securityonion-setup - 20120912-0ubuntu0securityonion330 now available for Security Onion 16.04!

First, please note that Security Onion 16.04 reaches EOL in less than 5 months. Instead of applying this update, most Security Onion 16.04 users should upgrade directly to Security Onion 2:
https://blog.securityonion.net/2020/11/5-month-eol-notice-for-security-onion.html

If you do decide to proceed with this update for Security Onion 16.04, please be reminded of the recent Docker Hub rate limit changes:
https://blog.securityonion.net/2020/10/docker-hub-rate-limits-effective.html

The following update is now available for Security Onion 16.04!

securityonion-setup - 20120912-0ubuntu0securityonion330

This update resolves the following issue:

sosetup-network: Empty hostname set when running automated installs #1783
https://github.com/Security-Onion-Solutions/security-onion/issues/1783

Thanks

Thanks to Chris Morgret for testing and QA!

Updating

Please see the following page for full update instructions:
https://docs.securityonion.net/en/16.04/upgrade.html

Support

Need support?  Please see:
https://docs.securityonion.net/en/16.04/support.html

Thanks!

Elastic Stack 7.9.3 now available for Security Onion 16.04!

First, please note that Security Onion 16.04 reaches EOL in less than 5 months. Instead of applying this update, most Security Onion 16.04 users should upgrade directly to Security Onion 2:
https://blog.securityonion.net/2020/11/5-month-eol-notice-for-security-onion.html

If you do decide to proceed with this update for Security Onion 16.04, please be reminded of the recent Docker Hub rate limit changes:
https://blog.securityonion.net/2020/10/docker-hub-rate-limits-effective.html

The following updates are now available for Security Onion 16.04!

• Elastic 7.9.3 Docker images
• securityonion-capme - 20121213-0ubuntu0securityonion80
• securityonion-elastic - 20190510-1ubuntu1securityonion124
• securityonion-setup - 20120912-0ubuntu0securityonion329
• securityonion-sostat - 20120722-0ubuntu0securityonion146
• securityonion-web-page - 20141015-0ubuntu0securityonion109

These updates should resolve the following issues:

Elastic 7.9.3 #1782
https://github.com/Security-Onion-Solutions/security-onion/issues/1782

so-elastic-features - improve soup call #1789
https://github.com/Security-Onion-Solutions/security-onion/issues/1789

securityonion-elastic: Migrate indices.* settings for elasticsearch.yml #1786
https://github.com/Security-Onion-Solutions/security-onion/issues/1786

securityonion-elastic: update links to documentation #1801
https://github.com/Security-Onion-Solutions/security-onion/issues/1801

securityonion-sostat: update links to documentation #1794
https://github.com/Security-Onion-Solutions/security-onion/issues/1794

securityonion-web-page: update links to documentation #1799
https://github.com/Security-Onion-Solutions/security-onion/issues/1799

Setup: do not write interfaces if we lack valid contents #1784
https://github.com/Security-Onion-Solutions/security-onion/issues/1784

securityonion-setup: update links to documentation #1800
https://github.com/Security-Onion-Solutions/security-onion/issues/1800

Known Issues

If you get errors in logstash.log like:

 "reason"=>"Failed to parse mapping [doc]: mapper [destination_geo.latitude] cannot be changed from type [long] to [half_float]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [destination_geo.latitude] cannot be changed from type [long] to [half_float]"}}}}}

then you may have an old Logstash template and may need to do the following on any node that is running Logstash:

          sudo so-logstash-stop   

curl -XDELETE localhost:9200/_template/logstash 

curl -XDELETE localhost:9200/_template/logstash-*

sudo so-logstash-start

For more information, please see:
https://groups.google.com/g/security-onion/c/6p6Jkr91-kM 

If that doesn't resolve the issue, you may have custom templates in /etc/logstash/custom/ that need to be updated. You’ll need to copy from source and modify as needed.

Thanks

• Thanks to the Elastic team for Elastic 7.9.3!
• Thanks to Pete Nelson for submitting fixes for both so-elastic-features and sosetup-network!
• Thanks to Chris Morgret for testing and QA!

Updating

Please see the following page for full update instructions:
https://docs.securityonion.net/en/16.04/upgrade.html

Support

Need support?  Please see:
https://docs.securityonion.net/en/16.04/support.html

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion328 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion328 is now available for Security Onion and should resolve the following issue:

securityonion-setup: change /nsm/bro to /nsm/zeek in a few user facing messages #1753
https://github.com/Security-Onion-Solutions/security-onion/issues/1753

Thanks
Thanks to Wes Lambert for testing and QA!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation
You can find our documentation here:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion.  For more information about our training classes, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://securityonionsolutions.com

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion316 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion316 is now available for Security Onion!

This update should resolve the following issues:

Setup: remind user to keep LOG_SIZE_LIMIT under 90% #1659
https://github.com/Security-Onion-Solutions/security-onion/issues/1659

securityonion-setup: include SOSTATADDRESS in so-email.conf #1665
https://github.com/Security-Onion-Solutions/security-onion/issues/1665

Thanks
Thanks to Wes Lambert for his work on improving and testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Basic and 4-day Advanced onsite training classes.  We also offer online classes as well.  For more information, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion314 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion314 is now available for Security Onion!  This should resolve the following issue:

Setup: improve removal of Elastic auth files #1632
https://github.com/Security-Onion-Solutions/security-onion/issues/1632

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Conference
Only a few weeks left to register for Security Onion Conference 2019 on Friday, October 4, 2019!
https://socaugusta2019.eventbrite.com/

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Security Onion Training classes coming up in Columbia MD and Augusta GA!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion294 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion294 is now available and should resolve the following issue:

Setup: sudo fails during sosetup if NOPASSWD:ALL not enabled #1490
https://github.com/Security-Onion-Solutions/security-onion/issues/1490

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have 4-day Security Onion Basic Training classes coming up in Columbia, MD and Costa Mesa CA!  Use promotional code marchmadness for 10% off either of these classes through the end of March!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

New Setup and NSM packages now available for Security Onion!

