Ubuntu MySQL Updates

Ubuntu recently released updated MySQL packages.  As a reminder, please follow the instructions at the following link to avoid any issues with MySQL updates:
https://code.google.com/p/security-onion/wiki/MySQLUpdates

New netsniff-ng and NSM packages now available

I've packaged a new version of netsniff-ng that allows for dropping privileges to a non-root user and I've updated the NSM scripts to take advantage of that.  These new packages fix the following issues:
Issue 310: Update netsniff-ng
Issue 320: Update NSM scripts so that nsm_sensor_ps-restart includes $PCAP_OPTIONS
Issue 311: Update NSM scripts to run netsniff-ng as non-root user
Issue 318: Update NSM scripts to force netsniff-ng to write to proper directory
Issue 303: Update NSM scripts so that sensor_cleandisk looks for unified2 files in proper directories

The new packages have been tested by the following (thanks!):
Heine Lysemose
Matt Gregory
David Zawdie

Updating
The new packages are now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Once the new packages are installed, you'll need to restart netsniff-ng to run the new binary as a non-root user:

sudo nsm_sensor_ps-restart --only-pcap

Screenshots

Update Process

Restarting netsniff-ng

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you or your organization has found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel.  Thanks!

Snort 2.9.4.1 packages now available

Snort 2.9.4.1 was recently released:
http://blog.snort.org/2013/03/snort-2941-has-been-released.html

I've packaged Snort 2.9.4.1 and DAQ 2.0.0 and the new packages have been tested by the following (thanks!):
Heine Lysemose
David Zawdie

The new packages are now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Please note that, if you normally use the Registered User VRT Ruleset, you are on a 30-day delay and rules may not be available for Snort 2.9.4.1 yet.

Install Process

The Snort update will do the following:

• back up each of your existing snort.conf file(s) to snort.conf.bak
• update Snort to 2.9.4.1

If you're running Snort in production, then you'll need to do the following:

• apply your local customizations to the new snort.conf file(s)
• update ruleset and restart Snort as follows:

sudo rule-update

sudo apt-get update && sudo apt-get dist-upgrade

snort -V

Apply any local customizations to snort.conf and then run "sudo rule-update"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Suricata 1.4.1 package now available

Suricata 1.4.1 was recently released:
http://suricata-ids.org/2013/03/08/suricata-1-4-1-released/

I've packaged Suricata 1.4.1 and it has been tested by the following (thanks!):
Eric Ooi
David Zawdie

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Install Process

The Suricata update will do the following:

• install some new dependencies (libluajit and libjansson)
• back up each of your existing suricata.yaml file(s) to suricata.yaml.bak
• update Suricata to 1.4.1

If you're running Suricata in production, then you'll need to do the following:

• apply your local customizations to the new suricata.yaml
• restart Suricata as follows:

sudo nsm_sensor_ps-restart --only-snort-alert

sudo apt-get update && sudo apt-get dist-upgrade

suricata -V

Update suricata.yaml file(s) and then run "sudo nsm_sensor_ps-restart --only-snort-alert"

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

New PRADS package available

I've packaged a new version of PRADS which changes the way that byte counts are reported.  PRADS will now report total IP bytes, which matches up with the way that NetworkMiner reports byte counts.  It also matches the byte counts in Bro's conn.log in the orig_ip_bytes and resp_ip_bytes fields.  For more details, please see:
https://github.com/gamelinux/prads/issues/30


The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

After upgrading, you'll need to manually restart PRADS as follows:

sudo nsm_sensor_ps-restart --only-prads

Here's an example using traffic from testmyids.com:

Byte counts in Sguil (provided by PRADS)

Byte counts in NetworkMiner

Byte counts in Bro's conn.log (orig_ip_bytes and resp_ip_bytes fields)

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

New PF_RING 5.5.2 packages now available!

PF_RING 5.5.2 was recently released:
http://www.ntop.org/pf_ring/pf_ring-5-5-2-released/

I've packaged PF_RING 5.5.2 and the packages have been tested by the following (thanks!):
Eric Ooi
David Zawdie
Matt Gregory

The new packages are now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Warnings
Ubuntu recently released some MySQL updates, so you may also be prompted to update MySQL at the same time.  If so, please cancel the update and use our recommended procedure for updating MySQL:
http://code.google.com/p/security-onion/wiki/MySQLUpdates

UPDATE 2013/03/13: Ubuntu recently released some kernel updates, so you may also be prompted to update your kernel packages at the same time.  If you do so, the PF_RING kernel module will get built for your current kernel and not for the newly installed kernel.  You should install JUST the updated kernel packages, reboot, and then install the updated PF_RING packages so that the module gets built properly for the new kernel.  If you accidentally install both the kernel and PF_RING packages at the same time and then reboot and find out that PF_RING services are failing, you can force PF_RING to build against the new kernel by simply running the update command again:

sudo apt-get update && sudo apt-get dist-upgrade

Install Process
The PF_RING update will do the following:

• stop all NSM sensor processes
• terminate any remaining processes using PF_RING
• remove the existing PF_RING module
• build the new PF_RING module
• start all NSM sensor processes

Upgrade Process

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Important note for those monitoring multiple interfaces with Bro

An issue was recently discovered in Bro 2.1 when monitoring multiple interfaces with PF_RING that could result in traffic loss.  This issue is targeted for resolution in Bro 2.2.

