Elastic Stack 7.9.3 now available for Security Onion 16.04!

First, please note that Security Onion 16.04 reaches EOL in less than 5 months. Instead of applying this update, most Security Onion 16.04 users should upgrade directly to Security Onion 2:
https://blog.securityonion.net/2020/11/5-month-eol-notice-for-security-onion.html

If you do decide to proceed with this update for Security Onion 16.04, please be reminded of the recent Docker Hub rate limit changes:
https://blog.securityonion.net/2020/10/docker-hub-rate-limits-effective.html

The following updates are now available for Security Onion 16.04!

• Elastic 7.9.3 Docker images
• securityonion-capme - 20121213-0ubuntu0securityonion80
• securityonion-elastic - 20190510-1ubuntu1securityonion124
• securityonion-setup - 20120912-0ubuntu0securityonion329
• securityonion-sostat - 20120722-0ubuntu0securityonion146
• securityonion-web-page - 20141015-0ubuntu0securityonion109

These updates should resolve the following issues:

Elastic 7.9.3 #1782
https://github.com/Security-Onion-Solutions/security-onion/issues/1782

so-elastic-features - improve soup call #1789
https://github.com/Security-Onion-Solutions/security-onion/issues/1789

securityonion-elastic: Migrate indices.* settings for elasticsearch.yml #1786
https://github.com/Security-Onion-Solutions/security-onion/issues/1786

securityonion-elastic: update links to documentation #1801
https://github.com/Security-Onion-Solutions/security-onion/issues/1801

securityonion-sostat: update links to documentation #1794
https://github.com/Security-Onion-Solutions/security-onion/issues/1794

securityonion-web-page: update links to documentation #1799
https://github.com/Security-Onion-Solutions/security-onion/issues/1799

Setup: do not write interfaces if we lack valid contents #1784
https://github.com/Security-Onion-Solutions/security-onion/issues/1784

securityonion-setup: update links to documentation #1800
https://github.com/Security-Onion-Solutions/security-onion/issues/1800

Known Issues

If you get errors in logstash.log like:

 "reason"=>"Failed to parse mapping [doc]: mapper [destination_geo.latitude] cannot be changed from type [long] to [half_float]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [destination_geo.latitude] cannot be changed from type [long] to [half_float]"}}}}}

then you may have an old Logstash template and may need to do the following on any node that is running Logstash:

          sudo so-logstash-stop   

curl -XDELETE localhost:9200/_template/logstash 

curl -XDELETE localhost:9200/_template/logstash-*

sudo so-logstash-start

For more information, please see:
https://groups.google.com/g/security-onion/c/6p6Jkr91-kM 

If that doesn't resolve the issue, you may have custom templates in /etc/logstash/custom/ that need to be updated. You’ll need to copy from source and modify as needed.

Thanks

• Thanks to the Elastic team for Elastic 7.9.3!
• Thanks to Pete Nelson for submitting fixes for both so-elastic-features and sosetup-network!
• Thanks to Chris Morgret for testing and QA!

Updating

Please see the following page for full update instructions:
https://docs.securityonion.net/en/16.04/upgrade.html

Support

Need support?  Please see:
https://docs.securityonion.net/en/16.04/support.html

Thanks!

Elastic 6.8.8 now available for Security Onion!

UPDATE 2020-04-22 7:00 Looks like there is an issue with domainstats in this release.  So if you're running domainstats, please do not update until we have resolved this issue.

UPDATE 2020-04-22 8:27 We've pushed a new domainstats image which should resolve this issue.

The following updates are now available for Security Onion!

• Elastic 6.8.8 Docker images
• securityonion-elastic - 20190510-1ubuntu1securityonion93

These updates should resolve the following issues:

Elastic 6.8.8 #1746
https://github.com/Security-Onion-Solutions/security-onion/issues/1746

LOGSTASH_MINIMAL doesn't include Beat config #1751
https://github.com/Security-Onion-Solutions/security-onion/issues/1751

securityonion-elastic: improve elasticsearch ingest parsing for sysmon logs via Wazuh #1754
https://github.com/Security-Onion-Solutions/security-onion/issues/1754

securityonion-elastic: bro_files file_ip should be copied to source_ip #1742
https://github.com/Security-Onion-Solutions/security-onion/issues/1742

securityonion-elastic: remove [data][sysmon][targetfilename] from winlogbeat sysmon parsing #1752
https://github.com/Security-Onion-Solutions/security-onion/issues/1752

securityonion-elastic: so-elastic-reset does not remove closed indices #1759
https://github.com/Security-Onion-Solutions/security-onion/issues/1759

securityonion-elastic: so-elastic-reset needs to disable elastalert and then re-enable afterward #1735
https://github.com/Security-Onion-Solutions/security-onion/issues/1735

so-import-pcap-configure: running alone results in error #1740
https://github.com/Security-Onion-Solutions/security-onion/issues/1740

