues/1711

securityonion-bro-scripts: add cve-2020-0601 script #1709
https://github.com/Security-Onion-Solutions/security-onion/issues/1709

securityonion-samples-bro: add cve-2020-0601 pcaps #1710
https://github.com/Security-Onion-Solutions/security-onion/issues/1710

securityonion-elastic: update parsers for Zeek 3 #1680
https://github.com/Security-Onion-Solutions/security-onion/issues/1680

securityonion-elastic: improve logstash parser for pfsense filterlog #1696
https://github.com/Security-Onion-Solutions/security-onion/issues/1696

securityonion-elastic: update dashboards for Zeek migration #1685
https://github.com/Security-Onion-Solutions/security-onion/issues/1685

securityonion-elastic: Update Kibana dashboard for firewall logs #1697
https://github.com/Security-Onion-Solutions/security-onion/issues/1697

securityonion-elastic: add elasticsearch ingest parser for pfsense filterlog #1698
https://github.com/Security-Onion-Solutions/security-onion/issues/1698

securityonion-elastic: elasticsearch ingest pipelines need to support "ips" fields #1666
https://github.com/Security-Onion-Solutions/security-onion/issues/1666

securityonion-elastic: update dns domain info for elasticsearch ingest #1667
https://github.com/Security-Onion-Solutions/security-onion/issues/1667

securityonion-elastic: improve support for custom ingest parsers #1671
https://github.com/Security-Onion-Solutions/security-onion/issues/1671

securityonion-elastic: Docker daemon.json conflict #1674
https://github.com/Security-Onion-Solutions/security-onion/issues/1674

securityonion-elastic: improve postinst update check #1699
https://github.com/Security-Onion-Solutions/security-onion/issues/1699

securityonion-elastic: migrate script.* settings from elasticsearch.yml.bak to elasticsearch.yml #1676
https://github.com/Security-Onion-Solutions/security-onion/issues/1676

securityonion-elastic: container status scripts should check system uptime before declaring fail #1686
https://github.com/Security-Onion-Solutions/security-onion/issues/1686

securityonion-elastic: Bro HTTP Logs "user" field not mapped in Elasticsearch template #1672
https://github.com/Security-Onion-Solutions/security-onion/issues/1672

securityonion-elastic: so-elastic-start times out waiting for elasticsearch #1695
https://github.com/Security-Onion-Solutions/security-onion/issues/1695

Elastalert - Update new_term.yaml #1706
https://github.com/Security-Onion-Solutions/security-onion/issues/1706

securityonion-onionsalt: replicate /etc/elasticsearch/custom #1693
https://github.com/Security-Onion-Solutions/security-onion/issues/1693

securityonion-sostat: migrate from Bro to Zeek #1692
https://github.com/Security-Onion-Solutions/security-onion/issues/1692

NSM: change Bro references to Zeek #1682
https://github.com/Security-Onion-Solutions/security-onion/issues/1682

NSM: increase timeout in /etc/systemd/system/securityonion.service #1708
https://github.com/Security-Onion-Solutions/security-onion/issues/1708

NSM: broctl and zeekctl need to check if parameters were passed #1713
https://github.com/Security-Onion-Solutions/security-onion/issues/1713

Docs: Change bro to zeek #1690
https://github.com/Security-Onion-Solutions/security-onion/issues/1690

Setup: change #inter#face to #interface #1675
https://github.com/Security-Onion-Solutions/security-onion/issues/1675

Setup: change Bro references to Zeek #1681
https://github.com/Security-Onion-Solutions/security-onion/issues/1681

securityonion-tcpudpflow: update for Zeek #1700
https://github.com/Security-Onion-Solutions/security-onion/issues/1700

securityonion-web-page: change bro to zeek #1687
https://github.com/Security-Onion-Solutions/security-onion/issues/1687

securityonion-web-page: update docs and cheat sheet for 16.04.6.4 #1688
https://github.com/Security-Onion-Solutions/security-onion/issues/1688

Test Zeek 3.0.1, Elastic 6.8.6, and related updates #1691
https://github.com/Security-Onion-Solutions/security-onion/issues/1691

Thanks
Thanks to the Zeek team for Zeek 3.0.1!
Thanks to the Elastic team for Elastic 6.8.6!
Thanks to the CyberChef team for CyberChef 9.12.0!
Thanks to the following for testing and QA!
Bryant Treacle
Wes Lambert
Josh Brower
Chris Cuevas

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Since we are transitioning from Bro to Zeek, Bro will automatically stop before the packages are upgraded.  Once soup completes, double-check your Bro/Zeek configuration and then restart Zeek:

sudo so-zeek-restart

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes.  We also offer online classes as well.  For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

10% Early Bird discount for 4-day Security Onion Basic Training class in Alexandria VA!