UPDATE 2013/05/13 - A new Setup package is now available which automatically disables Bro's PF_RING load balancing when multiple interfaces are being monitored:
http://securityonion.blogspot.com/2013/05/new-setup-package-avoids-bug-when.html

If you've already run Setup and selected multiple interfaces to monitor, please disable Bro's PF_RING load balancing as follows:

sudo broctl stop
sudo sed -i 's|^lb_method=pf_ring|#lb_method=pf_ring|g' /opt/bro/etc/node.cfg
sudo sed -i 's|^lb_procs|#lb_procs|g' /opt/bro/etc/node.cfg
sudo broctl install && sudo broctl start

For more information on the Bro issue, please see Bro Ticket #943.

New NSM scripts package now available!

I've updated our NSM scripts to resolve the following issues:

Issue 292: Need cronjob to reload syslog-ng at midnight
Issue 295: Increase sleep value in /etc/init/securityonion.conf
Issue 296: Run snort as non-root user
Issue 297: Run snort/suricata with unique PF_RING cluster-id per interface

Thanks to the following for testing this update!

Matt Gregory
GabrielS
Heine Lysemose

Installation
The new NSM scripts package is now available in our stable repo. You can initiate the update process using the graphical Update Manager or with the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Reminder about MySQL Updates
As a reminder, if you are prompted to install MySQL updates, please see the following for the recommended procedure for updating MySQL:
http://code.google.com/p/security-onion/wiki/MySQLUpdates

Feedback
If you have any questions or problems, please join our mailing list and ask away!
https://code.google.com/p/security-onion/wiki/MailingLists

Seth Hall's Bro Module for APT1 Detection

Seth Hall wrote a great Bro module based on the recent Mandiant APT1 report.  Here are some quick instructions for loading the module on a Security Onion sensor.

UPDATE 2013/12/11 - These scripts are for Bro 2.1 only.  We've released Bro 2.2 and included an updated version of the APT1 scripts written for Bro 2.2.  Please see:
http://blog.securityonion.net/2013/12/bro-22-and-elsa-15-packages-now.html

sudo apt-get install -y git

cd /opt/bro/share/bro/site/

sudo git clone git://github.com/sethhall/bro-apt1.git apt1

echo "@load apt1" | sudo tee -a local.bro

sudo broctl install && sudo broctl restart

New securityonion-snorby 20130129 package fixes a vulnerability

Snorby 2.5.6 was recently released to fix a vulnerability:
https://github.com/Snorby/snorby/blob/master/ChangeLog.md

I've packaged Snorby 2.5.6 and the new securityonion-snorby package has been tested and confirmed by the following (thanks!):
Heine Lysemose
Mark Hillick
Matt Gregory

The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Ubuntu recently released some MySQL updates, so you may also be prompted to update MySQL at the same time.  Please see the following for the recommended procedure for updating MySQL:
http://code.google.com/p/security-onion/wiki/MySQLUpdates

When the new securityonion-snorby package installs, it should restart Apache and, if Setup has already been run, it should run "bundle exec rake snorby:update" and restart the Snorby worker as follows (you can disregard any "Jammit Warning" messages):

Update Process

New securityonion-snorby package fixes multiple vulnerabilities

Snorby 2.5.4 was recently released with some vulnerability fixes:
https://github.com/Snorby/snorby/blob/master/ChangeLog.md

I've packaged Snorby 2.5.4 and the new securityonion-snorby package has been tested and confirmed by the following (thanks!):
Scott Runnels
Matt Gregory
Heine Lysemose
David Zawdie


The new package is now available in our stable repo. You can initiate the upgrade process using the graphical Update Manager or using the following one-liner:

sudo apt-get update && sudo apt-get dist-upgrade

Ubuntu recently released some MySQL updates, so you may also be prompted to update MySQL at the same time.  Please see the following for the recommended procedure for updating MySQL:

http://code.google.com/p/security-onion/wiki/MySQLUpdates

When the new securityonion-snorby package installs, it should restart Apache and, if Setup has already been run, it should run "bundle exec rake snorby:update" and restart the Snorby worker as follows (you can disregard any "Jammit Warning" messages):

Upgrade Process

DNS Visibility with Security Onion 12.04

UPDATE 2013-10-05: See the updated version of this blog post here:
http://securityonion.blogspot.com/2013/10/got-dns-visibility.html

There have been some interesting articles recently on the value of DNS visibility for security teams:

http://blogs.cisco.com/security/tracking-malicious-activity-with-passive-dns-query-monitoring/

https://blog.damballa.com/archives/1834/trackback

http://isc.sans.edu/diary.html?storyid=13918

If you don't already have good visibility into your DNS traffic, download Security Onion 12.04 now and see how Bro and ELSA can give you point-and-click DNS visibility in minutes!

