Security Onion: squert

Showing posts with label squert. Show all posts

Thursday, September 19, 2019

securityonion-squert - 20161212-1ubuntu1securityonion44 now available for Security Onion!

securityonion-squert - 20161212-1ubuntu1securityonion44 is now available for Security Onion! This should resolve the following issue:

Squert: improve consistency of username handling #1643
https://github.com/Security-Onion-Solutions/security-onion/issues/1643

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Documentation
We've got a brand new documentation site! Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Conference
Only a few days left to register for Security Onion Conference 2019 on Friday, October 4, 2019!
https://socaugusta2019.eventbrite.com/

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have a 4-day Security Onion Training class coming up in Augusta GA! If you can't make it to an onsite class, we have a new online training platform. For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support? Please see:
https://securityonion.net/docs/Support

Thanks!

Wednesday, August 14, 2019

securityonion-squert - 20161212-1ubuntu1securityonion43 now available for Security Onion!

securityonion-squert - 20161212-1ubuntu1securityonion43 is now available for Security Onion! This package should resolve the following issue:

securityonion-squert: increase group_concat_max_len #1602
https://github.com/Security-Onion-Solutions/security-onion/issues/1602

Thanks
Thanks to Wes Lambert for testing!

Updating
Please see the following page for full update instructions:
https://securityonion.net/docs/Upgrade

Conference
Registration is now open for Security Onion Conference 2019 on Friday, October 4, 2019!
https://socaugusta2019.eventbrite.com/

Documentation
We've got a brand new documentation site! Please let us know if anything needs to be updated:
https://securityonion.net/docs

Also, we're now offering a printed copy of our official documentation with foreword by Richard Bejtlich and proceeds going to Rural Technology Fund:
https://securityonion.net/book

Training
Security Onion Solutions is the only official authorized training provider for Security Onion and we have 4-day Security Onion Training classes coming up in Columbia MD and Augusta GA! If you can't make it to an onsite class, we have a new online training platform. For more information and other training options, please see:
https://securityonionsolutions.com

Appliances
We now offer hardware appliances! For more information, please see:
https://blog.securityonion.net/2018/10/introducing-security-onion-solutions.html

Support
Need support? Please see:
https://securityonion.net/docs/Support

Thanks!

Wednesday, June 12, 2019

Analyze pcaps in 3 simple steps using Security Onion's improved so-import-pcap!

In February 2018, we released an initial version of so-import-pcap to allow you to easily import pcap files into Security Onion while preserving original timestamps. Then in February 2019, we totally revamped so-import-pcap to make it much easier, faster, and have better error handling!

Our most recent ISO image includes the latest version of so-import-pcap and one of the new features is the ability to automatically run Setup for you. This means that you can now analyze pcap files in Security Onion in just 3 simple steps!

install our most recent ISO image
sudo so-import-pcap /path/to/pcap/file
log into Squert and Kibana to review alerts and logs with original timestamps

Another big difference in this new version of so-import-pcap is that we've drastically improved performance by switching to Elasticsearch ingest node parsing. Logstash now initializes in just a few seconds and your NIDS alerts and Bro logs can be found in Kibana shortly thereafter. This also heavily reduces the resource requirements. In the final screenshot below, you'll notice that we're using just over 3GB RAM (instead of the 8GB RAM that we would recommend for the previous version of so-import-pcap).

Finally, this new so-import-pcap should now handle errors much more gracefully. For example, corrupt pcap files are now automatically fixed using pcapfix.

As a reminder, so-import-pcap is NOT intended to run on your existing production deployment. Instead, it is intended for standalone systems designated for so-import-pcap.

Screenshot Tour

so-import-pcap warns before making any changes

so-import-pcap can now run Setup automatically for you

When so-import-pcap is complete, it will provide a hyperlink to view all data in Kibana

Kibana and Squert displaying logs and alerts while using just over 3GB RAM

Monday, July 9, 2018

securityonion-squert - 20161212-1ubuntu1securityonion42 now available for Security Onion 16.04!

securityonion-squert - 20161212-1ubuntu1securityonion42 is now available for Security Onion 16.04 and should resolve the following issues:

Squert: Priority counts incorrect #1277
https://github.com/Security-Onion-Solutions/security-onion/issues/1277

Thanks
Thanks to Wes Lambert for testing this package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia! For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://securityonion.net/wiki/Support

Thanks!

