Security Onion

Tuesday, September 13, 2016

Security Onion Conference 2016 Slides and Videos now available!

Security Onion Conference 2016 was an overwhelming success! Thanks to all the sponsors, speakers, volunteers, and attendees. The slides and videos have been posted to the Conference page on our Wiki:
https://securityonion.net/conference

Friday, September 9, 2016

Security Onion 14.04.5.1 ISO image now available!

We have a new Security Onion 14.04.5.1 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of September 3, 2016!

This resolves the following issue:

Issue 879: 14.04.5.1 ISO image
https://github.com/Security-Onion-Solutions/security-onion/issues/879

This new ISO image has been tested by the following (thanks!):
Wes Lambert
James Taylor

New Installations
I've updated the Verify_ISO page for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/blob/master/Verify_ISO.md

Please remember to verify the signature of the downloaded ISO image using the instructions on that page.

Existing Deployments
If you have existing installations based on a previous 14.04 ISO image, there is no need to download the new ISO image. You can simply continue using our standard update process to install updated packages as they are made available:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Release Notes
For more information about this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Security-Onion-14.04-Release-Notes

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Friday, September 2, 2016

Squert development

Paul Halliday announced that he is no longer developing Squert:
http://www.pintumbler.org/words/youcantgobackonlyforward

We'd like to thank Paul for all of his hard work over the years!

Security Onion will continue to maintain its own fork of Squert.

Wednesday, August 31, 2016

securityonion-setup - 20120912-0ubuntu0securityonion228 resolves an issue

A new setup package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion228

This new package should resolve the following issue:

Issue 986: Setup: use default MTU
https://github.com/Security-Onion-Solutions/security-onion/issues/986

Thanks
Thanks to Wes Lambert for testing this package!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes on Friday September 2!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, August 24, 2016

securityonion-setup - 20120912-0ubuntu0securityonion226 resolves an issue

A new setup package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion226

This new package should resolve the following issue:

Issue 981: sosetup-network: bug when configuring management interface only
https://github.com/Security-Onion-Solutions/security-onion/issues/981

Thanks
Thanks to Wes Lambert for testing this package!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes on Friday September 2!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-web-page - 20141015-0ubuntu0securityonion68 resolves an issue

Tom Webb recently posted to the Internet Storm Center about checking HTTP status codes:
https://isc.sans.edu/forums/diary/522+Error+Code+for+the+Win/21377/

I've added a new HTTP Top Status Code query to the ELSA hunting menu and built a new package:
securityonion-web-page - 20141015-0ubuntu0securityonion68

This new package should resolve the following issue:

Issue 984: securityonion-web-page: add HTTP top status code
https://github.com/Security-Onion-Solutions/security-onion/issues/984

Thanks
Thanks to Wes Lambert for testing this package!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes on Friday September 2!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Tuesday, August 23, 2016

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion141 resolves an issue

Wes Lambert submitted a Pull Request which should automatically start Snort with a calculated snaplen setting passed via the --snaplen command-line option:
https://github.com/Security-Onion-Solutions/securityonion-nsmnow-admin-scripts/pull/8

I've merged the Pull Request and built a new package:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion141

This new package should resolve the following issue:

Issue 975: NSM: configure Snort snaplen via command line argument
https://github.com/Security-Onion-Solutions/security-onion/issues/975

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes on Friday September 2!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, August 22, 2016

securityonion-elsa-extras - 20151011-1ubuntu1securityonion37 resolves 2 issues

James Taylor and Josh Brower submitted updates for some ELSA patterns. I've merged their pull requests and built a new package:
securityonion-elsa-extras - 20151011-1ubuntu1securityonion37

This new package has been tested by James Taylor, Josh Brower, and Wes Lambert (thanks!) and should resolve the following issues:

Issue 979: securityonion-elsa-extras: additional patterns for Sysmon 4 and 4.11
https://github.com/Security-Onion-Solutions/security-onion/issues/979

