Wazuh 3.6.1, Elastic 6.4.1, and associated components are now available for Security Onion 16.04!

The following are now available for Security Onion 14.04 and 16.04:
Elastic 6.4.1 and associated Docker images

The following are now available for Security Onion 16.04:
Wazuh 3.6.1 (packaged as ossec-hids-server - 3.6.1.23-ubuntu1securityonion1)
securityonion-elastic - 20180130-1ubuntu1securityonion137
securityonion-setup - 20120912-0ubuntu0securityonion277
securityonion-sguil-agent-ossec - 20120726-0ubuntu0securityonion19

Wazuh can analyze sysmon logs and generate HIDS alerts

This should resolve the following issues:

Issue 708: Wazuh 3.6.1
https://github.com/Security-Onion-Solutions/security-onion/issues/708

Issue 707: OSSEC: add decoders/rules for sysmon
https://github.com/Security-Onion-Solutions/security-onion/issues/707

Issue 852: OSSEC: remove Snorby logs from ossec.conf
https://github.com/Security-Onion-Solutions/security-onion/issues/852

Issue 1328: securityonion-sguil-agent-ossec: update for Wazuh
https://github.com/Security-Onion-Solutions/security-onion/issues/1328

Issue 1329: securityonion-elastic: update for Wazuh
https://github.com/Security-Onion-Solutions/security-onion/issues/1329

Issue 1315: securityonion-elastic: so-elastic-reset workaround disabled wildcard delete
https://github.com/Security-Onion-Solutions/security-onion/issues/1315

Issue 1319: securityonion-elastic: add ES node listing and removal scripts
https://github.com/Security-Onion-Solutions/security-onion/issues/1319

Issue 1327: securityonion-elastic: increase default logstash heap for Eval Mode
https://github.com/Security-Onion-Solutions/security-onion/issues/1327

Issue 1330: so-allow: allowing an OSSEC agent should allow both UDP and TCP traffic
https://github.com/Security-Onion-Solutions/security-onion/issues/1330

Issue 1331: Elastic 6.4.1
https://github.com/Security-Onion-Solutions/security-onion/issues/1331

Thanks
Thanks to the Wazuh team for Wazuh 3.6.1!
Thanks to the Elastic team for Elastic 6.4.1!
Thanks to Wes Lambert for his work on these updates!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have a 4-day Security Onion training class coming up in Augusta, Georgia!  If you can't make it to this onsite class, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-sguil-client - 20141004-0ubuntu0securityonion22 now available for Security Onion!

The following packages are now available:
securityonion-sguil-client - 20141004-0ubuntu0securityonion22
securityonion-sguil-sensor - 20141004-0ubuntu0securityonion22
securityonion-sguil-server - 20141004-0ubuntu0securityonion22

This should resolve the following issue:

securityonion-sguil-server: update dependencies to new tcl version #1275
https://github.com/Security-Onion-Solutions/security-onion/issues/1275

Thanks
Thanks to Wes Lambert for testing these new packages!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Conference
Registration is now open for our annual Security Onion Conference in Augusta GA!
http://socaugusta2018.eventbrite.com/

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia!  If you can't make it to any of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-sguil-* - 20141004-0ubuntu0securityonion17 now available for Security Onion!

The following packages are now available:
securityonion-sguil-client_20141004-0ubuntu0securityonion17
securityonion-sguil-sensor_20141004-0ubuntu0securityonion17
securityonion-sguil-server_20141004-0ubuntu0securityonion17

These packages should resolve the following issues:

Issue 905: Sguil: disable DNS lookups in pcap transcripts
https://github.com/Security-Onion-Solutions/security-onion/issues/905

Issue 1171: Sguil: update DShield URL
https://github.com/Security-Onion-Solutions/security-onion/issues/1171

Issue 1186: Sguil: dynamically generate lookups based on filters table
https://github.com/Security-Onion-Solutions/security-onion/issues/1186

Thanks
Thanks to Wes Lambert for testing these packages!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions offers onsite and online training!  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

CapMe 1.0.1 is now available and supports UDP traffic!