We just scheduled a 4-day Security Onion Basic training class in Alexandria VA!  Use promotional code earlybird to get 10% off through 3/5/2020 at 11:59 PM ET!  For more information and to register, please see:
https://securityonionsolutions.com/onsitetraining

If you can't make it to this onsite class, we also offer online training!
https://onlinetraining.securityonionsolutions.com/

For more information and other training options, please see:
https://securityonionsolutions.com

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion208 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion208 is now available for Security Onion!  This package resolves the following issues:

NSM Now Scripts don't check if sensor disabled before performing operations when --sensor-name= specified #645
https://github.com/Security-Onion-Solutions/security-onion/issues/645

NSM: nsm_sensor_ps-restart --sensor-name=$i --only-pcap should only restart pcap #1118
https://github.com/Security-Onion-Solutions/security-onion/issues/1118

NSM: Error when running nsm_sensor with --start and --sensor-name #1637
https://github.com/Security-Onion-Solutions/security-onion/issues/1637

NSM: replace pcap ls with find #1654
https://github.com/Security-Onion-Solutions/security-onion/issues/1654

Thanks
Thanks to Tim Whisnant for suggesting changes!
Thanks to Pete Nelson for suggesting changes!
Thanks to github user tom564 for submitting a pull request!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes.  We also offer online classes as well.  For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

Suricata 4.1.5 now available for Security Onion!

Suricata 4.1.5 is now available for Security Onion!  The new package version is:

securityonion-suricata - 4.1.5-1ubuntu1securityonion4

This package resolves the following issue:

Suricata 4.1.5 #1646
https://github.com/Security-Onion-Solutions/security-onion/issues/1646

Suricata 4.1.5

Thanks
Thanks to the Suricata team for Suricata 4.1.5!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Conference
This Friday 9/27 is the LAST day to register for Security Onion Conference 2019!
https://socaugusta2019.eventbrite.com/

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes.  We also offer online classes as well.  For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion205 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion205 is now available for Security Onion!  This should resolve the following issue:

NSM: nsm_server_user-add should require usernames to be alphanumeric #1627
https://github.com/Security-Onion-Solutions/security-onion/issues/1627

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Conference
Only a few weeks left to register for Security Onion Conference 2019 on Friday, October 4, 2019!
https://socaugusta2019.eventbrite.com/

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Security Onion Training classes coming up in Columbia MD and Augusta GA!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

Snort 2.9.13.0 and PulledPork 0.7.3 now available for Security Onion!

Snort 2.9.13.0 was recently released:
https://blog.snort.org/2019/04/snort-29130-has-been-released.html

We've packaged Snort 2.9.13.0 and the new version of PulledPork required for this new Snort version.  The new package versions are as follows:

securityonion-snort - 2.9.13.0-1ubuntu1securityonion3
securityonion-pulledpork - 0.7.3-1ubuntu1securityonion3

These packages should resolve the following issues:

Snort 2.9.13.0 #1142
https://github.com/Security-Onion-Solutions/security-onion/issues/1142

PulledPork 0.7.3 #1143
https://github.com/Security-Onion-Solutions/security-onion/issues/1143

Snort 2.9.13.0

PulledPork 0.7.3

Thanks
Thanks to the Snort team for Snort 2.9.13.0!
Thanks to the PulledPork team for PulledPork 0.7.3!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Conference
Please mark your calendar! Security Onion Conference 2019 will be on Friday, October 4, 2019 and registration will open July 18! CFP is open now and we want to hear from you!
https://blog.securityonion.net/2019/04/security-onion-conference-2019-cfp.html

Training
We have 4-day Security Onion Training classes coming up in Columbia MD!  Use promotional code earlybird for 10% off the ADVANCED class for a limited time.  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion204 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion204 is now available and should resolve the following issue:

NSM: add --no-hwtimestamp to netsniff command line #1514
https://github.com/Security-Onion-Solutions/security-onion/issues/1514

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Conference
Please mark your calendar! Security Onion Conference 2019 will be on Friday, October 4, 2019 and registration will open July 18! CFP is open now and we want to hear from you!
https://blog.securityonion.net/2019/04/security-onion-conference-2019-cfp.html

Training
We have a 4-day Security Onion Basic Training class coming up in Costa Mesa CA!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion203 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion203 is now available and should resolve the following issue:

NSM: nsm_server_user-add should check to see if user account exists and prompt user #1505
https://github.com/Security-Onion-Solutions/security-onion/issues/1505

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have a 4-day Security Onion Basic Training class coming up in Costa Mesa CA!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion202 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion202 is now available and should resolve the following issue:

NSM: change filesystem grep #1488
https://github.com/Security-Onion-Solutions/security-onion/issues/1488

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have 4-day Security Onion Basic Training classes coming up in Columbia, MD and Costa Mesa CA!  Use promotional code marchmadness for 10% off either of these classes through the end of March!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

Suricata 4.1.3 now available for Security Onion!