Issue 983: securityonion-elsa-extras: add "AR-LOG" header to autoruns pattern
https://github.com/Security-Onion-Solutions/security-onion/issues/983

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes on Friday September 2!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Thursday, August 11, 2016

securityonion-setup - 20120912-0ubuntu0securityonion225 resolves an issue

I've updated the Setup package and the new package version is:
securityonion-setup - 20120912-0ubuntu0securityonion225

This new package has been tested by Wes Lambert (thanks!) and should resolve the following issue:

Setup: sosetup.conf SGUIL_CLIENT_USERNAME alphanumeric only #980
https://github.com/Security-Onion-Solutions/security-onion/issues/980

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes in just a few weeks!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, August 10, 2016

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion140 resolves an issue

I've updated the NSM scripts to wipe Suricata's stats.log when starting/restarting Suricata. The new package is:
securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion140

This new package has been tested by Wes Lambert (thanks!) and should resolve the following issue:

Issue 968: NSM: wipe stats.log when restarting Suricata
https://github.com/Security-Onion-Solutions/security-onion/issues/968

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration closes in just a few weeks!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Tuesday, August 9, 2016

securityonion-sguil-db-purge - 20120722-0ubuntu0securityonion17 resolves 3 issues

Wes Lambert submitted a pull request for sguil-db-purge:
https://github.com/Security-Onion-Solutions/securityonion-sguil-db-purge/pull/1

I merged the pull request and also did the following:

refactored mysql calls to use mysql defaults-file
added check for root privileges

This new package should resolve the following issues:

Issue 971: securityonion-sguil-db-purge: add command line options
https://github.com/Security-Onion-Solutions/security-onion/issues/971

Issue 972: securityonion-sguil-db-purge: update mysql calls
https://github.com/Security-Onion-Solutions/security-onion/issues/972

Issue 974: securityonion-sguil-db-purge: check for privileges
https://github.com/Security-Onion-Solutions/security-onion/issues/974

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, August 8, 2016

New ELSA packages resolve several issues

I've merged several pull requests:
https://github.com/Security-Onion-Solutions/securityonion-elsa-extras/pull/10
https://github.com/Security-Onion-Solutions/securityonion-elsa-extras/pull/15
https://github.com/Security-Onion-Solutions/securityonion-elsa-extras/pull/17
https://github.com/Security-Onion-Solutions/securityonion-elsa-extras/pull/18
https://github.com/Security-Onion-Solutions/securityonion-web-page/pull/5

Martin Holste merged several pull requests in his ELSA repo:
https://github.com/mcholste/elsa/pull/16
https://github.com/mcholste/elsa/pull/40
https://github.com/mcholste/elsa/pull/39
https://github.com/mcholste/elsa/pull/37

I've built new packages including all of these changes and the new
package versions are as follows:
securityonion-elsa - 1205chartsjsd3-1ubuntu1securityonion9
securityonion-elsa-extras - 20151011-1ubuntu1securityonion35
securityonion-web-page - 20141015-0ubuntu0securityonion67

These new packages should resolve the following issues:

Issue 950: ELSA: change Help link to point to ELSA Github
https://github.com/Security-Onion-Solutions/security-onion/issues/950

Issue 827: securityonion-elsa-extras: merge additional patterns including DNP3 and Modbus
https://github.com/Security-Onion-Solutions/security-onion/issues/827

Issue 970: securityonion-web-page: add queries for autoruns, dnp3, and modbus
https://github.com/Security-Onion-Solutions/security-onion/issues/970

Issue 973: securityonion-web-page: Apache ServerName localhost
https://github.com/Security-Onion-Solutions/security-onion/issues/973

Issue 964: securityonion-web-page: add "bottom" queries for long tail analysis
https://github.com/Security-Onion-Solutions/security-onion/issues/964