Tuesday, June 19, 2018

securityonion-squert - 20161212-1ubuntu1securityonion41 now available for Security Onion 16.04!

securityonion-squert - 20161212-1ubuntu1securityonion41 is now available for Security Onion 16.04 and should resolve the following issues:

Squert: turning grouping off results in no alerts #1259
https://github.com/Security-Onion-Solutions/security-onion/issues/1259

Thanks
Thanks to Wes Lambert for testing this new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Training
We have 4-day Security Onion training classes coming up in Maryland and Georgia! For more information and other training options, please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://securityonion.net/wiki/Support

Thanks!

Wednesday, March 28, 2018

Security Onion Elastic Stack Release Candidate 4 and Security Onion 14.04.5.10 ISO Image!

UPDATED 2018/04/09! We've released a newer version!
https://blog.securityonion.net/2018/04/security-onion-elastic-stack-general.html

We're excited to announce that our Elastic Stack integration has now reached Release Candidate 4 (RC4)! RC4 includes a new 14.04.5.10 ISO image that contains these RC4 components and all the latest Ubuntu and Security Onion updates as of March 26, 2018!

RC4 Highlights

All Ubuntu and Security Onion updates as of 2018/3/26
Elastic Stack Release Candidate 4:
https://github.com/Security-Onion-Solutions/security-onion/issues/1219
Docker images based on Elastic Stack 6.2.3
Elasticsearch dynamic mapping is now set to false to prevent field limit explosion.
Elasticsearch and Logstash now set heap and other java options in jvm.options.
/etc/logstash/conf.d/ is now a collection of symbolic links to the actual files. This will allow you to disable parts of the Logstash config without having them re-enabled at next upgrade.
To increase performance, Logstash no longer looks up IDS rules.
CapMe now displays the log that you pivoted from and, if it was an IDS alert, it will display the rule that generated the alert.
Lots of new so-$COMPONENT-$VERB scripts for controlling various components.
Elastic recently implemented a new skip_unavailable option for cross cluster nodes and this replaces our old so-crossclustercheck workaround.
Lots of other improvements and bug fixes!

Issues Resolved

Issue 1223: 14.04.5.10 ISO image
https://github.com/Security-Onion-Solutions/security-onion/issues/1223

This new ISO image has been tested by Mike Reeves and Wes Lambert. Thanks, guys!

Known Issues
For known issues, please see the todo list for our next Elastic release:
https://github.com/Security-Onion-Solutions/security-onion/issues/1221

Thanks
Special thanks to the following for their contributions to our Elastic Stack integration!

Elastic.co
Justin Henderson
Mark Baggett

New Installations
We've updated the Verify_ISO page for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/blob/master/Verify_ISO.md

Please remember to verify the signature of the downloaded ISO image using the instructions on that page.

Please note! This ISO image includes the EXPERIMENTAL Elastic stack!

The Elastic components are included in the ISO image and Setup gives you an option of Stable Setup (ELSA) or Experimental Setup (Elastic). If you do not want to try the new Elastic stack, you can choose Stable Setup. If you choose Experimental Setup, the usual disclaimers and warnings apply!

Experimental Setup is BLEEDING EDGE and TOTALLY UNSUPPORTED!
If this breaks your system, you get to keep both pieces!
This is a work in progress and is in constant flux.
This is intended to build a quick prototype proof of concept so you can see what our ultimate Elastic configuration might look like. This configuration will change drastically over time leading up to the final release.
Do NOT run this on a system that you care about!
Do NOT run this on a system that has data that you care about!
This should only be run on a TEST box with TEST data!
Experimental Setup may result in nausea, vomiting, or a burning sensation.

For more about Elastic Release Candidate 4, please see https://securityonion.net/wiki/elastic and the Screenshot tour at the bottom of this blog post.

Please note the following minimum hardware requirements for the Elastic stack:

2 CPU cores
8GB RAM

If you would prefer an ISO image with no Elastic components at all, you have a few options: