Elastic 6.8.2, Wazuh 3.9.5, and updated packages for Setup, CapMe, and sostat are now available for Security Onion!

The following updates are now available for Security Onion!
Elastic 6.8.2 Docker images
Wazuh 3.9.5 (packaged as ossec-hids-server - 3.9.5.1-ubuntu1securityonion1)
securityonion-capme - 20121213-0ubuntu0securityonion78
securityonion-elastic - 20190510-1ubuntu1securityonion65
securityonion-setup - 20120912-0ubuntu0securityonion312
securityonion-sostat - 20120722-0ubuntu0securityonion129

These updates resolve a whopping 85 issues!  You can see the full list of resolved issues at the end of this blog post, but here is a quick summary of the new features in this release.

Setup can now run interactively via CLI!  Setup started out as a GUI built using Zenity.  Many years ago, we added the ability to automate Setup using sosetup.conf and this helped folks who didn't want to run Setup via GUI.  When Mike Reeves began building Hybrid Hunter last year, he started a new Setup process from scratch using whiptail to allow interactive prompts via CLI.  We've now added whiptail support to our existing 16.04 Setup!

Interactive Setup via CLI

Running sosetup-minimal and choosing Evaluation Mode can run in only 4GB RAM!

sosetup-minimal Evaluation Mode

LOGSTASH_MINIMAL config moves parsing from Logstash to Elasticsearch ingest node (NIDS alerts and Bro logs in JSON format) allowing Logstash to start faster and consume less resources!

LOGSTASH_MINIMAL config

so-import-pcap has been completely overhauled!

Lots of bug fixes and performance improvements!

If you would like to switch from open source Elastic to Elastic Features, then you can run the new so-elastic-features and it will walk you through that process!

so-elastic-features

If you would like to enable native Elastic authentication, you can run the new so-elastic-auth!  This will automatically run so-elastic-features as shown above and then enable Elastic authentication which includes Role Based Access Control (RBAC)!

so-elastic-auth

Kibana auth

so-elastic-auth enumerates your existing Sguil/Squert user accounts and automatically generates corresponding Elastic accounts with minimal privileges

Thanks

Thanks to the Elastic team for Elastic 6.8.2!
Thanks to the Wazuh team for Wazuh 3.9.5!
Thanks to the following for testing and QA!

• Wes Lambert
• Josh Brower
• Dustin Lee

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Conference
Registration is now open for Security Onion Conference 2019 on Friday, October 4, 2019!
https://socaugusta2019.eventbrite.com/

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Security Onion Training classes coming up in Columbia MD and Augusta GA!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Documentation Updates

https://securityonion.readthedocs.io/en/latest/use-cases.html#minimal-evaluation
https://securityonion.readthedocs.io/en/latest/elastic-features.html
https://securityonion.readthedocs.io/en/latest/elastic-auth.html
https://securityonion.readthedocs.io/en/latest/accounts.html
https://securityonion.readthedocs.io/en/latest/passwords.html
https://securityonion.readthedocs.io/en/latest/adding-accounts.html
https://securityonion.readthedocs.io/en/latest/listing-accounts.html
https://securityonion.readthedocs.io/en/latest/disabling-accounts.html
https://securityonion.readthedocs.io/en/latest/so-elasticsearch-query.html
https://securityonion.readthedocs.io/en/latest/logstash.html#logstash-minimal
https://securityonion.readthedocs.io/en/latest/quick-iso-image.html
https://securityonion.readthedocs.io/en/latest/installing-on-ubuntu.html
https://securityonion.readthedocs.io/en/latest/production-deployment.html
https://securityonion.readthedocs.io/en/latest/cheat-sheet.html

Issues Resolved

Setup: interactive setup via command line

securityonion-elastic: change Beats user_data field to dynamic mapping

ElastAlert dashboard filter

Wazuh 3.9.5

securityonion-elastic: update Logstash config to support Wazuh 3.9 agent

securityonion-elastic: simplify Firewall Action/Reason viz to just Action

Logstash crashes due to logstash-filter-tld

securityonion-elastic: so-logstash-start should map /var/log/nsm/securityonion/

securityonion-elastic: Bro Logstash config - change body_len to body_length

securityonion-elastic: Add evaluation for multiple IPs in file_ip or destination_ip in Bro files.log

securityonion-elastic: add image_timestamp to autoruns pattern

securityonion-elastic: improve selection of closed indices in so-curator-closed-delete-delete

so-import-pcap: improve Logstash initialization check

so-import-pcap: improve handling of single pcap without full path

securityonion-elastic: Update OSSEC Dashboard

securityonion-elastic: DHCP dashboard should show hostname field

securityonion-elastic: copy so-ossec-verb scripts to so-wazuh-verb

securityonion-elastic: add note to Help dashboard that Wazuh has replaced OSSEC

securityonion-elastic: decrease logstash pipeline.workers depending on config

securityonion-elastic: improve Kibana check before importing dashboards and config

so-import-pcap: if pcap already exists in pcap store, then use mergecap to avoid overwriting