Issue 976: securityonion-web-page: additional protections in securityonion.conf
https://github.com/Security-Onion-Solutions/security-onion/issues/976

These packages have been tested by the following (thanks!):
Phil Plantamura
Josh Brower
Wes Lambert
James Taylor

Screenshots

DNP3 - Top SRC IPs

DNP3 - Top DST IPs

DNP3 - Top DST Ports

DNP3 - Top Requests

DNP3 - Top Replies

Modbus - Top SRC IPs

Modbus - Top DST IPs

Modbus - Top DST Ports

Modbus - Top Functions

Modbus - Top Exceptions

Autoruns Queries

DNS - Bottom Requests (Long Tail Analysis)

Updating
These packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Friday, August 5, 2016

New designs for securityonion.net and securityonionsolutions.com

We recently updated both https://securityonion.net and https://securityonionsolutions.com.

Hope you like them!

Tuesday, August 2, 2016

securityonion-squert - 20141015-0ubuntu0securityonion19 resolves XSS issue and disables Apache autoindex module

Manuel Mancera discovered a XSS issue in Squert:
https://github.com/int13h/squert/issues/76
https://groups.google.com/d/topic/security-onion/-x_PQQwm4bQ/discussion

securityonion-squert - 20141015-0ubuntu0securityonion19 resolves this XSS issue and also disables the Apache autoindex module:

Issue 967: Squert: Parameter not escaped in ip2c.php
https://github.com/Security-Onion-Solutions/security-onion/issues/967

Issue 969: Squert: prevent directory listing for subdirectories
https://github.com/Security-Onion-Solutions/security-onion/issues/969

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, August 1, 2016

securityonion-setup - 20120912-0ubuntu0securityonion224 resolves an issue

Wes Lambert submitted a pull request for sosetup:
https://github.com/Security-Onion-Solutions/securityonion-setup/pull/22

I've merged this pull request and the following package is now available:
securityonion-setup - 20120912-0ubuntu0securityonion224

This new package should resolve the following issues:

Issue 966: Setup: sosetup.conf needs to include MTU
https://github.com/Security-Onion-Solutions/security-onion/issues/966

Issue 592: sosetup: add -y option
https://github.com/Security-Onion-Solutions/security-onion/issues/592

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Thursday, July 28, 2016

securityonion-sostat - 20120722-0ubuntu0securityonion59 resolves an issue

Wes Lambert submitted some pull requests for sostat:
https://github.com/Security-Onion-Solutions/securityonion-sostat/pull/7
https://github.com/Security-Onion-Solutions/securityonion-sostat/pull/8

I've merged these pull requests and the following package is now available:
securityonion-sostat - 20120722-0ubuntu0securityonion59

This new package should resolve the following issue:

Issue 963: sostat: improve formatting
https://github.com/Security-Onion-Solutions/security-onion/issues/963

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, July 20, 2016

Suricata 3.1.1 now available for Security Onion!

Suricata 3.1.1 was recently released:
https://suricata-ids.org/2016/07/13/suricata-3-1-1-released/

I've packaged it and the following package is now available:
securityonion-suricata - 3.1.1-1ubuntu1securityonion1

This new package should resolve the following issue:

Issue 945: Suricata 3.1.1
https://github.com/Security-Onion-Solutions/security-onion/issues/945

This package has been tested by Wes Lambert. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

This update will back up each of your existing suricata.yaml files to suricata.yaml.bak and migrate your HOME_NET and EXTERNAL_NET variables. You'll then need to do the following:

re-apply any other local customizations to your suricata.yaml file(s)
update ruleset and restart Suricata as follows:
sudo rule-update

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Snort 2.9.8.3 now available for Security Onion!

Snort 2.9.8.3 was recently released:
http://blog.snort.org/2016/06/snort-2983-has-been-released.html

I've packaged it and the following packages are now available:
securityonion-snort 2.9.8.3-1ubuntu1securityonion1
securityonion-daq 2.0.6-0ubuntu0securityonion5

These new packages should resolve the following issue:

Issue 946: Snort 2.9.8.3
https://github.com/Security-Onion-Solutions/security-onion/issues/946

These packages have been tested by Wes Lambert. Thanks, Wes!