The following packages are now available:
securityonion-capme - 20121213-0ubuntu0securityonion65
securityonion-sguil-client - 20141004-0ubuntu0securityonion16
securityonion-sguil-sensor - 20141004-0ubuntu0securityonion16
securityonion-sguil-server - 20141004-0ubuntu0securityonion16

These new packages should resolve the following issue:

Issue 492: CapMe needs to handle UDP better
https://github.com/Security-Onion-Solutions/security-onion/issues/492

Thanks to Wes Lambert!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Release Notes
After installing the updated packages, you will need to restart sguild as follows:

sudo nsm_server_ps-restart

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

New securityonion-sguil-agent-ossec package resolves an issue

Brian Kellogg sent in a patch for the securityonion-sguil-agent-ossec package to parse syslog IP addresses.  Thanks, Brian!

The new package version is as follows:
securityonion-sguil-agent-ossec - 20120726-0ubuntu0securityonion16

Issues Resolved
ossec_agent: Add source of syslog as destination IP for Sguil alert #760
https://github.com/Security-Onion-Solutions/security-onion/issues/760

Updating
This new package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://github.com/Security-Onion-Solutions/security-onion/wiki/MailingLists

Training
Need training?  Please see:
http://securityonionsolutions.com

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://github.com/Security-Onion-Solutions/security-onion/wiki/TeamMembers

Thanks!

New securityonion-sguil-agent-ossec package resolves three issues

Brian Kellogg sent some patches for our ossec_agent for Sguil and I've updated the package.  The new package has been tested by David Zawdie and Brian Kellogg (thanks!).

The new package version is:
securityonion-sguil-agent-ossec - 20120726-0ubuntu0securityonion15

Issues Resolved

Issue 705: ossec_agent: improvements from Brian Kellogg
https://github.com/Security-Onion-Solutions/security-onion/issues/705

Issue 716: ossec_agent: tighten regex to only look for -> anchored to hostname or IP
https://github.com/Security-Onion-Solutions/security-onion/issues/716

Issue 717: ossec_agent: send alerts to sguild immediately instead of waiting for next alert
https://github.com/Security-Onion-Solutions/security-onion/issues/717

Updating
The new package is now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://github.com/Security-Onion-Solutions/security-onion/wiki/MailingLists

Training
Need training?  We have 3-hour online classes this week:
http://securityonionsolutions.com

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://github.com/Security-Onion-Solutions/security-onion/wiki/TeamMembers

Thanks!

New NSM and ossec_agent.tcl packages resolve several issues

Brian Kellogg submitted a patch for ossec_agent.tcl that allows you to enable or disable DNS lookups.  Thanks, Brian!  I've packaged this and also updated the NSM package to resolve several issues.

The new packages are as follows:

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion114
securityonion-sguil-agent-ossec - 20120726-0ubuntu0securityonion7

These new packages should resolve the following issues:

Issue 684: NSM: nsm_server_ps-start needs to create /var/log/sguild/ if it doesn't already exist
https://code.google.com/p/security-onion/issues/detail?id=684

Issue 686: NSM: nsm_server_ps-start needs to set permissions on /var/log/nsm/so-elsa/ properly
https://code.google.com/p/security-onion/issues/detail?id=686

Issue 687: NSM: nsm_sensor_ps-start should set permissions on /var/log/nsm/HOSTNAME-INTERFACE/ properly
https://code.google.com/p/security-onion/issues/detail?id=687

Issue 689: NSM: add USE_DNS option to ossec_agent.conf
https://code.google.com/p/security-onion/issues/detail?id=689

Issue 688: ossec_agent: add option to disable DNS lookups
https://code.google.com/p/security-onion/issues/detail?id=688

These new packages have been tested by David Zawdie (thanks!).

Release Notes
After updating to the new packages, the next time that the NSM scripts start ossec_agent.tcl, they will add a new USE_DNS option to /etc/nsm/ossec/ossec_agent.conf and default it to 0 (disabled).  This results in much better performance for ossec_agent.tcl.

If you need to revert to the previous behavior of DNS lookups enabled and don't mind the additional lookup delay, you can change USE_DNS to 1 (enabled) and then restart ossec_agent.tcl:

sudo nsm_sensor_ps-restart --only-ossec-agent

Also note that these packages move ossec_agent.tcl to /usr/bin/.