The following packages are now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion199
securityonion-setup - 20120912-0ubuntu0securityonion285

This should resolve the following issues:

Setup: update setup conf files #1417
https://github.com/Security-Onion-Solutions/security-onion/issues/1417

Setup: Fix bug where the regex in sed disables incorrect interfaces #1427
https://github.com/Security-Onion-Solutions/security-onion/issues/1427

Setup: add logger node to Bro node.cfg #1420
https://github.com/Security-Onion-Solutions/security-onion/issues/1420

Setup: configure Bro cluster mode for AF_PACKET #1421
https://github.com/Security-Onion-Solutions/security-onion/issues/1421

Setup: configure Suricata for AF_PACKET #1432
https://github.com/Security-Onion-Solutions/security-onion/issues/1432

NSM: Improve the method of updating thread count in suricata.yaml #1230
https://github.com/Security-Onion-Solutions/security-onion/issues/1230

NSM: support running Suricata using AF_PACKET #1431
https://github.com/Security-Onion-Solutions/security-onion/issues/1431

As an overview, these updates will cause new installations to configure Bro and Suricata to collect network traffic via AF_PACKET (instead of PF_RING as we've done for the last few years).  Installations already configured for PF_RING will continue to use PF_RING.  Please see the links above for background information and config changes.

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio TX, Atlanta GA, and Columbia MD!  If you can't make it to one of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've started moving our documentation to https://securityonion.net/docs!  Please let us know if anything needs to be updated.

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion281 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion281 is now available and should resolve the following issues:

Setup: Prevent ES ports from being allocated for snort_agent #1397
https://github.com/Security-Onion-Solutions/security-onion/issues/1397

Setup: update sosetup-storage.conf to align with new storage node config #1395
https://github.com/Security-Onion-Solutions/security-onion/issues/1395

Thanks
Thanks to Kevin Branch for the pull request!
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio, Texas and Atlanta, Georgia!  If you can't make it to either of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Updated securityonion-iso, securityonion-logo, and securityonion-setup packages now available for Security Onion 16.04!

The following packages are now available:
securityonion-iso - 20151016-1ubuntu1securityonion28
securityonion-logo - 20120722-0ubuntu0securityonion3
securityonion-setup - 20120912-0ubuntu0securityonion280

These updated packages should resolve the following issues:

Setup: after configuring network, remind user to run Setup after reboot #1368
https://github.com/Security-Onion-Solutions/security-onion/issues/1368

Setup: remove old OSSEC code #1377
https://github.com/Security-Onion-Solutions/security-onion/issues/1377

Setup: Storage Node should enable ossec_agent #1378
https://github.com/Security-Onion-Solutions/security-onion/issues/1378

Setup: copy wallpaper into place to prompt user #1382
https://github.com/Security-Onion-Solutions/security-onion/issues/1382

securityonion-logo: prompt user to run Setup #1379
https://github.com/Security-Onion-Solutions/security-onion/issues/1379

so-iso-boot: if user hasn't run Setup yet, copy wallpaper into place to prompt them #1383
https://github.com/Security-Onion-Solutions/security-onion/issues/1383

Screenshots

After installing the ISO image, the desktop guides the user to running Setup

After Setup configures network interfaces and reboots, the desktop guides the user to run Setup again to continue to the second phase of Setup

Once the second phase of Setup completes, the desktop displays the normal wallpaper with no prompts

Thanks
Thanks to Digininja for suggesting the Setup prompts!
Thanks to Wes Lambert for testing these packages!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio, Texas and Atlanta, Georgia!  If you can't make it to either of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion278 now available for Security Onion 16.04!

The following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion278

This should resolve the following issues:

Setup: ensure Apache SSO config is enabled #1355
https://github.com/Security-Onion-Solutions/security-onion/issues/1355

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have a 4-day Security Onion training class coming up in San Antonio, Texas!  If you can't make it to this onsite class, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion276 now available for Security Onion 16.04!

The following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion276

This should resolve the following issues:

so-allow: fix verbiage for ES REST Endpoint #1325
https://github.com/Security-Onion-Solutions/security-onion/issues/1325

securityonion-setup: increase MySQL open files limit #1322
https://github.com/Security-Onion-Solutions/security-onion/issues/1322

Screenshots

MySQL open_files_limit

so-allow

Thanks
Thanks to Wes Lambert for updating so-allow and testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion275 now available for Security Onion 16.04!

The following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion275

This should resolve the following issues:

securityonion-setup: allow ES exposure through so-allow #1307
https://github.com/Security-Onion-Solutions/security-onion/issues/1307

securityonion-setup: so-email advanced mode to set FROM email addresses #1308
https://github.com/Security-Onion-Solutions/security-onion/issues/1308

Screenshots

so-email now has an Advanced Setup option for specifying FROM addresses

so-allow now includes Elasticsearch options

Thanks
Thanks to Jon Zeolla and Wes Lambert for the Pull Requests!
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!