Updating
These packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

This update will back up each of your existing snort.conf files to snort.conf.bak and migrate your HOME_NET and EXTERNAL_NET variables. You'll then need to do the following:

re-apply any other local customizations to your snort.conf file(s)
update ruleset and restart Snort as follows:
sudo rule-update

PF_RING 6.4.1 now available for Security Onion!

PF_RING 6.4.1 was recently released:
http://www.ntop.org/pf_ring/pf_ring-6-4-just-released/
https://github.com/ntop/PF_RING/releases

I've packaged PF_RING 6.4.1 and backported some fixes for recent Ubuntu kernels:
https://github.com/ntop/PF_RING/commit/f5fbb56f70a737399f62300bbbfae3bc5adbcbe9
https://github.com/ntop/PF_RING/commit/0e4738d563cbb39e1ce88c116278a390ccc6d0a7
https://github.com/ntop/PF_RING/commit/e40b06114251cfa8f4a5713eb25a9c8a0ef98308
https://github.com/ntop/PF_RING/commit/7677ce2961c6ceab96824460c471ea3c2e3f4f56

The following packages are now available:
securityonion-pfring-daq 20121107-0ubuntu0securityonion13
securityonion-pfring-devel 20121107-0ubuntu0securityonion10
securityonion-pfring-ld 20120827-0ubuntu0securityonion10
securityonion-pfring-module 20121107-0ubuntu0securityonion28
securityonion-pfring-userland 20160708-1ubuntu1securityonion1

These new packages should resolve the following issue:

Issue 941: PF_RING 6.4.1
https://github.com/Security-Onion-Solutions/security-onion/issues/941

These packages have been tested by Wes Lambert. Thanks, Wes!

Updating
These packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Tuesday, July 19, 2016

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion138 resolves several issues

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion138 is now available and should resolve the following issues:

Issue 944: NSM: backup scripts should not prompt when run with --force-yes
https://github.com/Security-Onion-Solutions/security-onion/issues/944

Issue 561: NSM: nsm_server_backup-config should check FORCE_YES
https://github.com/Security-Onion-Solutions/security-onion/issues/561

Issue 937: NSM: remove sguild DEBUG 1 from postinst
https://github.com/Security-Onion-Solutions/security-onion/issues/937

Issue 943: NSM: add nsm_server_user-list
https://github.com/Security-Onion-Solutions/security-onion/issues/943

This package has been tested by Phil Plantamura and Wes Lambert. Thanks!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, July 18, 2016

securityonion-setup - 20120912-0ubuntu0securityonion222 resolves several issues

Wes Lambert submitted some Pull Requests for Setup. Thanks, Wes!

I've packaged Wes's changes and securityonion-setup - 20120912-0ubuntu0securityonion222 should resolve the following issues:

Issue 925: Setup: ask user for MTU of sniffing interface(s) and allow VLAN tags
https://github.com/Security-Onion-Solutions/security-onion/issues/925

Issue 926: Setup: ask user for HOME_NET
https://github.com/Security-Onion-Solutions/security-onion/issues/926

Issue 948: Setup: configure email
https://github.com/Security-Onion-Solutions/security-onion/issues/948

Issue 949: Setup: change http links to https
https://github.com/Security-Onion-Solutions/security-onion/issues/949

Issue 953: Setup: change "Emerging Threats GPL" to "Emerging Threats Open"
https://github.com/Security-Onion-Solutions/security-onion/issues/953

Issue 955: Setup: Nonstandard interface names not being detected
https://github.com/Security-Onion-Solutions/security-onion/issues/955

Issue 304: Setup: support unique interface names
https://github.com/Security-Onion-Solutions/security-onion/issues/304