so-import-pcap: create lock file to prevent multiple instances from trying to configure the system at the same time

securityonion-setup: default PCAP_OPTIONS in sosetup-forward.conf to no options

securityonion-elastic: add so-redis-count

securityonion-elastic: improve status scripts

so-import-pcap: split configuration out into separate script

so-import-pcap: create lock file to prevent multiple instances from writing to pcap store at same time

so-import-pcap: create lock file to prevent multiple instances from writing IDS alerts at same time

securityonion-elastic: so-elasticsearch-start should map /etc/elasticsearch

securityonion-elastic: add login and logout to apache reverse proxy

securityonion-elastic: so-elasticsearch-start needs to set ownership on /etc/elasticsearch/

securityonion-elastic: change ownership and perms of kibana.yml

securityonion-elastic: support elastic auth in so-component-verb scripts

sostat: support elastic auth

securityonion-elastic: create so-elastic-auth

securityonion-elastic: create so-elastic-features

securityonion-elastic: copy so-bro-verb scripts to so-zeek-verb

securityonion-elastic: so-test-configure-bro no longer needs to configure for smb

securityonion-setup: support elastic auth

CapMe: support Elastic auth

securityonion-elastic: create so-elasticsearch-query

securityonion-setup: if re-running setup, delete any existing elastic auth config

securityonion-elastic: update so-user-* to support elastic auth

Elastic 6.8.2

Setup: sosetup-network should check for hostname of securityonion and recommend changing

securityonion-elastic: create new LOGSTASH_MINIMAL config

securityonion-setup: create new sosetup-minimal script

securityonion-elastic: create so-rule-update as a wrapper to rule-update

securityonion-elastic: don't overwrite conf.d.redis.output files

securityonion-elastic: support elastic auth in ElastAlert

securityonion-elastic: fix typo in 6501_ossec_sysmon.conf

securityonion-elastic: support elastic auth in curator

securityonion-elastic: upgrades need to preserve auth settings in elasticsearch.yml and kibana.yml

Wazuh: create agent-template.conf

securityonion-elastic: update logstash jvm.options

securityonion-elastic: update so-elasticsearch-node-list and so-elasticsearch-node-remove

securityonion-elastic: elasticsearch ingest node parsing should create bro_conn total_bytes

securityonion-elastic: elasticsearch ingest geoip should output all fields

securityonion-elastic: update elasticsearch ingest parser for bro_ntlm

securityonion-elastic: update elasticsearch ingest parser for bro_ssh

securityonion-elastic: elasticsearch ingest node parsing should populate connection_state_description

so-import-pcap: improve geoip for NIDS alerts

so-import-pcap: parse NIDS rule category

so-import-pcap: set NIDS severity field

securityonion-elastic: move common ingest node config into common file

securityonion-elastic: ingest node parser for ossec/wazuh

securityonion-elastic: resize DHCP hostname viz to avoid scrollbars

securityonion-elastic: LOGSTASH_MINIMAL should support standard syslog

securityonion-elastic: update Help dashboard

securityonion-elastic: LOGSTASH_MINIMAL should parse NIDS logs via ingest

so-import-pcap: fix sguild_nids parsing for ICMP alerts

so-import-pcap: sguild_nids should translate protocol field

securityonion-elastic: common_nids should set rule_type

securityonion-elastic: common_nids should set signature_info

so-import-pcap: sguild_nids dissect should drop on failure

securityonion-elastic: snort ingest drop on failure

so-import-pcap: sguild_nids should drop null values in source_ip, destination_ip, and protocol

securityonion-elastic: change DHCP dashboard button from Refresh to Update

securityonion-elastic: adjust DHCP Logs panel to avoid scrollbars

securityonion-elastic: create bro_common_ssl to parse cert fields for bro ssl and x509 logs

securityonion-elastic: add length fields to bro_http ingest

securityonion-elastic: add query_length field to bro_dns ingest

securityonion-elastic: improve LOGSTASH_MINIMAL config file check in so-logstash-start

so-import-pcap-configure: improve heap adjustment

securityonion-setup: improve heap adjustment in sosetup-minimal

securityonion-setup - 20120912-0ubuntu0securityonion294 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion294 is now available and should resolve the following issue:

Setup: sudo fails during sosetup if NOPASSWD:ALL not enabled #1490
https://github.com/Security-Onion-Solutions/security-onion/issues/1490

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Training
We have 4-day Security Onion Basic Training classes coming up in Columbia, MD and Costa Mesa CA!  Use promotional code marchmadness for 10% off either of these classes through the end of March!  If you can't make it to an onsite class, we have a new online training platform.  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've got a brand new documentation site!  Please let us know if anything needs to be updated:
https://securityonion.net/docs

Support
Need support?  Please see:
https://securityonion.net/docs/Support

Thanks!

New Setup and NSM packages now available for Security Onion!