Updating
The new packages are now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Commercial Support
Need training and/or commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

Want to show your support for Security Onion?
Several folks have asked about Security Onion t-shirts and they are now available in our CafePress store!
http://www.cafepress.com/securityonion/11820053


Thanks!

New Sguil client resolves an issue

Scott F. found an issue in the Sguil client:
https://groups.google.com/d/topic/security-onion/P57oKu02tI4/discussion

I've updated the Sguil client with Bamm's patch and the new version
numbers are as follows:
securityonion-sguil-client - 20141004-0ubuntu0securityonion9
securityonion-sguil-sensor - 20141004-0ubuntu0securityonion9
securityonion-sguil-server - 20141004-0ubuntu0securityonion9
(since client, sensor, and server all come from the same tarball, a change in one causes a full rebuild of all 3 packages)

These new packages have been tested by the following (thanks!):
Eddy Simons
David Zawdie

These packages should resolve the following issue:
https://code.google.com/p/security-onion/issues/detail?id=646

Updating
The new packages are now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Training
Need training?  Please see:
https://security-onion-class-20141215.eventbrite.com/

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!

Sguil 0.9 and Squert 1.5.0 now available!

Sguil 0.9 and Squert 1.5.0 were recently released:
http://sourceforge.net/p/sguil/mailman/message/32230854/
http://www.squertproject.org/summaryofchangesforsquertversion130
http://www.squertproject.org/summaryofchangesforsquertversion140
http://www.squertproject.org/summaryofchangesforsquertversion150

I've updated our packages to include both of these releases.  The new package versions are as follows:

securityonion-capme - 20121213-0ubuntu0securityonion20
securityonion-http-agent - 0.3.1-0ubuntu0securityonion6
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion88
securityonion-ossec-rules - 20120726-0ubuntu0securityonion4
securityonion-setup - 20120912-0ubuntu0securityonion125
securityonion-sguil-agent-ossec - 20120726-0ubuntu0securityonion4
securityonion-sguil-client - 20141004-0ubuntu0securityonion7
securityonion-sguil-sensor - 20141004-0ubuntu0securityonion7
securityonion-sguil-server - 20141004-0ubuntu0securityonion7
securityonion-squert - 20141015-0ubuntu0securityonion3

Issues Resolved

Issue 287: Sguil 0.9
https://code.google.com/p/security-onion/issues/detail?id=287

Issue 622: Update http_agent for Sguil 0.9 and move from SSL to TLS
https://code.google.com/p/security-onion/issues/detail?id=622

Issue 623: Update ossec_agent for Sguil 0.9 and move from SSL to TLS
https://code.google.com/p/security-onion/issues/detail?id=623

Issue 624: Update CapMe for Sguil 0.9 and move from SSL to TLS
https://code.google.com/p/security-onion/issues/detail?id=624

Issue 625: Update NSM for Sguil 0.9
https://code.google.com/p/security-onion/issues/detail?id=625

Issue 626: Update Setup for Sguil 0.9
https://code.google.com/p/security-onion/issues/detail?id=626

Issue 491: Squert 1.5.0
https://code.google.com/p/security-onion/issues/detail?id=491

Issue 638: securityonion-ossec-rules: add rule to ignore Squert POST
https://code.google.com/p/security-onion/issues/detail?id=638

Release Notes
Please note that the Squert interface has changed quite a bit from the previous version.  In particular:

• To drill into an event to see the payload of the event, click on the value in the Status (ST) column.
• To generate a full pcap transcript, click on the value in the "Event ID" column.

Updating
The new packages are now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Updating packages using "sudo soup"

The new OSSEC rules package will prompt you to restart OSSEC

The new securityonion-sguil-sensor package will prompt you to restart sensor services

The new securityonion-sguil-server package will update your database and import your autocat rules

The new securityonion-sguil-server package will then prompt you to restart server services

The new securityonion-squert package will update your database

Restarting OSSEC using "sudo service ossec-hids-server restart"

Restarting server and sensor processes using "sudo service nsm restart"

The Sguil client is now updated to 0.9...

...and includes an AutoCat Rule Builder...

...and an AutoCat Viewer 

Squert has been updated to 1.5.0

Squert Event tab

In Squert, you can now pivot to ELSA

Pivoting from IP address in Squert to an ELSA query for the IP

Squert now allows you to color code IP addresses

Color-coded IP address

Squert AutoCat Viewer

Squert Summary tab including GeoIP mapping

Squert Views tab with Sankey Diagram

Thanks
Thanks to the following for testing!
Eddy Simons
Mike Pilkington
Landon Lewis
David Zawdie

Feedback
If you have any questions or problems, please use our security-onion mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Commercial Support
Need commercial support?  Please see:
http://securityonionsolutions.com

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:
http://groups.google.com/group/security-onion

We also need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!

Bro 2.2 and ELSA 1.5 packages now available

We have some new packages available for Bro 2.2 and ELSA 1.5!

ELSA 1.5 with support for Bro 2.2 and more log types

Release Notes

IMPORTANT! If you are upgrading a distributed deployment, it is vitally important that you upgrade the master before upgrading the sensors!  After upgrading the master and all sensors, if the ELSA web interface doesn't show all of your nodes properly, you may need to do the following:

• restart autossh on each sensor:
  sudo pkill -USR1 autossh
• stop/start (NOT restart) starman on each sensor:
  sudo service starman stop
  sudo service starman start
• restart Apache on your master server:
  sudo service apache2 restart

If you have email configured on your sensor and you start getting lots of email from the ELSA cron job, you can fix it by changing the last line of /etc/cron.d/elsa as follows (moving 2>&1 to the end of the line):

* * * * * root perl /opt/elsa/web/cron.pl -c /etc/elsa_web.conf > /dev/null 2>&1

If you had previously installed the APT1 scripts per http://blog.securityonion.net/2013/02/seth-halls-bro-module-for-apt1-detection.html, the update will detect this and automatically enable the new version of the APT1 scripts.  If you would like to manually enable the APT1 scripts, do the following:

sudo sed -i 's|#@load apt1|@load apt1|g' /opt/bro/share/bro/site/local.bro
sudo broctl check && sudo broctl install && sudo broctl restart

The new version of Setup asks if you want to configure Bro to extract files (EXEs by default).  If you've already run Setup and want to enable file extraction, do the following:

sudo sed -i 's|#@load file-extraction|@load file-extraction|g' /opt/bro/share/bro/site/local.bro
sudo broctl check && sudo broctl install && sudo broctl restart

The new version of Setup configures Snorby to allow you to pivot from an IP address in Snorby to an ELSA query for that IP address.  If you've already run Setup and want to add this capability to Snorby, click Administration and then click Lookup Sources and add the following (also see screenshot in the Screenshots section):

https://elsa.ip.addr.ess:3154/?query_string="${ip}"%20groupby:program

Issues Resolved

Issue 362: sguil-db-purge - add DAYSTOREPAIR option
https://code.google.com/p/security-onion/issues/detail?id=362

Issue 395: Bro 2.2
https://code.google.com/p/security-onion/issues/detail?id=395

Issue 426: Update http_agent for Bro 2.2
https://code.google.com/p/security-onion/issues/detail?id=426

Issue 420: Setup should no longer disable Bro PF_RING since it should
work in 2.2
https://code.google.com/p/security-onion/issues/detail?id=420

Issue 424: Setup should write out changes to /etc/network/interfaces
and then prompt for reboot
https://code.google.com/p/security-onion/issues/detail?id=424

Issue 415: Setup should ask user about DAYSTOKEEP and DAYSTOREPAIR
https://code.google.com/p/security-onion/issues/detail?id=415

Issue 396: Setup should give the option of enabling file extraction in Bro
https://code.google.com/p/security-onion/issues/detail?id=396

Issue 433: Setup should configure Snorby to pivot from an IP address to ELSA
https://code.google.com/p/security-onion/issues/detail?id=433

Issue 431: Update APT1 scripts for Bro 2.2
https://code.google.com/p/security-onion/issues/detail?id=431

Issue 350: Modify Sguil client to allow pivoting directly to ELSA query
https://code.google.com/p/security-onion/issues/detail?id=350

Issue 346: New ELSA packages
https://code.google.com/p/security-onion/issues/detail?id=346

Issue 343: Add more Bro logs to ELSA
https://code.google.com/p/security-onion/issues/detail?id=343

Issue 434: nsm_sensor_ps-start shouldn't call sensor_cleandisk anymore
https://code.google.com/p/security-onion/issues/detail?id=434

New/Updated packages

securityonion-bro - 2.2-0ubuntu0securityonion9
securityonion-bro-scripts - 20121004-0ubuntu0securityonion17
securityonion-elsa - 1090-1ubuntu0securityonion11
securityonion-elsa-extras - 20131117-1ubuntu0securityonion19
securityonion-elsa-node-perl - 20130819-0ubuntu0securityonion2
securityonion-elsa-web-perl - 20131029-0ubuntu0securityonion0ubuntu1
securityonion-http-agent - 0.3.1-0ubuntu0securityonion3
securityonion-libapache-logformat-compiler-perl - 0.13-0ubuntu0securityonion1
securityonion-libcapture-tiny-perl - 0.22-0ubuntu0securityonion0
securityonion-libclass-method-modifiers-perl - 2.04-1ubuntu0securityonion1
securityonion-libcookie-baker-perl - 0.01-1ubuntu0securityonion1
securityonion-libdevel-stacktrace-perl - 1.30-1ubuntu0securityonion0
securityonion-libexception-class-perl - 1.37-1ubuntu0securityonion1
securityonion-libextutils-config-perl - 0.007-1ubuntu0securityonion0
securityonion-libextutils-helpers-perl - 0.021-1ubuntu0securityonion0
securityonion-libextutils-installpaths-perl - 0.009-1ubuntu0securityonion0
securityonion-liblog-log4perl-appender-socket-unix-perl - 1.04-1ubuntu0securityonion0
securityonion-liblog-syslog-constants-perl - 1.02-1ubuntu0securityonion0
securityonion-liblog-syslog-fast-perl - 0.61-1ubuntu0securityonion1
securityonion-libmoo-perl - 1.003-1ubuntu0securityonion1
securityonion-libmoox-types-mooselike-numeric-perl - 1.01-1ubuntu0securityonion1
securityonion-libmoox-types-mooselike-perl - 0.25-1ubuntu0securityonion0
securityonion-libplack-middleware-xforwardedfor-perl - 0.1030-1ubuntu0securityonion0
securityonion-librole-tiny-perl - 1.003-1ubuntu0securityonion1
securityonion-libtest-name-fromline-perl - 0.11-1ubuntu0securityonion1
securityonion-libtest-time-perl - 0.04-1ubuntu0securityonion1
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion64
securityonion-setup - 20120912-0ubuntu0securityonion89
securityonion-sguil-client - 0.8.0-0ubuntu0securityonion15
securityonion-sguil-db-purge - 20120722-0ubuntu0securityonion7

The new packages have been tested by the following (thanks!):

Heine Lysemose
JP Bourget
Matt Gregory
David Zawdie

Screenshots

Bro update

ELSA update

ELSA update with support for more Bro logs

http_agent update

New Sguil client supports pivoting from IP address to ELSA query

Pivoting from Sguil/Snorby to ELSA

Manually adding ELSA as a Lookup Source after running Setup

Pivoting from Snorby to ELSA

New Setup screen for DAYSTOKEEP

New Setup screen for DAYSTOREPAIR

New Setup screen for enabling Bro file extraction

ELSA query for BRO_SOFTWARE

ELSA query for BRO_FILES

ELSA query for BRO_NOTICE

ELSA query for BRO_WEIRD

Updating
The new packages are now available in our stable repo.  Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

New securityonion-sguil-client and securityonion-sguil-server packages include Bro Transcript functionality

New versions of our securityonion-sguil-client and securityonion-sguil-server packages are now available that add a new "Bro" option to the Sguil client's right-click context menu.  This option will run the pcap through a Bro script that will mimic the existing tcpflow transcript option but with a couple of very important changes:

• any gzipped server responses are automatically unzipped
• transcripts are rendered for not only tcp but also udp traffic