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Training
Need training? Please see:
https://securityonionsolutions.com

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Security Onion Remote Training

Last week's Security Onion online training went very well. For those of you who missed it and would like to purchase access to the recordings, please see:
https://securityonionsolutions.com/ondemandtraining

The next round of online training sessions will be held Monday September 12 through Thursday September 15. For more information and to register, please see:
https://securityonionsolutions.com/onlinetraining

Thursday, July 7, 2016

securityonion-sostat - 20120722-0ubuntu0securityonion57 resolves two issues

Wes Lambert submitted some Pull Requests for sostat. Thanks, Wes!

I've packaged Wes's changes and securityonion-sostat - 20120722-0ubuntu0securityonion57 should resolve the following issues:

Issue 951: sostat: group packet loss stats into one section
https://github.com/Security-Onion-Solutions/security-onion/issues/951

Issue 960: sostat: output when current monitoring interval has not completed
https://github.com/Security-Onion-Solutions/security-onion/issues/960

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes is next week!
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, July 6, 2016

securityonion-capme - 20121213-0ubuntu0securityonion60 resolves an issue

Wes Lambert submitted a patch for CapMe to resolve an issue (thanks, Wes!):

Issue 956: CapMe: only close transcript when 'close' button is clicked
https://github.com/Security-Onion-Solutions/security-onion/issues/956

I've updated the following package:

securityonion-capme - 20121213-0ubuntu0securityonion60

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes is next week!
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, July 4, 2016

securityonion-web-page - 20141015-0ubuntu0securityonion60 resolves 2 issues

I've updated the following package:

securityonion-web-page - 20141015-0ubuntu0securityonion60

It should resolve the following issues:

Issue 952: securityonion-web-page: add FTP Data query to FTP category:
https://github.com/Security-Onion-Solutions/security-onion/issues/952

With the current FTP queries in ELSA, if you pivot to full packet capture, you only see the FTP control channel (you don't see actual files being transferred). This update add a new query to the FTP category to help users to find the FTP data channel where files are actually transferred.

Issue 957: securityonion-web-page: change public site hyperlinks to https
https://github.com/Security-Onion-Solutions/security-onion/issues/957

Our public websites for the Security Onion project and for Security Onion Solutions now default to https, so we're changing all hyperlinks from http to https.

Wes Lambert tested this package. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes is next week!
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and registration is open!
https://securityonion.net/conference

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Thursday, June 30, 2016

Security Onion Conference 2016: Registration is open!

Registration for Security Onion Conference 2016 is now open and the speaker lineup has been published!

https://securityonion.net/conference

Monday, June 13, 2016

Security Onion 14.04.4.2 ISO image now available!

We have a new Security Onion 14.04.4.2 ISO image now available that contains all the latest Ubuntu and Security Onion updates as of June 6, 2016!

This resolves the following issue:

Issue 913: 14.04.4.2 ISO image
https://github.com/Security-Onion-Solutions/security-onion/issues/913

This new ISO image has been tested by the following (thanks!):
Wes Lambert
Phil Plantamura

New Users
I've updated the Verify_ISO page for the new ISO image:
https://github.com/Security-Onion-Solutions/security-onion/blob/master/Verify_ISO.md

Please remember to verify the signature of the downloaded ISO image using the instructions on that page.

Existing Deployments
If you have existing installations based on a previous 14.04 ISO image, there is no need to download the new ISO image. You can simply continue using our standard update process to install updated packages as they are made available:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Release Notes
For more information about this release, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Security-Onion-14.04-Release-Notes

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Phil Plantamura has joined Security Onion Solutions LLC as COO

I'm very pleased to announce that Phil Plantamura is starting at Security Onion Solutions LLC today as Chief Operating Officer!