Suricata 4.1.3 was released recently:
https://suricata-ids.org/2019/03/07/suricata-4-1-3-released/

We've packaged Suricata 4.1.3 and the following package is now available:
securityonion-suricata - 4.1.3-1ubuntu1securityonion1

This package should resolve the following issue:

Suricata 4.1.3 #1475
https://github.com/Security-Onion-Solutions/security-onion/issues/1475

Suricata 4.1.3

Thanks
Thanks to the Suricata team for Suricata 4.1.3!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have 4-day Security Onion training classes coming up in Atlanta, Georgia and Columbia, MD!  If you can't make it to either of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion201 now available for Security Onion!

The following packages are now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion201

This should resolve the following issues:

NSM: when (re)starting Suricata, make sure stats.log has proper ownership #1477
https://github.com/Security-Onion-Solutions/security-onion/issues/1477

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have a 4-day Security Onion training class coming up in Columbia MD!  If you can't make it to this onsite class, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion200 now available for Security Onion!

The following packages are now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion200

This should resolve the following issues:

NSM: wipe Suricata stats.log using truncate rather than rm #1456
https://github.com/Security-Onion-Solutions/security-onion/issues/1456

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have a 4-day Security Onion training class coming up in Columbia MD!  If you can't make it to this onsite class, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated.
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

New Setup and NSM packages now available for Security Onion!

The following packages are now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion199
securityonion-setup - 20120912-0ubuntu0securityonion285

This should resolve the following issues:

Setup: update setup conf files #1417
https://github.com/Security-Onion-Solutions/security-onion/issues/1417

Setup: Fix bug where the regex in sed disables incorrect interfaces #1427
https://github.com/Security-Onion-Solutions/security-onion/issues/1427

Setup: add logger node to Bro node.cfg #1420
https://github.com/Security-Onion-Solutions/security-onion/issues/1420

Setup: configure Bro cluster mode for AF_PACKET #1421
https://github.com/Security-Onion-Solutions/security-onion/issues/1421

Setup: configure Suricata for AF_PACKET #1432
https://github.com/Security-Onion-Solutions/security-onion/issues/1432

NSM: Improve the method of updating thread count in suricata.yaml #1230
https://github.com/Security-Onion-Solutions/security-onion/issues/1230

NSM: support running Suricata using AF_PACKET #1431
https://github.com/Security-Onion-Solutions/security-onion/issues/1431

As an overview, these updates will cause new installations to configure Bro and Suricata to collect network traffic via AF_PACKET (instead of PF_RING as we've done for the last few years).  Installations already configured for PF_RING will continue to use PF_RING.  Please see the links above for background information and config changes.

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio TX, Atlanta GA, and Columbia MD!  If you can't make it to one of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've started moving our documentation to https://securityonion.net/docs!  Please let us know if anything needs to be updated.

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion196 now available for Security Onion!

The following package is now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion196

This package should resolve the following issue:

NSM: nsm_server_configure_sshd should check for existing config #1396
https://github.com/Security-Onion-Solutions/security-onion/issues/1396

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio, Texas and Atlanta, Georgia!  If you can't make it to either of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion195 now available for Security Onion 16.04!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion195 is now available and should resolve the following issues:

NSM: refactor config backup cron jobs #1376
https://github.com/Security-Onion-Solutions/security-onion/issues/1376

NSM: cron jobs should only log if their respective service is enabled #1337
https://github.com/Security-Onion-Solutions/security-onion/issues/1337

Thanks
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio, Texas and Atlanta, Georgia!  If you can't make it to either of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion179 now available for Security Onion 16.04!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion179 now available for Security Onion 16.04!  This package should resolve the following issue:

Issue 1291: NSM: add cron jobs for backing up server/sensor config daily
https://github.com/Security-Onion-Solutions/security-onion/issues/1291

Issue 1292: NSM: Delay watchdog checks while any other nsm_sensor_ps script runs
https://github.com/Security-Onion-Solutions/security-onion/issues/1292

Issue 1176: nsm_sensor_clear: check for FORCE_YES
https://github.com/Security-Onion-Solutions/security-onion/issues/1176

Issue 1362: NSM: wait for network-online on boot
https://github.com/Security-Onion-Solutions/security-onion/issues/1362

Thanks
Thanks to Pete Nelson for his pull request!
Thanks to Wes Lambert for his work on this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have a 4-day Security Onion training class coming up in San Antonio, Texas!  If you can't make it to this onsite class, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion177 now available for Security Onion 16.04!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion177 is now available for Security Onion 16.04 and should resolve the following issues:

NSM: improper confirmation of password should throw an error #1271
https://github.com/Security-Onion-Solutions/security-onion/issues/1271

Thanks
Thanks to Wes Lambert for his work on this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!