The following packages are now available:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion199
securityonion-setup - 20120912-0ubuntu0securityonion285

This should resolve the following issues:

Setup: update setup conf files #1417
https://github.com/Security-Onion-Solutions/security-onion/issues/1417

Setup: Fix bug where the regex in sed disables incorrect interfaces #1427
https://github.com/Security-Onion-Solutions/security-onion/issues/1427

Setup: add logger node to Bro node.cfg #1420
https://github.com/Security-Onion-Solutions/security-onion/issues/1420

Setup: configure Bro cluster mode for AF_PACKET #1421
https://github.com/Security-Onion-Solutions/security-onion/issues/1421

Setup: configure Suricata for AF_PACKET #1432
https://github.com/Security-Onion-Solutions/security-onion/issues/1432

NSM: Improve the method of updating thread count in suricata.yaml #1230
https://github.com/Security-Onion-Solutions/security-onion/issues/1230

NSM: support running Suricata using AF_PACKET #1431
https://github.com/Security-Onion-Solutions/security-onion/issues/1431

As an overview, these updates will cause new installations to configure Bro and Suricata to collect network traffic via AF_PACKET (instead of PF_RING as we've done for the last few years).  Installations already configured for PF_RING will continue to use PF_RING.  Please see the links above for background information and config changes.

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in San Antonio TX, Atlanta GA, and Columbia MD!  If you can't make it to one of these onsite classes, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Documentation
We've started moving our documentation to https://securityonion.net/docs!  Please let us know if anything needs to be updated.

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion278 now available for Security Onion 16.04!

The following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion278

This should resolve the following issues:

Setup: ensure Apache SSO config is enabled #1355
https://github.com/Security-Onion-Solutions/security-onion/issues/1355

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have a 4-day Security Onion training class coming up in San Antonio, Texas!  If you can't make it to this onsite class, we have a new online training platform!  For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances!  For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion251 now available for Security Onion!

The following package is now available:

securityonion-setup - 20120912-0ubuntu0securityonion251

This new package should resolve the following issue:

Issue 1216: Setup - default to Elastic
https://github.com/Security-Onion-Solutions/security-onion/issues/1216

Release Notes
Setup now defaults to Elastic instead of ELSA.  ELSA will reach End Of Life on October 9, 2018.  If for some reason you still need to run the old ELSA version of Setup, you can manually run:

sudo sosetup-elsa

Thanks
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We offer both onsite and online training!  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion248 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion248 is now available and should resolve the following issues:

Issue 1161: so-email: fix any references to sosetup
https://github.com/Security-Onion-Solutions/security-onion/issues/1161

Issue 1163: Setup: disable Xplico when choosing Evaluation Mode
https://github.com/Security-Onion-Solutions/security-onion/issues/1163

Thanks
Thanks to Wes Lambert for testing the new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions offers onsite and online training!  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion246 now available for Security Onion!

securityonion-setup - 20120912-0ubuntu0securityonion246 is now available and should resolve the following issues:

Setup: add support for Elastic via sosetup.conf #1135
https://github.com/Security-Onion-Solutions/security-onion/issues/1135

Thanks
Thanks to Wes Lambert for testing the new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
We have a 4-day Security Onion training class coming up in San Antonio, Texas!  For this and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion245 now available for Security Onion!

The following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion245

This package should resolve the following issues:

setup: add EXPERIMENTAL option for Elastic #1128
https://github.com/Security-Onion-Solutions/security-onion/issues/1128

PLEASE NOTE!  This EXPERIMENTAL option will only be offered if the EXPERIMENTAL securityonion-elastic package is installed.  If you install the EXPERIMENTAL securityonion-elastic package and then choose this EXPERIMENTAL option, the usual disclaimers and warnings apply!

• This EXPERIMENTAL software is PRE-ALPHA, BLEEDING EDGE, and TOTALLY UNSUPPORTED!
• If this breaks your system, you get to keep both pieces!
• This is a work in progress and is in constant flux.
• This is intended to build a quick prototype proof of concept so you can see what our ultimate Elastic configuration might look like.  This configuration will change drastically over time leading up to the final release.
• Do NOT run this on a system that you care about!
• Do NOT run this on a system that has data that you care about!
• This should only be run on a TEST box with TEST data!
• Use of this script may result in nausea, vomiting, or a burning sensation.

Thanks
Thanks to Wes Lambert for testing the new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference 2017 will be on Friday September 15 in beautiful Augusta, GA!
https://securityonion.net/conference

Training
We have a 4-day Security Onion training class right before the Security Onion Conference in Augusta GA.  For this and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

securityonion-setup - 20120912-0ubuntu0securityonion237 now available for Security Onion!

The following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion237

This package should resolve the following issue:

Issue 1113: so-allow/disallow: fix wrong number of arguments error
https://github.com/Security-Onion-Solutions/security-onion/issues/1113

Thanks
Thanks to Wes Lambert for submitting the pull request and testing the new package!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 15 in beautiful Augusta, GA!
https://securityonion.net/conference

Training
We have a 4-day Security Onion training class right before the Security Onion Conference in Augusta GA.  For this and other training options, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!