Monday, June 6, 2016

New CapMe and Squert packages resolve several issues

I've updated the following packages:

securityonion-capme - 20121213-0ubuntu0securityonion59
securityonion-squert - 20141015-0ubuntu0securityonion15

These new packages should resolve the following issues:

Issue 871: CapMe: add session support to avoid re-authenticating every time
https://github.com/Security-Onion-Solutions/security-onion/issues/871

Issue 930: CapMe: increase memory limit
https://github.com/Security-Onion-Solutions/security-onion/issues/930

Issue 933: CapMe: handle inactive/failed pcap_agents more gracefully
https://github.com/Security-Onion-Solutions/security-onion/issues/933

Issue 927: CapMe: Handle pcaps that generate no p0f output
https://github.com/Security-Onion-Solutions/security-onion/issues/927

Issue 934: CapMe: subdirectories should redirect to main page
https://github.com/Security-Onion-Solutions/security-onion/issues/934

Issue 935: CapMe: improve input validation on stime and etime variables
https://github.com/Security-Onion-Solutions/security-onion/issues/935

Issue 936: CapMe: replace include_once with require_once
https://github.com/Security-Onion-Solutions/security-onion/issues/936

Issue 867: Squert: pivot to CapMe for pcap
https://github.com/Security-Onion-Solutions/security-onion/issues/867

Issue 929: Squert: update mysql call in scripts
https://github.com/Security-Onion-Solutions/security-onion/issues/929

Wes Lambert tested these packages. Thanks, Wes!

Screenshots

capME now includes session support

Updating
Thess packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Thursday, June 2, 2016

securityonion-elsa-extras - 20151011-1ubuntu1securityonion32 resolves an issue

I've updated the following package:

securityonion-elsa-extras - 20151011-1ubuntu1securityonion32

It should resolve the following issue:

Issue 908: securityonion-elsa-extras: add securityonion-elsa-reset script
https://github.com/Security-Onion-Solutions/security-onion/issues/908

Wes Lambert tested this package. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion134 resolves an issue

I've updated the following package:

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion134

It should resolve the following issue:

Issue 931: nsm_sensor_backup-data missing leading slash in directory
https://github.com/Security-Onion-Solutions/security-onion/issues/931

Wes Lambert tested this package. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, June 1, 2016

securityonion-setup - 20120912-0ubuntu0securityonion215 resolves 3 issues

Wes Lambert submitted two pull requests and I've updated the following package:

securityonion-setup - 20120912-0ubuntu0securityonion215

It should resolve the following issues:

Issue 919: Setup: check minimum RAM requirements
https://github.com/Security-Onion-Solutions/security-onion/issues/919

Issue 923: Setup: warn user if they disable full packet capture
https://github.com/Security-Onion-Solutions/security-onion/issues/923

Issue 932: Setup: consistently apply title to all zenity windows
https://github.com/Security-Onion-Solutions/security-onion/issues/932

Wes Lambert tested this package. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, May 25, 2016

securityonion-capme - 20121213-0ubuntu0securityonion47 resolves 5 issues

I've updated the following package:

securityonion-capme - 20121213-0ubuntu0securityonion47

This package should resolve the following issues:

Issue 736: CapMe: Debug information occasionally gets rendered inside the transcript
https://github.com/Security-Onion-Solutions/security-onion/issues/736

Issue 738: CapMe: handle large pcaps more gracefully
https://github.com/Security-Onion-Solutions/security-onion/issues/738

Issue 916: CapMe: Check for gzip encoding and automatically switch to Bro transcript
https://github.com/Security-Onion-Solutions/security-onion/issues/916

Issue 922: CapMe: Handle sguild failure more gracefully
https://github.com/Security-Onion-Solutions/security-onion/issues/922

Issue 493: CapMe: send credentials interactively to avoid exposing on command line
https://github.com/Security-Onion-Solutions/security-onion/issues/493

Wes Lambert and Robert Bardo tested this package. Thanks, guys!

Screenshots

The CapMe submission form now includes a new field called Max Xscript Bytes (which defaults to 500,000) and the default Output option is now "auto".

With Output set to "auto", CapMe will check for gzip encoding and, if found, will automatically switch to the Bro transcript to decode the gzip.

If the transcript is larger than the Max Xscript Bytes setting (500,000 bytes by default), CapMe will display this at the bottom of the transcript.

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, May 23, 2016

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion133 resolves an issue

I've updated the following package:

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion133

This package should resolve the following issue:

Issue 924: NSM: set DEBUG 1 in /etc/sguild/sguild.conf
https://github.com/Security-Onion-Solutions/security-onion/issues/924

Wes Lambert tested this package. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
The next round of online classes will be in July:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Next Round of Security Onion Online Training Sessions - July 11 through July 14

The next round of online training sessions will be held Monday July 11 through Thursday July 14!

For more information and to register, please see:
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Tuesday, May 17, 2016

securityonion-sostat - 20120722-0ubuntu0securityonion53 resolves an issue

I've updated the following package:

securityonion-sostat - 20120722-0ubuntu0securityonion53

This package should resolve the following issue:

securityonion-sostat: mysql calls should use --defaults-file
https://github.com/Security-Onion-Solutions/security-onion/issues/915

Wes Lambert tested this package. Thanks, Wes!

Updating
This package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Online classes are running this week!
https://attendee.gototraining.com/9z73w/catalog/8119062504158470144

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, May 16, 2016

New rule-update, setup, and squert-cron packages resolve 9 issues

I've updated the following packages:

securityonion-rule-update - 20151201-1ubuntu1securityonion6
securityonion-setup - 20120912-0ubuntu0securityonion212
securityonion-squert-cron - 20120722-0ubuntu0securityonion9

These packages should resolve the following issues:

Issue 906: sosetup.conf: allow passwords with special characters
https://github.com/Security-Onion-Solutions/security-onion/issues/906

Issue 907: sosetup-fix-ppconf duplicating Snort community ruleset entries
https://github.com/Security-Onion-Solutions/security-onion/issues/907

Issue 904: Setup should run pulledpork and squert-ip2c as limited user
https://github.com/Security-Onion-Solutions/security-onion/issues/904

Issue 914: securityonion-setup: mysql calls should use --defaults-file
https://github.com/Security-Onion-Solutions/security-onion/issues/914

Issue 909: securityonion-rule-update: ensure barnyard/IDS are running before restarting
https://github.com/Security-Onion-Solutions/security-onion/issues/909

Issue 911: securityonion-rule-update: add cron option to force delay
https://github.com/Security-Onion-Solutions/security-onion/issues/911

Issue 918: securityonion-rule-update: cron delay should be at least 10 minutes
https://github.com/Security-Onion-Solutions/security-onion/issues/918

Issue 910: securityonion-squert-cron: add cron option to force delay
https://github.com/Security-Onion-Solutions/security-onion/issues/910

Issue 917: securityonion-squert-cron: cron delay should be at least 10 minutes
https://github.com/Security-Onion-Solutions/security-onion/issues/917

Wes Lambert tested these packages. Thanks, Wes!

Updating
These new packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Online classes start today!
http://blog.securityonion.net/2016/03/next-round-of-security-onion-online.html

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Monday, May 9, 2016

securityonion-elsa - 1205chartsjsd3-1ubuntu1securityonion8 resolves an issue with ELSA Dashboard GeoIP mapping

Martin Holste committed some fixes for ELSA dashboard maps recently:
https://github.com/mcholste/elsa/commit/1566d32054cb886a404c68fb6db8d5420d0f85b3

I've built new ELSA packages with all the latest fixes:
securityonion-elsa - 1205chartsjsd3-1ubuntu1securityonion8
securityonion-elsa-extras - 20151011-1ubuntu1securityonion30

These packages should resolve the following issue:

ELSA: Improve dashboard map shading #864
https://github.com/Security-Onion-Solutions/security-onion/issues/864

Wes Lambert tested these packages. Thanks, Wes!

You can build an ELSA GeoIP dashboard as shown here:
http://blog.securityonion.net/2016/02/securityonion-elsa-1205chartsjsd3.html

Updating
These new packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Our next round of online classes is next week!
http://blog.securityonion.net/2016/03/next-round-of-security-onion-online.html

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Thursday, May 5, 2016

Security Onion Conference 2016 CFP Closes in Less than a Month

CFP for Security Onion 2016 closes in less than a month! Get those proposals in now!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Thursday, April 28, 2016

securityonion-squert-cron - 20120722-0ubuntu0securityonion6 resolves 3 issues

securityonion-squert-cron - 20120722-0ubuntu0securityonion6 is now available and should resolve the following issues:

Issue 890: Squert ip2c cron job should sleep a random number of minutes
https://github.com/Security-Onion-Solutions/security-onion/issues/890

Issue 899: Squert ip2c cron job should run as a non-root user
https://github.com/Security-Onion-Solutions/security-onion/issues/899

Issue 903: Squert ip2c cron job should log to a log file
https://github.com/Security-Onion-Solutions/security-onion/issues/903

Wes Lambert tested this package. Thanks, Wes!

Updating
This new package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Several folks have asked about Security Onion t-shirts and they are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Our next round of online classes is coming up in a few weeks:
http://blog.securityonion.net/2016/03/next-round-of-security-onion-online.html

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Wednesday, April 27, 2016

securityonion-setup - 20120912-0ubuntu0securityonion207 adds more debug info and input validation

Wes Lambert submitted a Pull Request to add additional debug info and input validation:
https://github.com/Security-Onion-Solutions/securityonion-setup/pull/11

I've merged this Pull Request and created a new package:
securityonion-setup - 20120912-0ubuntu0securityonion207

This package should resolve the following issue:
https://github.com/Security-Onion-Solutions/security-onion/issues/902

James Taylor tested this package. Thanks, James!

Updating
This new package is now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Several folks have asked about Security Onion t-shirts and they are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Our next round of online classes is coming up in a few weeks:
http://blog.securityonion.net/2016/03/next-round-of-security-onion-online.html

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Tuesday, April 26, 2016

New ELSA packages resolve 2 issues

Martin Holste committed some fixes for ELSA email recently:
https://github.com/mcholste/elsa/commit/d6b57293ea2d83d35fc530e8d8071539013b3469
https://github.com/mcholste/elsa/commit/9ea0a9d6ed589297094b97c514f29e20eab0c567
https://github.com/mcholste/elsa/commit/6ad7966897a6c18573788d657cc6e28147dc9880

I've built a new ELSA package with all the latest fixes:
securityonion-elsa - 1205chartsjsd3-1ubuntu1securityonion7

Also, Harvii submitted a pull request to remove a non-ASCII character from securityonion-elsa-reset-archive:
https://github.com/Security-Onion-Solutions/securityonion-elsa-extras/pull/16

I've merged the pull request and the new package is as follows:
securityonion-elsa-extras - 20151011-1ubuntu1securityonion28

These packages should resolve the following issues:

Issue 881: ELSA: remove non-ascii character from securityonion-elsa-reset-archive
https://github.com/Security-Onion-Solutions/security-onion/issues/881

Issue 882: ELSA: fix email
https://github.com/Security-Onion-Solutions/security-onion/issues/882

Wes Lambert tested these packages. Thanks, Wes!

Updating
These new packages are now available in our stable repo. Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Several folks have asked about Security Onion t-shirts and they are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Our next round of online classes is coming up in a few weeks:
http://blog.securityonion.net/2016/03/next-round-of-security-onion-online.html

Conference
Security Onion Conference will be on Friday September 9 and CFP is open!
http://blog.securityonion.net/2016/03/security-onion-conference-2016-cfp.html

Support
Need support? Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!