This update resolves the following issue:
Issue 347: New Sguil client transcript option to run through tcpudpflow.bro

Thanks
Thanks to Scott Runnels for his work on the Bro script and changes to the sguil packages!
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie

Upgrading
The new packages are now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart sguild:

sudo nsm_server_ps-restart

Screenshots

Upgrade Process

Restarting sguild

Existing Transcript option

Existing Transcript option doesn't handle gzip encoded server responses

New Bro option

New Bro option unzips any gzip encoded server responses

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Training
Want to learn more about Security Onion?  Sign up for the upcoming 8-hour class in Augusta GA!
http://securityonion.eventbrite.com/

New securityonion-sguil-client package now available

I've patched the Sguil client to add "Copy IP Address" to the right-click context menu for IP addresses. So for example, if you find an interesting IP address in Sguil and want to search ELSA for that IP address, you can just right-click the IP address, select "Copy IP Address", select "SrcIP" or "DstIP", and then alt-tab to your ELSA window and paste it in.

Copy IP Address

Thanks
The new package has been tested by the following:
David Zawdie
Heine Lysemose

Upgrading
The new package is now available in our stable repo.  Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Security Onion 12.04 Beta Available Now!

After many months of hard work, I'm excited to announce that Security Onion 12.04 Beta is available now!  Thanks to everyone who has helped get us this far!

Quick highlights:

• Choose your favorite flavor of 32-bit/64-bit Ubuntu (Ubuntu, Kubuntu, Lubuntu, Xubuntu, or Ubuntu Server)

• Add our PPA and our packages and run through the Setup wizard to get:

• Snort, Suricata, Bro, Sguil, Squert, Snorby, NetworkMiner

• PF_RING and AF_PACKET fanout for high performance and scalability

• ELSA - Enterprise Log Search and Archive

For full instructions, please see the Security Onion 12.04 Beta page on our Wiki.

If you're at DerbyCon this weekend, come check out the new Security Onion 12.04 Beta on Saturday at 6:00 PM! 

Sguil showing 2 load-balanced Snort processes using PF_RING

Snorby showing 2 load-balanced Snort processes using PF_RING

Squert showing 2 load-balanced Snort processes using PF_RING

ELSA with new Dashboard functionality

Security Onion 20120125 now available!

Security Onion 20120125 is now available!  This resolves the following issues:
Issue 203: New users should have a more sensible default for Sguil client fonts
Issue 204: /usr/local/sbin/nsm_server_del: line 192: [: eq: binary operator expected
Issue 206: /usr/local/sbin/nsm_sensor_clean should purge old Bro logs
Issue 207: Re-install /etc/skel/.bashrc to enable bash coloring
Issue 208: Need a new ISO for NoVA Hackers presentation

New Users
New users can download and install the 20120125 ISO image using the instructions here.

In-place Upgrade
Existing Security Onion users can perform an in-place upgrade using the following command (if you're behind a proxy, remember to set your proxy variables as described in the FAQ):

sudo -i "curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh"

Screenshots

Upgrade Process

Feedback
If you have any questions, please join our mailing list and ask away!
http://groups.google.com/group/security-onion

Toolsmith Tool of the Year
If you're a fan of Security Onion, please vote for it for 2011 Toolsmith Tool of the Year!
http://holisticinfosec.blogspot.com/2011/12/choose-2011-toolsmith-tool-of-year.html

Security Onion 20111201 now available!

Security Onion 20111201 is now available!  This resolves the following issues:

Issue 157: Update pulledpork.conf.master with new local_rules declaration

Issue 159: NSM scripts are storing initial Sguil credentials in /etc/nsm/securityonion/server.conf

New Users

New users can download and install the 20111103 ISO image using the instructions here.  The step marked "Install Security Onion updates" will automatically install this update.

In-place Upgrade

Existing Security Onion users can perform an in-place upgrade using the following command (if you're behind a proxy, remember to set your proxy variables as described in the FAQ):

sudo -i "curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh"

Note that the upgrade script is cumulative and will upgrade any older version of Security Onion to the most recent version (including any updates in between).

Screenshots

Upgrade Process