Hunting through DNS traffic with Bro and ELSA

Security Onion 12.04 is now available!

Introduction

New to Security Onion?  Here's a short FAQ from Brad Shoop:

What is Security Onion?

Security Onion is a network security monitoring system that provides full context and forensic visibility into the traffic it monitors. At it's heart it is designed to make deploying multiple complex open source tools simple via a single package, reducing what would normally take days to weeks of work to minutes. Featuring Bro IDS, your choice of Snort or Suricata, Sguil analyst console, ELSA, Squert, Snorby and capME web interfaces, and the ability to pivot from one tool to the next seamlessly provides the most effective collection of network security tools available in a single package.  

What can it do for you?

• Signature-based detection - Whether you choose Snort or Suricata for signature-based detection, you'll have Snort and/or Emerging Threats signatures available for use.
• Context - Bro IDS provides visibility into the haystack, while signature-based detection targets the needle. Now you can know not only what signature-based events occurred, but you can have full context of all activity detected from the host involved. What domains a host queries, SSL certificates it's used, files downloaded, FTP/SMTP/IRC activity? All contextual questions that can help determine whether a signature-based alert is an event or an incident.
• Evidence - Full packet capture means you can know exactly what a host did. Sguil and its integration with other tools in Security Onion, such as Network Miner and Wireshark in addition to ELSA, Squert and Snorby via capME, allow an analyst to look at the evidence of a network attack frame by frame exactly as it happened, all with a click of a mouse.
• Tools - Security Onion is loaded with tools to monitor your network efficiently and effectively. Sguil provides the best security analyst console available in terms of function and utility. Squert and Snorby provide visibility into Sguil and Snort respectively, and ELSA provides a Splunk-like interface to the vast wealth of log data Security Onion will harvest from Bro, OSSEC and more.
• Save Money - It's free, well except for the hardware. But it will help you save a lot of money you might otherwise throw at commercial solutions and you could maybe spend some of that money so your analysts can become better.

What can't it do for you?

Security Onion is a network monitoring and detection system. It will not block an attack, nor is it designed to. It will however act as a video camera for your network for every connection it sees, not just the one's that it thinks are bad. In a world where detection rates are unpredictable, evidence like this can save you a lot of money.

Changes

No major changes since we announced RC1 and the ISO image, just a few small bug fixes:

• Setup no longer disables NIC offloading features on management interface
• Setup now disables the IPv6 stack on sniffing interfaces (can still sniff IPv6, though)
• if running Quick Setup, netsniff-ng is started with "-c" option to disable scatter/gather mode and force traffic to be written to disk instantly

Instructions

For full instructions on installing Security Onion 12.04, please see the installation page on our Wiki.

Screenshots

Booting ISO image

Booted into Live desktop, starting Xubuntu installer

Started Xubuntu installer

Completed Xubuntu installer, ready to reboot into new installation

Rebooted into new installation, ready to run Setup

Started Setup Wizard

Configuring /etc/network/interfaces

Selecting management interface

Selecting DHCP for this test VM

Selecting sniffing interfaces

Confirming network interface configuration, ready to reboot

Rebooted and ready to do the second phase of Setup

Started Setup Wizard

Setup detects that network interfaces have already been configured

Choosing Quick Setup for this test VM

Selecting interface to run sniffing processes on

Setting username for Sguil/Squert/ELSA

Setting email address for Snorby

Setting password for Sguil/Squert/Snorby/ELSA

Confirming password

Optionally enabling ELSA

Confirming selections

Setup wizard performs all configuration automatically

Setup Complete #1

Setup Complete #2

Setup Complete #3

Replaying sample pcaps to simulate network traffic

Logging into Snorby

Snorby Dashboard

Pivoting from IDS alert in Snorby to Full Transcript

Viewing full transcript in CapME

Logging into Squert

Squert Dashboard

Squert Signature Statistics

Squert GeoIP

Squert events

Logging into Sguil

Sguil RealTime Console

Sguil pivoting from IDS alert to full transcript

Logging into ELSA

ELSA query for Bro Notices

ELSA pivoting from Bro notice to full transcript

Full transcript in CapME