Unanchored regexes in 8001_postprocess_common_ip_augmentation.conf wrongly skip geoip #1244
https://github.com/Security-Onion-Solutions/security-onion/issues/1244

Thanks
Thanks to the Elastic team for Elastic 6.8.8!
Thanks to Wes Lambert and John Bernal for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Elastic 6.8.7 now available for Security Onion!

The following updates are now available for Security Onion!

• Elastic 6.8.7 Docker images
• securityonion-elastic - 20190510-1ubuntu1securityonion87

These updates should resolve the following issues:

Elastic 6.8.7 #1728
https://github.com/Security-Onion-Solutions/security-onion/issues/1728

securityonion-elastic: adjust bro_notice parsing #1724
https://github.com/Security-Onion-Solutions/security-onion/issues/1724

securityonion-elastic: check ingest geoip fields #1725
https://github.com/Security-Onion-Solutions/security-onion/issues/1725

so-import-pcap: support paths with spaces #1714
https://github.com/Security-Onion-Solutions/security-onion/issues/1714

so-import-pcap: enable file-extraction #1715
https://github.com/Security-Onion-Solutions/security-onion/issues/1715

securityonion-elastic: change template name in 9002_output_import.conf #1723
https://github.com/Security-Onion-Solutions/security-onion/issues/1723

securityonion-elastic: logstash custom config should get copied for LOGSTASH_MINIMAL #1719
https://github.com/Security-Onion-Solutions/security-onion/issues/1719

Thanks
Thanks to the Elastic team for Elastic 6.8.7!
Thanks to Wes Lambert and Bryant Treacle for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

Elastic 6.8.4 now available for Security Onion!

The following updates are now available for Security Onion!
Elastic 6.8.4 Docker images
securityonion-elastic - 20190510-1ubuntu1securityonion69

These updates should resolve the following issues:

Elastic 6.8.4 #1634
https://github.com/Security-Onion-Solutions/security-onion/issues/1634

Curator: move from pip to yum #1638
https://github.com/Security-Onion-Solutions/security-onion/issues/1638

Logstash: add prune filter #1639
https://github.com/Security-Onion-Solutions/security-onion/issues/1639

securityonion-docker: so-elastalert - update to Python 3 #1629
https://github.com/Security-Onion-Solutions/security-onion/issues/1629

securityonion-elastic: update /etc/apt/preferences.d/securityonion-docker #1653
https://github.com/Security-Onion-Solutions/security-onion/issues/1653

securityonion-elastic: so-kibana-start needs to wait on .kibana shard #1655
https://github.com/Security-Onion-Solutions/security-onion/issues/1655

securityonion-elastic: add elasticsearch index scripts #1636
https://github.com/Security-Onion-Solutions/security-onion/issues/1636

securityonion-elastic: reconcile additional geo fields in ingest node #1640
https://github.com/Security-Onion-Solutions/security-onion/issues/1640

securityonion-elastic: so-elasticsearch-pipelines should update parsers in place without removing #1649
https://github.com/Security-Onion-Solutions/security-onion/issues/1649

securityonion-elastic: master logstash output to redis should be batched by default #1661
https://github.com/Security-Onion-Solutions/security-onion/issues/1661

securityonion-elastic: storage node redis input should be batched by default #1662
https://github.com/Security-Onion-Solutions/security-onion/issues/1662

so-elastic-auth: add more guidance #1635
https://github.com/Security-Onion-Solutions/security-onion/issues/1635

so-import-pcap: only decrease ES heap if less than 9GB RAM #1642
https://github.com/Security-Onion-Solutions/security-onion/issues/1642

Thanks
Thanks to the Elastic team for Elastic 6.8.4!
Thanks to the following for testing and QA!
Bryant Treacle
Wes Lambert
Josh Brower
Kris Springer

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes.  We also offer online classes as well.  For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

Elastic 6.7.2 now available for Security Onion!

The following are now available for Security Onion:
Docker images for Elastic 6.7.2
securityonion-elastic - 20190510-1ubuntu1securityonion3

Elastic 6.7.2

Issues Resolved

Elastic 6.7.2 #1426
https://github.com/Security-Onion-Solutions/security-onion/issues/1426

securityonion-elastic: enable Java Execution Engine in Logstash #1436
https://github.com/Security-Onion-Solutions/security-onion/issues/1436

securityonion-elastic: update "Syslog - Source IP Address" visualization on Syslog dashboard #1498
https://github.com/Security-Onion-Solutions/security-onion/issues/1498

securityonion-elastic: add bro_conn service data table #1496
https://github.com/Security-Onion-Solutions/security-onion/issues/1496

securityonion-elastic: rename bro x509 id to fuid #1499
https://github.com/Security-Onion-Solutions/security-onion/issues/1499

securityonion-elastic: rename bro pe id to fuid #1493
https://github.com/Security-Onion-Solutions/security-onion/issues/1493

securityonion-elastic: update so-elastalert-create-whiptail to use new parameters in so-elastalert-test #1487
https://github.com/Security-Onion-Solutions/security-onion/issues/1487

securityonion-elastic: add more options to so-elastalert-test #1486
https://github.com/Security-Onion-Solutions/security-onion/issues/1486

securityonion-elastic: so-elastalert-test errors if no input provided #1470
https://github.com/Security-Onion-Solutions/security-onion/issues/1470

securityonion-elastic: correct separator in 1122_preprocess_bro_socks.conf #1485
https://github.com/Security-Onion-Solutions/security-onion/issues/1485

securityonion-elastic: update Logstash config to support Wazuh 3.8 agent #1469
https://github.com/Security-Onion-Solutions/security-onion/issues/1469

securityonion-elastic: avoid writing firewall logs to logstash-syslog index #1481
https://github.com/Security-Onion-Solutions/security-onion/issues/1481

securityonion-elastic: remove Wazuh's alerts.json from syslog-ng config #1467
https://github.com/Security-Onion-Solutions/security-onion/issues/1467

securityonion-elastic: update PFSense Logstash config for IPv6 options #1461
https://github.com/Security-Onion-Solutions/security-onion/issues/1461

securityonion-elastic: add so-elastic-document-stats #1459
https://github.com/Security-Onion-Solutions/security-onion/issues/1459

securityonion-elastic: minor fixes to bro logstash filters #1460
https://github.com/Security-Onion-Solutions/security-onion/issues/1460

securityonion-elastic: change wiki to docs #1452
https://github.com/Security-Onion-Solutions/security-onion/issues/1452

securityonion-elastic: if Standalone with 8GB RAM, set ES heap to 1GB #1425
https://github.com/Security-Onion-Solutions/security-onion/issues/1425

securityonion-elastic: move parsing from logstash to elasticsearch ingest for so-import-pcap #1497
https://github.com/Security-Onion-Solutions/security-onion/issues/1497

securityonion-elastic: so-import-pcap should run snort and suricata with checksums disabled #1478
https://github.com/Security-Onion-Solutions/security-onion/issues/1478

securityonion-elastic: minor fixes to so-import-pcap #1458
https://github.com/Security-Onion-Solutions/security-onion/issues/1458

securityonion-elastic: so-import-pcap should create a sguil sensor named HOSTNAME-import #1472
https://github.com/Security-Onion-Solutions/security-onion/issues/1472

so-import-pcap: run Setup if necessary #1480
https://github.com/Security-Onion-Solutions/security-onion/issues/1480

so-import-pcap: avoid merging errors #1430
https://github.com/Security-Onion-Solutions/security-onion/issues/1430

so-import-pcap - improve single pcap use case #1239
https://github.com/Security-Onion-Solutions/security-onion/issues/1239

securityonion-elastic: add translations route to Apache proxy config #1495
https://github.com/Security-Onion-Solutions/security-onion/issues/1495

securityonion-elastic: add built_assets route to Apache proxy config #1494
https://github.com/Security-Onion-Solutions/security-onion/issues/1494

securityonion-elastic: add dlls route to Apache proxy config #1435
https://github.com/Security-Onion-Solutions/security-onion/issues/1435

securityonion-elastic: add socket.io route to Apache proxy config #1437
https://github.com/Security-Onion-Solutions/security-onion/issues/1437

securityonion-elastic: add s route to Apache proxy config #1438
https://github.com/Security-Onion-Solutions/security-onion/issues/1438

securityonion-elastic: ensure update/refresh button is consistent across all Kibana dashboards #1429
https://github.com/Security-Onion-Solutions/security-onion/issues/1429

Kibana: HIDS Alerts Dashboard - Replace syslog-host_from with agent.name #1442
https://github.com/Security-Onion-Solutions/security-onion/issues/1442

securityonion-elastic: DHCP dashboard has different darkTheme behavior than others #1516
https://github.com/Security-Onion-Solutions/security-onion/issues/1516

securityonion-elastic: modify fields for Bro socks log #1517
https://github.com/Security-Onion-Solutions/security-onion/issues/1517

securityonion-elastic: fix so-elasticsearch-template-create #1518
https://github.com/Security-Onion-Solutions/security-onion/issues/1518

Thanks
Thanks to the Elastic team for Elastic 6.7.2!
Thanks to Wes Lambert and Dustin Lee for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Conference
Please mark your calendar! Security Onion Conference 2019 will be on Friday, October 4, 2019 and registration will open July 18! CFP is open now and we want to hear from you!
https://blog.securityonion.net/2019/04/security-onion-conference-2019-cfp.html

Training
We have 4-day Security Onion Training classes coming up in Costa Mesa CA and Columbia MD!  Use promotional code earlybird for 10% off the Columbia MD classes for a limited time.  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

Call For Testing: Elastic 6.7.2

Elastic 6.7.2 was released recently and we've got Docker images and a new securityonion-elastic package ready for testing!  There are lots of changes here, so we need your help in testing to see what we missed.  Please follow the instructions on our security-onion-testing thread and post your test results there!  Thanks!

https://groups.google.com/d/topic/security-onion-testing/FDJ66pUgH8E/discussion

Elastic 6.5.2 now available for Security Onion 16.04!

The following are now available for Security Onion 16.04:
Docker images for Elastic 6.5.2
securityonion-elastic - 20180130-1ubuntu1securityonion148

Elastic 6.5.2

This should resolve the following issues:

Elastic 6.5.2 #1374
https://github.com/Security-Onion-Solutions/security-onion/issues/1374

Elastic: Improve Kibana config/dashboard import #1389
https://github.com/Security-Onion-Solutions/security-onion/issues/1389

Elastic: Logstash support for ja3 and hassh #1375
https://github.com/Security-Onion-Solutions/security-onion/issues/1375

Elastic: enable redis-server service if LOGSTASH_OUTPUT_REDIS enabled #1385
https://github.com/Security-Onion-Solutions/security-onion/issues/1385

Thanks
Thanks to the Elastic team for Elastic 6.5.2!
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio, Texas and Atlanta, Georgia!  If you can't make it to either of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Elastic 6.2.4 and securityonion-elastic - 20180130-1ubuntu1securityonion78 now available for Security Onion!

The following are now available for Security Onion:

• Elastic 6.2.4 Docker images
• securityonion-elastic - 20180130-1ubuntu1securityonion78

This should resolve the following issue:

Elastic Stack 6.2.4 #1238
https://github.com/Security-Onion-Solutions/security-onion/issues/1238

Thanks
Thanks to the Elastic team for the Elastic Stack!
Thanks to Wes Lambert for testing!

Updating
If you have pre-release Elastic installations (Technology Previews, Alpha, Beta, RC1, RC2, etc.), we don't officially support upgrading to newer releases, but you can try the steps listed here:
https://securityonion.net/wiki/Elastic-RC4

Otherwise, if you are currently running our GA release (Elastic 6.2.3), you should be able to update using the standard update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have a 4-day Security Onion training class coming up in Augusta, GA!  For this and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Elastic 6.2.3 and securityonion-elastic - 20180130-1ubuntu1securityonion76 now available for Security Onion!

The following are now available for Security Onion:

• Elastic 6.2.3 Docker images
• securityonion-elastic - 20180130-1ubuntu1securityonion76

This should resolve the following issue:

securityonion-elastic: RC4 #1219
https://github.com/Security-Onion-Solutions/security-onion/issues/1228

Thanks
Thanks to the Elastic team for the Elastic Stack!
Thanks to Jay Hawk and Wes Lambert for testing!

Updating
If you have existing Elastic installations (Technology Previews, Alpha, Beta, RC1, or RC2), we don't officially support upgrading to newer releases, but you can try the steps listed here:
https://securityonion.net/wiki/Elastic-RC4

Training
We have a 4-day Security Onion training class coming up in San Antonio, Texas!  For this and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!